What is the main difference between one-way encryption, Transparent data encryption (TDE) and data encryption? If one needs to store passwords or credit card details in the DB, which one is best to use?

What I have understood from my search is that an example of one-way is hash, in this case is the password encrypted at storage or just hidden from the DBA? And that with TDE the data is encrypted at storage only, so is it more applicable to use one-way encryption rather than TDE to hide details from the DBA/users?


You are right that "one-way" thing is hash function, and in fact, it's not encryption at all! Password hashing is different from data/file hashing in that data/file hashing algorithms like SHA-256 are deterministic and (supposedly) efficient; whereas password hashing is in practice non-deterministic so as to deter various types of precomputation attacks.

The difference you'll encounter with transparent data encryption and data encryption, is that TDE don't need you to rewrite your application to enjoy the benefit brought by encryption, where as data encryption on its own, requires processing data using cipher functions. Hence the name "transparent" data encryption.

That's all you have to know for now, you're welcome to learn more if you can get your head around it.

| improve this answer | |
  • $\begingroup$ Non-deterministic? Than, how one can re calculate to compare? $\endgroup$ – kelalaka Apr 12 '19 at 12:06
  • $\begingroup$ Hashing a password is non-deterministic, but verifying is deterministic based on the salt part of the hash of the password. $\endgroup$ – DannyNiu Apr 12 '19 at 13:29
  • $\begingroup$ @kelalaka semi-deterministic? The algorithm is deterministic but the implementations apply randomization via salts $\endgroup$ – Natanael Apr 12 '19 at 16:18
  • $\begingroup$ Randomization is just a method of getting a probably-unique salt. You could use a username and update counter as a salt instead, and it would provide exactly the same security. The point of a salt in a password hash is to use a distinct function for each instance to thwart attacks that save effort on many instances of the same function. $\endgroup$ – Squeamish Ossifrage Apr 13 '19 at 14:43
  • $\begingroup$ The OPAQUE Password Authenticated Key Exchange (PAKE) protocol is nondeterministic and a good way to verify passwords. It doesn't even store a salted hash, but rather a verifier. The verifier's generation includes a random value, but verifying it does not depend on the random value. A bit like $k$ in ECDSA. $\endgroup$ – SAI Peregrinus Apr 15 '19 at 3:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.