0
$\begingroup$

I have PII in my logs that I would like to replace with hashes (e.g. sha3-256(salt + email)). The idea is that I can always go back to my logs and find all the log lines with that email address, by searching on the hash result of sha3-256(salt + email).

How hard would it be for folks to retrieve the original email address? I'm assuming the salt is fixed, and kept secret and the salt is >= 32 bytes.

Will this setup provide any real security if the logs are leaked?

/W

$\endgroup$
1
  • 1
    $\begingroup$ A salt is not secret by definition. What you consider is called a key and SHA3 has KMAC for those which much simpler than HMAC. How do you guarantee that the key is not compromised? An attacker will always go to the shorter path to their aim. $\endgroup$ – kelalaka Sep 4 '20 at 15:55
1
$\begingroup$

Will this setup provide any real security if the logs are leaked?

One issue is the fixed salt. With that, the translation of email to hash is fixed; that is, if the attacker sees two identical hashes, he knows that they were the same email address; he might not know what the email address is, but he knows that the two emails were to/from the same person. And conversely, if the hashes were different, then they referred to two different email addresses.

One possibility would be to include a 'per-hash' salt (salt1), which is randomly selected each time you generate a hash [1], and so the email address would be replaced by salt1 + sha3-256( salt + salt1 + email ) (where + is string concatenation).


[1]: You could generate the per-hash salt sequentially if the order you generated the hashes didn't need to be secret; this would allow the per-hash salt to be shorter without worrying about duplications.

$\endgroup$
1
  • 2
    $\begingroup$ The possible solution prevents the SELECT query, therefore one has to process all of the logs one by one, though there are not a fast and secure solution for this, AFAIK. $\endgroup$ – kelalaka Sep 4 '20 at 15:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.