Sorry for my dumb question, but it's better to ask dumb question than to do dumb things silently.

I want to encrypt user email in my DB so that if someone stole the DB (and not the key) - he won't be able to restore the email adresses. But I need to be able to find user by email in my DB. And I can't iterate over all the emails in the DB, decrypt each and compare - this is too slow (minutes, hours).

If I encrypt emails with AES with random IV - then each time I encrypt the same email - the encrypted value is different. This is great for security but this way I can't just encrypt the given email and search for a value. If the IV is the same each time - then as far as I understand if attacker have enough encrypted values - he can easily find the key, right?

I was thinking about storing original email hash alongside the encrypted value, but this way attacker will be able to recover original email values by encrypting emails from some dictionary with the same hash algorithm and comparing hash values with values in the DB.

I thought about storing hash of original email+some_fixed_secret. Is this secure? If not - is there a secure solution to my problem?

  • $\begingroup$ While you say "find user by email", it seems like you're describing finding emails by username. $\hspace{.12 in}$ $\endgroup$
    – user991
    May 28, 2013 at 17:39
  • 1
    $\begingroup$ Why not just eschew the IV altogether and use a deterministic scheme? There are lots of recent results showing good provable security for deterministic schemes. Look at Boldyreva's CV for a couple of them. $\endgroup$
    – pg1989
    May 28, 2013 at 17:40
  • $\begingroup$ Ricky Demer, email is used not only as a login, e.g. for finding user friends already registered in the system (given the exported list of his contacts from other system), for ensuring email uniqueness etc. $\endgroup$
    – Mikhail
    May 28, 2013 at 17:50
  • $\begingroup$ pg1989, thanks! Using your advice I found some links at en.wikipedia.org/wiki/Deterministic_encryption including Boldyreva's work. Need to study them. $\endgroup$
    – Mikhail
    May 28, 2013 at 17:57
  • $\begingroup$ A fixed IV doesn't allow to find the key, but might allow decrypting other ciphertexts, depending on the encryption scheme. But you actually only need a one-way function. $\endgroup$ May 28, 2013 at 17:58

1 Answer 1


I ended up with the following solution:
For each email store two values: encrypted email and signature for the email.
For encryption I used AES in CBC mode with random IV.
For signing I used HMAC SHA256.
The keys used for encryption and for signing are different.

Later on I found the following link: docs.oracle.com. So looks like this is pretty standard approach.

  • $\begingroup$ +1 Looks good. For some applications, if the attacker already has an email address on his list, then he can already send spam to that address -- it doesn't hurt anyone if that attacker can confirm that you have the same address on your list (or not). So for those applications, non-keyed hash functions are adequate. See suppression list and Store hashed email and compare hash values. $\endgroup$
    – David Cary
    Jun 3, 2013 at 5:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.