You are building a new system that needs to collect social security numbers (SSNs) from its users.Let’s start with a simple scenario (which might be particularly relevant for a lot of local government or health care applications): If you’re in a hurry, feel free to skip ahead to the solution. Our secure solution is rather straightforward, but the path between most teams asking that question and discovering our straightforward solution is fraught with peril: bad designs, academic research projects, misleading marketing, and poor threat modeling. You know how to search database fields, but the question is, How do we securely encrypt database fields but still use these fields in search queries? This was one of the “weird problems” covered in my talk at B-Sides Orlando (titled Building Defensible Solutions to Weird Problems), and we’ve previously dedicated a small section to it in one of our white papers. This question shows up from time to time in open source encryption libraries’ bug trackers.
We get asked the same question a lot (or some remix of it). This post was originally published on the ParagonIE blog and reposted here with their permission.
0 kommentar(er)
