Thoughts on adding an Order Preserving Encryption algorithm?

[jdraths]

It's probably a common use case to need to be able to order by the encrypted data, for instance:

class User < ActiveRecord::Base
  attr_encrypted :email, key: [ENV['ENCRYPTION_KEY']].pack("H*")
  blind_index :email, key: [ENV['BLIND_INDEX_KEY']].pack("H*")
end

User.order(:email)

I think the only way of being able to do this would be adding an order preserving encryption algorithm like ope-rb. Is there any widely accepted order preserving encryption algorithm?

[ankane]

Hey @jdraths, I only have a basic understanding of order preserving encryption, but I believe it can leak a significant amount of information. If you use order-preserving encryption, you shouldn't need blind indexing, since the encryption itself is deterministic.

It looks like there are order preserving hash functions as well, but they are trivial to crack with binary search. https://crypto.stackexchange.com/questions/8160/secure-order-preserving-hash-function

To sort a small number of records, you can decrypt and sort in memory.

Do you have a particular use case in mind?

[jdraths]

Thanks for the quick response.

In my case I have a series of Users that belong to an Account. An account administrator is performing some maintenance on the user accounts and wants to be able to sort by email address. In some cases we have 1000s of Users belonging to an Account. I didn't really want to load them all into memory to be able to sort their emails, but I definitely could. I could also in theory order the records via javascript in the browser. I'll try that and see how many records my machine can order in a reasonable time frame.

GDPR brought me here and it's pretty interesting running into the real world implications of encryption.

[ankane]

If there's not a strong business reason to sort by email, my advice would be to not allow it. Anyways, thanks for the discussion 👍

[jdraths]

Yes, at this time I'm not allowing it unless the user filters to smaller amount of records and then I allow ordering via javascript in the browser.

Thanks for the feedback. It really is interesting running into these real world hurdles from GDPR. In hindsight they were obvious, but I never recognized them until I actually hit them head on.