I am in need of an deterministic encryption algorithm I can use on social security numbers that i will store encrypted in a MongoDB and need to be able to search for them.
What I came up with is to use AES but purposefully gimp it using a un-changing IV. I just want to make sure I am not completely ruining the encryption and only doing what i need to do to enable searching.
To summarize, If you got a dump of the db with the SSNs encrypted as below, would you able to get the cleartext via some sort of attack without knowing the IV and Key? Would it help if i passed in the IV (instead of hard coding it) which would act as a second key?
this is a follow up to my other question
public class DeterministicAes
{
//random 16 byte iv
private static readonly string DeterministicIv = "YO9FhYEIpGd28mJNupCjvg==";
public static string SimpleEncryptWithPassword(string secretMessage, string password)
{
if (String.IsNullOrEmpty(secretMessage))
throw new ArgumentException("Secret Message Required!", "secretMessage");
var key = Convert.FromBase64String(password);
var iv = Convert.FromBase64String(DeterministicIv);
var cipherText = EncryptStringToBytes_Aes(secretMessage, key, iv);
return Convert.ToBase64String(cipherText);
}
public static string SimpleDecryptWithPassword(string cipherText, string password)
{
if (String.IsNullOrEmpty(cipherText))
throw new ArgumentException("Secret Message Required!", "cipherText");
var cipherTextBytes = Convert.FromBase64String(cipherText);
var key = Convert.FromBase64String(password);
var iv = Convert.FromBase64String(DeterministicIv);
return DecryptStringFromBytes_Aes(cipherTextBytes, key, iv);
}
//Credit: https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.aes?view=netframework-4.7.2#examples
static byte[] EncryptStringToBytes_Aes(string plainText, byte[] key, byte[] iv) {}
static string DecryptStringFromBytes_Aes(byte[] cipherText, byte[] Key, byte[] IV) {}
}
