search

47ng / prisma-field-encryption

Transparent field-level encryption at rest for Prisma
https://github.com/franky47/prisma-field-encryption-sandbox
MIT License
246 stars 29 forks source link

Filter with "contains" #93

Closed multipliedtwice closed 10 months ago

multipliedtwice commented 10 months ago

Hello, thank you for an amazing library. How can I enable "contains" filtering, if it's possible?

franky47 commented 10 months ago

As stated in the filtering documentation (emphasis added):

This is because the encryption is not deterministic: encrypting the same input multiple times will yield different outputs, due to the use of random initialisation vectors to keep ciphertext safe. Therefore Prisma cannot match the query to the data.

To circumvent this issue, the extension provides support for a separate field containing a hash of the clear-text input, which is stable and can be used for exact matching (partial matching like startsWith, contains is not possible).

It would technically be possible to use something like homomorphic encryption to enable arbitrary search on encrypted fields, but since current implementations would take several minutes to return results, I doubt it's something worth exploring further for this use-case until more performant solutions show up.

Read more here: https://soatok.blog/2023/03/01/database-cryptography-fur-the-rest-of-us/