search

defrex / django-encrypted-fields

This is a collection of Django Model Field classes that are encrypted using Keyczar.
MIT License
193 stars 60 forks source link

Make a query over encrypted field #17

Closed nairdaus closed 8 years ago

nairdaus commented 8 years ago

Hello, I'm using your library django encrypted fields and I have a problem when I make a query on the encrypted field. I'm using myModel.objects.filter(names__istartswith = mysearch) and django shows me the result decrypted, but the search is done over the encrypted text, for example: I search names with "A" and it shows me: Roberto... because its encrypted value is AB59cOgUT1lf.............. on my database.

Is there any command I can use to solve this issue? or any way you can suggest me so I can decrypt the field before doing the search?

defrex commented 8 years ago

Unfortunately what you're asking for is impossible. The decryption is done in the application layer, and the query is running in the DB layer.

Django simply turns MyModel.objects.filter(names__startswith='mysearch') into a SQL query roughly like SELECT * from myapp_mymodel where names LIKE 'mysearch%';.

You either have to live without querying, or store the data unencrypted.

rriehle commented 8 years ago

As @defrex has said, once data is encrypted what you're asking of the database is impossible. A work around is to load required fields into data structures at the application layer and then to run queries across those data structures. At that point "running queries" involves Python, not SQL or the Django ORM.