search

spikex / strongbox

Secures ActiveRecord attributes with public key encryption
http://stuff-things.net/2009/04/17/introducing-strongbox/
MIT License
397 stars 43 forks source link

Validate uniqueness is possible? #48

Closed lucasprag closed 8 years ago

lucasprag commented 8 years ago

There is a way to validate uniqueness?

I thought in encrypt the new input of my field and try to search for it in the database, but seems that it wasn't working very well oO

Someone have an idea for validate uniqueness of a field?

lucasprag commented 8 years ago

Do you could help me please? oO @spikex

spikex commented 8 years ago

I'm afraid encryption and uniqueness don't mix. By design the encryption does not encrypt the same text the same way twice. If it did, it would be possible compare encrypted data making it much easier to crack.

So, you are not going to be able to use database uniqueness.

Probably your best bet would be to to store the a hash (say SHA-1) of the data you are encrypting in a different column and depend on it's uniqueness. Be sure to salt that hash, otherwise you are opening yourself up to a dictionary attack.

lucasprag commented 8 years ago

I see. Thanks =) @spikex