5 ms·
That solution does not work for frontend encrypted data. It also does not work for short strings, such as days, months, years, street numbers.
by randunel 7y ago
That solution does not work for frontend encrypted data. It also does not work for short strings, such as days, months, years, street numbers.
- gtsteve 7y agoCould you not also just throw in 1-2kb of random data with your short data? Your app can then just disregard all text after a null bye or something similar. I'm not a cryptographer but that sounds like a good strategy when encrypting very short strings to resist cryptanalysis.
- nitboss 7y agoFirstly disclaimer that I work at Very Good Security. ec109685 is right and this is precisely what VGS does. Most companies collect sensitive data (PII/PCI) to achieve a business objective, like verifying identity, age, creditworthiness or to authorize payment. Storing and securing this data is not their primary objective and possession of data comes with the burden of compliance and regulations. VGS acts as a proxy aliasing sensitive datasets as the data flows between systems. When it is time to use this data, VGS acts as a proxy replacing the aliases with real values as data has to be exchanged with third parties. When dealing with short attributes, combining several other parts of the form to create a composite alias partitioned over the different parts of the payload gets the job done. This would expand the size of the short integer. Adjacent encodings in Chinese, Korean and Japanese characters further expand possibilities.