35 ms·

FHE @ plain text speed? Absolute bullshit. > You choose the encryption standard in use for the database, from AES, DES, 3DES, Blowfish, Twofish, Skipjack, and

by yarg 4y ago

FHE @ plain text speed? Absolute bullshit. > You choose the encryption standard in use for the database, from AES, DES, 3DES, Blowfish, Twofish, Skipjack, and more. That seems very wrong ((as far as I know) those standards are not in any way designed in such a way as to permit operations on their cyphertexts). > Vaultree has achieved major breakthroughs in several encryption technologies, allowing organisations to process fully encrypted data at near plaintext speed and keep their data safe even in case of a leak. That seems even wronger (security via obscurity at best).

bawolff 4y ago
> That seems very wrong ((as far as I know) those standards are not in any way designed in such a way as to permit operations on their cyphertexts). Those standards are meaningless by themselves without specifying a mode (e.g. GCM, CTR, CBC, ECB, etc). A thing people sometimes try to do with them (no idea if this is what vaulttree is doing) is use some less secure mode that is determistic and do equality matching (this is almost always a bad idea and usually leaks way more than you would naively assume). For example, if you use ECB mode you can search as long as you are searching along block boundries. https://www.microsoft.com/en-us/research/wp-content/uploads/2017/02/edb.pdf https://www.microsoft.com/en-us/research/wp-content/uploads/... is an interesting paper about this sort of thing.
- yarg 4y ago
  https://upload.wikimedia.org/wikipedia/commons/f/f0/Tux_ecb.jpg https://upload.wikimedia.org/wikipedia/commons/f/f0/Tux_ecb....
- l33t233372 4y ago
  ECB should never be used under any circumstances. Library creators would do well to rename their functions along the lines of ECB_NEVER_USE_THIS_IS_NOT_SECURE.
  - bawolff 4y ago
    In case it wasn't clear from my comment - i agree 100%
hectormalot 4y ago
How I read it is that you specify which ways you will use a column and then VT will create the various encrypted columns to support this. Deterministic shared key for matches only. Ordered encryption for ranges and FHE for various calculations. The latter probably being quite slow. I don’t think they are rolling their own crypto, just combining a lot of existing algorithms in various ways. I could see a use cases in either defense in depth and/or storing data in the cloud while having your keys somewhere else.
- yarg 4y ago
  They're claiming to have made breakthroughs in several encryption technologies, not that they've figured out a clever way to glue some things together. I could be wrong, but it smells like snake oil to me.

by yarg 4y ago

bawolff 4y ago

> That seems very wrong ((as far as I know) those standards are not in any way designed in such a way as to permit operations on their cyphertexts). Those standards are meaningless by themselves without specifying a mode (e.g. GCM, CTR, CBC, ECB, etc). A thing people sometimes try to do with them (no idea if this is what vaulttree is doing) is use some less secure mode that is determistic and do equality matching (this is almost always a bad idea and usually leaks way more than you would naively assume). For example, if you use ECB mode you can search as long as you are searching along block boundries. https://www.microsoft.com/en-us/research/wp-content/uploads/2017/02/edb.pdf https://www.microsoft.com/en-us/research/wp-content/uploads/... is an interesting paper about this sort of thing.

yarg 4y ago
https://upload.wikimedia.org/wikipedia/commons/f/f0/Tux_ecb.jpg https://upload.wikimedia.org/wikipedia/commons/f/f0/Tux_ecb....
l33t233372 4y ago
ECB should never be used under any circumstances. Library creators would do well to rename their functions along the lines of ECB_NEVER_USE_THIS_IS_NOT_SECURE.
- bawolff 4y ago
  In case it wasn't clear from my comment - i agree 100%

hectormalot 4y ago

How I read it is that you specify which ways you will use a column and then VT will create the various encrypted columns to support this. Deterministic shared key for matches only. Ordered encryption for ranges and FHE for various calculations. The latter probably being quite slow. I don’t think they are rolling their own crypto, just combining a lot of existing algorithms in various ways. I could see a use cases in either defense in depth and/or storing data in the cloud while having your keys somewhere else.

yarg 4y ago
They're claiming to have made breakthroughs in several encryption technologies, not that they've figured out a clever way to glue some things together. I could be wrong, but it smells like snake oil to me.