dandraper

6 ms·

31.
by dandraper 2y ago
Protect.js makes encrypting sensitive fields in Node apps like Next.js simple for devs without the need for expertise in cryptography. It supports searchable encryption, integrates with Auth0, Okta and Clerk and works with the performance-f
32.
Show HN: Protect.js: Super fast, dev-friendly encryption-in-use for Node apps(cipherstash.com)
5 points by dandraper 2y ago|1 comments
33.
by dandraper 3y ago
Clearing memory of secrets is a black art. This post is a summary experiments I ran to convince myself that memory in Rust _really_ is being Zeroized.
34.
Verifying Rust Zeroize with Assembly Including Portable SIMD(cipherstash.com)
8 points by dandraper 3y ago|1 comments
35.
by dandraper 3y ago
As with any secure system, it depends on your threat model but the early versions of OPE are woefully insecure. The attack you're describing sounds like the one on the Boldyreva scheme from 2009. While all OPE schemes leak some infor
36.
by dandraper 3y ago
Note that this paper is about the CLWW scheme of 2015. The Lewi-Wu Scheme of 2016 (Block Order Revealing Encryption) has entirely different security properties. Storage of the right ciphertexts (as they describe in the paper) is semanticall
37.
by dandraper 3y ago
That's true except that if that session key is lost or exfiltrated, the scope of the breach is everything that key was used to encrypt (all of the user's data in your example). The other consideration is how to safely cache the da
38.
by dandraper 3y ago
It's a good idea. CBC without verification is vulnerable as well. An attacker can modify the IV and the value will still decrypt. It's quite easy to change a what plaintext will pop out the other side and the client will be none-t
39.
by dandraper 3y ago
The security properties become much more interesting when the data remains encrypted when it leaves the database. For example, an ETL process doesn't necessarily need to know what data is, just the structure. Transferring data between
40.
by dandraper 3y ago
Homomorphic is literally hundreds of thousands of times slower than operations on plaintext. A comparison of 2 64-bit integers can take around > 50ms. So even with a b-tree where maybe ~100 comparisons could occur, the query will take 5s
41.
by dandraper 3y ago
The only problem with KMS in this model is that to get that auditability you need a data key per value/record. That means every decryption requires a request to KMS as it does not (and likely won't ever) support batched requests.
42.
by dandraper 3y ago
If you're using AES in GCM mode? Bad...like catastrophic. An attacker can reveal the key. If you want to use constant IV for deterministic (exact) lookups. Make sure you use AES in SIV mode which is resistant to IV reuse or CBC mode wi
43.
by dandraper 3y ago
Key management and ability to support SQL/searching are the 2 biggest considerations. `pg_enquo` uses Block ORE which is reasonably secure but results in very large (like 100x) ciphertext sizes. For an alternative (also written in Rust
44.
by dandraper 4y ago
Absolutely! FHE isn't practical for most applications.
45.
by dandraper 4y ago
Not yet but that's a good suggestion! The core client code is Rust so additional languages are (mostly) just native bindings to Rust. We will be releasing the Rust SDK publicly soon and welcome contributions!
46.
by dandraper 4y ago
Its not Homomorphic but "structural encryption". Less useful than HE but faster.
47.
by dandraper 4y ago
This feature is a result of MongoDB's acquisition of Aroki. It looks like a good product but we actually beat them to it with https://cipherstash.com/activestash CipherStash works with any Database and also supports Ra
48.
by dandraper 5y ago
I love this concept. Mail platforms are just another place where sensitive data has to be managed!
49.
Australian documentary tackles gender diversity in tech(debuggingdiversity.com)
2 points by dandraper 7y ago|0 comments
50.
Is it time to ditch the term “full-stack”?(engine.expert360.com)
3 points by dandraper 9y ago|2 comments
51.
Codr.TV aims to address gender imbalance in tech scene(startupdaily.com.au)
2 points by dandraper 12y ago|0 comments