Viewing profile — dandraper

Sorry I was imprecise. Query logging would tell you what queries were executed. E.g the following would tell you that 10 user records were returned with name and email but not whic…

> What does the risk profile look like in a full leak of the encrypted database? We actually have a number of different schemes which trade leakage for performance/storage overhead…

Because queries are encrypted, too. And you need to be authorized to encrypt a query term. That's the whole crux. TBH, I'm so close to this now I forget that part isn't obvious! Yo…

Let’s chat dan@cipherstash.com

Applications do not have access - individual authenticated users have access. A user must be authenticated & authorised in order to be able to create encrypted query terms. This is…

Thanks for all the comments. CipherStash isn't something that we just threw together on a weekend. We've spent years developing it. I've personally invested almost every waking mom…

lol yeah. Just a side chain that I found on a weekend. 8 years and $10m later. Couldn’t possibly be real now could it?

Yep, we’ve read the papers. Naveed et al and Grubbs et al primarily.

This doesn’t have anything to do with being able to change the code. Devs can code and change things as they need. The database is also the same as it always is. What CipherStash d…

No, to derive a key you need a client key (controlled by the app) and key-seeds for each value which can only be retrieved from the key server with a valid JWT. The JWT is time bou…

Encrypted*.

It is indeed the case.

No, not by default. You could but as you said, that would be a A LOT of data. It depends on your setup. If you're using Supabase, one way is to send the logs to Clickhouse and use …

Not just each column, each value . The answer to your question is yes. Explanation: The identifier is actually for the key that encrypts the value (1 unique key per value). 1. When…

CipherStash - specifically the key service. There is a lot of data for sure but we only record an identifier for each value and (optionally) the user ID. It compresses well.

If we do, I'll be sure to attribute it to this thread :p

See above but some additional points: Keys are not stored in the database or in the application. Every data key is derived at query time via a 2-party system: 1. by the key server …

I've replied above

Searchable encryption means you can have encryption and queries (from apps etc) still work for authorized users. This is all started when I was the CTO of a health-tech and the eng…

Also the proxy runs in your infra not ours (docker container).

Hey, CipherStash founder here: So we actually have 2 kinds of encryption: * standard encryption which can be decrypted (we call this "source" encryption) * what we call SEM: search…

CipherStash founder here. If a column is encrypted using standard encryption (like AES-GCM) then the values are non-deterministic and fully randomized. That means that if you encry…

CipherStash founder here: I'll cop it about the website - we're a small team so we lean on AI for marketing copy but this is a reminder that we need to do better. The tech is the r…

Hey, CipherStash founder here. Our model is that data is encrypted in the application before being saved to the database. In order to encrypt, decrypt or query, you need to use the…