6 / 7 Encryption, Keys & Secrets

Search Without Seeing

Government IDs are stored with field-level encryption using AES-GCM with a random nonce per row. Support now needs exact-match lookup by ID, and the current plan is to scan the table and decrypt every row in the application. What is the standard way to make this lookup indexable?

A

Push the comparison into the database with a function that calls KMS decrypt for each row during the scan

B

Add an indexed column holding a keyed HMAC of the normalized value and query on that column instead

C

Index the AES-GCM ciphertext column directly, since the same plaintext under the same key produces the same ciphertext

D

Store an unkeyed SHA-256 of the value in an indexed column, which is one-way and therefore safe to expose