3

is this possible?

For a model with EncryptedCharField named "first_name" i notice that the field does not decrypt when I search on it. In all other uses it is fine. This does not work:

if form.is_valid():
    cd = form.cleaned_data
    search_results = MyTable.objects.filter(first_name__icontains=cd['search_term'])

is this by design or am i doing something wrong? thanks for you help...

Encrypting the search term first, even if the exact decrypted value, would not work as the cipher is not going to be the same as the one stored in the db. So this would not work:

crypter = Crypter.Read(settings.ENCRYPTED_FIELD_KEYS_DIR)
if form.is_valid():
    cd = form.cleaned_data
    cipher = crypter.Encrypt(cd['search_term'])
    search_results = MyTable.objects.filter(first_name__icontains=cipher)
4
  • So it does work for first_name__istartswith=cd['search_term']? Dec 1, 2010 at 17:33
  • My guess it is not possible because with all the other search functions, the value is probably encrypted first and then compared with the value in the database. This would work for _exact at the very least. Not sure how it would work with _iexact honestly, since most encryption methods will absolutely treat A and a completely differently. Dec 1, 2010 at 17:35
  • Yes this is what is does, EncryptedCharField's get_db_prep_value() encrypt's the value and to_python() decrypts. They use keyczar. But when I test in a shell, encrypting a value twice, using the same key, does not generate the same cipher. But of course the cipher always decrypts correctly. So __exact would not work nor __istartswith. Although absurd, it "works" if I do not encrypt the cipher and use part of the stored cipher as the search term.
    – erikvw
    Dec 1, 2010 at 21:39
  • soory, meant to say: Although absurd, it "works" if I do not encrypt the "search term" and use part of the stored cipher as the search term.
    – erikvw
    Dec 1, 2010 at 21:49

2 Answers 2

2

When something is encrypted (or at least, when it is done properly), it is impossible to gain the value that has been encrypted, without knowing the value. This means that while you can check the value of say a password very quickly, as the user has given you the value of the password, it is very hard to find out the value of the password from the encrypted string. This is part of the P=NP topic.

When you search say via MyTable.objects.filter(first_name=cipher), you are just comparing encrypted strings, which is fine. However, when you try MyTable.objects.filter(first_name_icontains=cipher), you are asking django to unencrypt all of the values, compare them, then return what matches. However, django cannot do that, as no one knows what the value of the decrypted first_name field is. This is by design, as it means that even if the database is compromised, the data is safe (It is also why you should beware any website or organisation that will show you your password, as it means they have not encrypted the value in their database). Overall, not being able to see a users password is a good thing, and even if you do not agree, it is a small price to pay for good security.

3
  • i agree with your point, but i need to encrypt names and personal identifiers and maintain the ability to search and order on these values as well as use a UNIQUE constraint. All which seems not to work and perhaps not practical. Might this be a "manager" issue?
    – erikvw
    Dec 1, 2010 at 21:42
  • The only way you can do this is by having a CharField, and firstly saving the raw encrypted unmodified string, then storing after it (say in csv form) every different combination of letters that you want to be able to search for. So foo would become foo, fo, oo. By doing this you decrease the security of the system massively, to the extent you might as well not encrypt them. In short, if you require searching, you cannot encrypt your values; partial encrypted values are not infix of the fully encrypted value. Dec 2, 2010 at 10:55
  • these are good points. seems what i wanted cannot be done in any useful way. i have dropped the encrypted field altogether. thanks!!
    – erikvw
    May 24, 2011 at 20:29
2

You could simply store the HMAC hash of the value in another field, then search for that.

1
  • 1
    No, the OP cannot do that for all data. If he wants to search all 'John' on the database, it will be impossible. A HMAC will only be useful when searching for perfect matches.
    – ThoriumBR
    Feb 18, 2016 at 17:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.