Hacker News Reader

Comment by yarg | Hacker News Reader

FHE @ plain text speed?

Absolute bullshit.

> You choose the encryption standard in use for the database, from AES, DES, 3DES, Blowfish, Twofish, Skipjack, and more.

That seems very wrong ((as far as I know) those standards are not in any way designed in such a way as to permit operations on their cyphertexts).

> Vaultree has achieved major breakthroughs in several encryption technologies, allowing organisations to process fully encrypted data at near plaintext speed and keep their data safe even in case of a leak.

That seems even wronger (security via obscurity at best).

View on HN

> That seems very wrong ((as far as I know) those standards are not in any way designed in such a way as to permit operations on their cyphertexts).

Those standards are meaningless by themselves without specifying a mode (e.g. GCM, CTR, CBC, ECB, etc). A thing people sometimes try to do with them (no idea if this is what vaulttree is doing) is use some less secure mode that is determistic and do equality matching (this is almost always a bad idea and usually leaks way more than you would naively assume). For example, if you use ECB mode you can search as long as you are searching along block boundries.

https://www.microsoft.com/en-us/research/wp-content/uploads/... is an interesting paper about this sort of thing.

ECB should never be used under any circumstances. Library creators would do well to rename their functions along the lines of ECB_NEVER_USE_THIS_IS_NOT_SECURE.

In case it wasn't clear from my comment - i agree 100%

https://upload.wikimedia.org/wikipedia/commons/f/f0/Tux_ecb....

How I read it is that you specify which ways you will use a column and then VT will create the various encrypted columns to support this. Deterministic shared key for matches only. Ordered encryption for ranges and FHE for various calculations. The latter probably being quite slow. I don’t think they are rolling their own crypto, just combining a lot of existing algorithms in various ways.

I could see a use cases in either defense in depth and/or storing data in the cloud while having your keys somewhere else.

They're claiming to have made breakthroughs in several encryption technologies, not that they've figured out a clever way to glue some things together.

I could be wrong, but it smells like snake oil to me.

Reply on news.ycombinator.com