String Encryption with JASYPT + Hibernate + Spring

Question

I integrated successfully my Spring Hibernate backend with Jasypt. According to following entity class I have encrypted it's name field, due to encryption process take place now database student table's name column contains encrypted data.

I need to know,

1) When I write some DAO query for search some student by his name, whether I have to pass that search text as plain text or I have to encrypt that value too?

2) With DAO query when I list down all the students order by to their names, then it supposes to sort according to database level encrypted values or decrypt (real) values ( that mean Jasypt will decrypt those values for me)?

Thanks.

Entity class

@Entity
@Table(name = "student")
public class Student implements Serializable {

    @Id
    @GeneratedValue 
    @Column(name = "ID")
    private Integer id;

    @Type(type="encryptedString")
    @Column(name = "name")
    private String name;
}

DAO class

     public interface StudentRepository extends CrudRepository<Student, Integer> JpaSpecificationExecutor<Student> {

        public List<Student> findByName(String searchText);  

        public List<Student> findAll(null, (new Sort(Direction.ASC, "name")));  
     }

Maarten Bodewes · Accepted Answer · 2015-02-14 14:20:02Z

From the Jasypt page on Hibernate:

But encryption sets a limitation on your Hibernate usage: security standards establish that two different encryption operations on the same data should not return the same value (due to the use of a random salt). Because of this, none of the fields that are set to be encrypted when persisted can be a part of a WHERE clause in your search queries for the entity they belong to.

This disallows searching for student names. This is to be expected since Jasypt doesn't perform homomorphic encryption (i.e. encryption where certain operations are permitted). Homomorphic encryption is still very much in its infancy, and most implementations cannot be directly deployed in the field.

Encrypting the search query doesn't work because the encryption is not deterministic. I.e. even if you encrypt the search query you would still get a different value because of the random salt.

In general I would not mark something so basic as a student name to be confidential information. You'd be better off to encrypt the entire database if encryption is really deemed necessary.

Collectives™ on Stack Overflow

String Encryption with JASYPT + Hibernate + Spring

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related