Fast, highly effective database security using searchable encryption (without the yak shave)
summary
Claims that encrypting every value with identity‑derived keys makes encryption act as access control and keeps SQL queries usable by adding searchable primitives. Uses a custom key server called Zer KMS (batch ops, runs anywhere) plus an encrypted query layer eql / equalPi and primitives like order‑revealing encryption and Bloom‑filter searches. Reports first KMS was ~9× faster than AWS KMS and a rewrite up to ~500× faster; range queries add ~700 μs overhead at 100M rows, and SQL compatibility still holds.
AI-written summary · about
chapters (20)
- 0:00Introduction
- 0:48Data flow in applications
- 3:18Policy-based access control
- 5:25Row-level security failures
- 6:30Traditional encryption problems
- 8:21GCM mode encryption
- 10:30Encryption for access control
- 11:55Key server for secure encryption
- 14:45AWS KMS limitations
- 17:16Cypher Stash Zero KMS
- 17:37Need for searchable encryption
- 19:04Order-revealing encryption
- 20:08Fuzzy text search with Bloom filters
- 21:35Encrypted Query Language benefits
- 23:44System solutions and advantages
- 24:26About Cypher Stash resources
- 25:08Q&A
- 26:50Q&A
- 27:53Q&A
- 28:20Q&A
related talks
29mProtecting data vs systems: practicality, performance, and problems...
51mKeynote: Data is a new security boundary
23mEncrypted Search Party
19mTop Security Questions: Delight Your CISO and Protect Your Business
48mProtecting the confidentiality and integrity of your high value data with Azure SQL and SQL Server 2
59mDatabase Encryption in a GDPR World
48mGetting To Know SQL Server Encryption Capabilities
43mConfidential development with Always Encrypted using enclaves