Cryptographic key generation for logically sharded data stores
The present disclosure relates to deriving cryptographic keys for use in encrypting data based on a plaintext to be encrypted. An example method generally includes receiving, from a querying device, a request for a cryptographic key. The request generally includes data derived from a plaintext value to be encrypted and an indication of a type of the plaintext value to be encrypted. A cryptographic key is generated based, at least in part, on the derived data and the type of the plaintext value to be encrypted. The key deriver transmits the generated cryptographic key to the querying device.
1. A method for generating cryptographic keys to secure sensitive data in data queries, comprising:
receiving, from a querying device, a request for a cryptographic key, the request including a cryptographic hash of a plaintext value to be encrypted and an indication of a type of the plaintext value to be encrypted;
generating a cryptographic key based, at least in part, on at least a portion of the cryptographic hash of the plaintext value to be encrypted and the type of the plaintext value to be encrypted, wherein:
the at least the portion of the cryptographic hash of the plaintext value to be encrypted comprises a truncated version of the cryptographic hash of the plaintext value to be encrypted having a length of n characters, and
n is less than a length of the cryptographic hash of the plaintext value to be encrypted; and
transmitting the generated cryptographic key to the querying device.
2. The method of claim 1 , wherein truncating the cryptographic hash of the plaintext value to be encrypted comprises:
deleting characters in the cryptographic hash of the plaintext value to be encrypted up to a specified beginning location; and
deleting characters in the cryptographic hash of the plaintext value to be encrypted after a predefined number of characters from the specified beginning location.
3. The method of claim 2 , wherein the specified beginning location is associated with the type of the plaintext value to be encrypted.
4. The method of claim 1 , wherein the cryptographic key is generated based further on a cryptographic salt associated with the type of the plaintext value to be encrypted.
5. The method of claim 1 , further comprising:
determining that a key rotation is in progress for a type of data stored in a database;
generating a new base cryptographic key for the type of data; and
upon determining that the key rotation has completed, discontinuing use of a deprecated base cryptographic key for generating cryptographic keys for the type of data stored in the database.
6. The method of claim 5 , further comprising:
receiving, while the key rotation is in progress, a second request for a cryptographic key from the querying device including cryptographic hash of a second plaintext value to be encrypted, wherein the second plaintext value is associated with the type of data for which the key rotation is in progress;
generating a first cryptographic key based on the deprecated base cryptographic key and the cryptographic hash of the second plaintext value to be encrypted and a second cryptographic key based on the new base cryptographic key and the cryptographic hash of the second plaintext value to be encrypted; and
transmitting the first cryptographic key and the second cryptographic key to the querying device.
7. The method of claim 1 , further comprising:
encrypting the portion of the cryptographic hash, wherein the cryptographic key is generated based on the encrypted portion of the cryptographic hash.
8. A system, comprising:
a processor; and
a memory having instructions stored thereon which, when executed by the processor, causes the processor to perform an operation for generating cryptographic keys to secure sensitive data in data queries, the operation comprising:
receiving, from a querying device, a request for a cryptographic key, the request including cryptographic hash of a plaintext value to be encrypted and an indication of a type of the plaintext value to be encrypted;
generating a cryptographic key based, at least in part, on at least a portion of the cryptographic hash of the plaintext value to be encrypted and the type of the plaintext value to be encrypted, wherein:
the at least the portion of the cryptographic hash of the plaintext value to be encrypted comprises a truncated version of the cryptographic hash of the plaintext value to be encrypted having a length of n characters, and
n is less than a length of the cryptographic hash of the plaintext value to be encrypted; and
transmitting the generated cryptographic key to the querying device.
9. The system of claim 8 , wherein truncating the cryptographic hash of the plaintext value to be encrypted comprises:
deleting characters in the cryptographic hash of the plaintext value to be encrypted up to a specified beginning location; and
deleting characters in the cryptographic hash of the plaintext value to be encrypted after a predefined number of characters from the specified beginning location.
10. The system of claim 9 , wherein the specified beginning location is associated with the type of the plaintext value to be encrypted.
11. The system of claim 8 , wherein the cryptographic key is generated further based on a cryptographic salt associated with the type of the plaintext value to be encrypted.
12. The system of claim 8 , wherein the operation further comprises:
determining that a key rotation is in progress for a type of data stored in a database;
generating a new base cryptographic key for the type of data; and
upon determining that the key rotation has completed, discontinuing use of a deprecated base cryptographic key for generating cryptographic keys for the type of data stored in the database.
13. The system of claim 12 , wherein the operation further comprises:
receiving, while the key rotation is in progress, a second request for a cryptographic key from the querying device including cryptographic hash of a second plaintext value to be encrypted, wherein the second plaintext value is associated with the type of data for which the key rotation is in progress;
generating a first cryptographic key based on the deprecated base cryptographic key and the cryptographic hash of the second plaintext value to be encrypted and a second cryptographic key based on the new base cryptographic key and the cryptographic hash of the second plaintext value to be encrypted; and
transmitting the first cryptographic key and the second cryptographic key to the querying device.
14. The system of claim 8 , wherein the operation further comprises:
encrypting the portion of the cryptographic hash, wherein the cryptographic key is generated based on the encrypted portion of the cryptographic hash.
15. A non-transitory computer-readable medium having instructions stored thereon which, when executed by a processor, performs an operation for generating cryptographic keys to secure sensitive data in data queries, the operation comprising:
receiving, from a querying device, a request for a cryptographic key, the request including cryptographic hash of a plaintext value to be encrypted and an indication of a type of the plaintext value to be encrypted;
generating the cryptographic key based, at least in part, on at least a portion of the cryptographic hash of the plaintext value to be encrypted and the type of the plaintext value to be encrypted, wherein:
the at least the portion of the cryptographic hash of the plaintext value to be encrypted comprises a truncated version of the cryptographic hash of the plaintext value to be encrypted having a length of n characters, and
n is less than a length of the cryptographic hash of the plaintext value to be encrypted; and
transmitting the generated cryptographic key to the querying device.
16. The non-transitory computer-readable medium of claim 15 , wherein the operation further comprises:
determining that a key rotation is in progress for a type of data stored in a database;
generating a new base cryptographic key for the type of data; and
upon determining that the key rotation has completed, discontinuing use of a deprecated base cryptographic key for generating cryptographic keys for the type of data stored in the database.
17. The non-transitory computer-readable medium of claim 16 , wherein the operation further comprises:
receiving, while the key rotation is in progress, a second request for a cryptographic key from the querying device including cryptographic hash of a second plaintext value to be encrypted, wherein the second plaintext value is associated with the type of data for which the key rotation is in progress;
generating a first cryptographic key based on the deprecated base cryptographic key and the cryptographic hash of the second plaintext value to be encrypted and a second cryptographic key based on the new base cryptographic key and the cryptographic hash of the second plaintext value to be encrypted; and
transmitting the first cryptographic key and the second cryptographic key to the querying device.
18. The non-transitory computer-readable medium of claim 15 , wherein truncating the cryptographic hash of the plaintext value to be encrypted comprises:
deleting characters in the cryptographic hash of the plaintext value to be encrypted up to a specified beginning location; and
deleting characters in the cryptographic hash of the plaintext value to be encrypted after a predefined number of characters from the specified beginning location.
19. The non-transitory computer-readable medium of claim 18 , wherein the specified beginning location is associated with the type of the plaintext value to be encrypted.
20. The non-transitory computer-readable medium of claim 15 , wherein the cryptographic key is generated further based on a cryptographic salt associated with the type of the plaintext value to be encrypted.