Did you roll your own crypto?
- Date
- By
- CipherStash Team
No. Values are encrypted with AES-256-GCM-SIV. Equality search is an HMAC-SHA-256 tag. Ordering uses order-preserving encryption, with order-revealing encryption as an option, and free-text match uses encrypted Bloom filters. The primitives come from open-source libraries, and the source for every scheme can be read today. EQL and the SDK bindings are open source. The encryption core, the ORE implementations and Proxy are source-available.
The searchable part is where people expect a custom cipher. There are four schemes, and they do different jobs.
Storing a value. AES-256-GCM-SIV, an authenticated cipher with nonce-misuse resistance, from an open-source implementation. We did not write the block cipher.
Equality search. An HMAC-SHA-256 tag stored next to the ciphertext. The database compares tags. It is a blind index with the key managed by ZeroKMS.
Ordering and range queries. EQL's default ordering term is CLLW order-preserving encryption. Block order-revealing encryption is available as a pinned alternative, and our implementation is public at cipherstash/ore.rs.
Free-text match. Encrypted Bloom filters over trigram tokens.
The cryptography reference lists every primitive and what each search term reveals to the database.
What you can read
All of it. The source for every scheme above is published, under one of two kinds of licence.
Open source. EQL (the Postgres types, operators and functions) and the Stack SDK's TypeScript packages and native bindings are MIT licensed. The primitives underneath, AES-GCM-SIV, HMAC, SHA-2 and BLAKE3, come from widely used open-source Rust libraries.
Source-available. The encryption core the SDK wraps (cipherstash-client), the CLLW ordering implementation (cllw-ore), block ORE (ore.rs) and CipherStash Proxy are published so you can review the code and check it against the builds we ship. Their licences restrict modification and use.
Stack Encrypt, the next version of the SDK, will be fully open source and built on AWS-LC, the FIPS-validated cryptographic library.
Searchable encrypted JSON is composed from the same primitives. The docs cover the type and its queries, and a public description of the construction is still to come.
Assurance
We are SOC 2 Type II certified and run regular third-party penetration tests. Reports are available through the Trust Center.