alt Hacker NewsSo an identifier is kept for each column returned by a query?
If the value changes would you be able to get from the id you have audited back to the value that was returned at that point in time?
So an identifier is kept for each column returned by a query?
If the value changes would you be able to get from the id you have audited back to the value that was returned at that point in time?
Not just each column, each value.
The answer to your question is yes.
Explanation: The identifier is actually for the key that encrypts the value (1 unique key per value).
1. When the value is encrypted for the first time, it gets an ID. 2. When its decrypted, the application requests the key for that ID from the key-server (key-server records that the data was accessed)* 3. When updating, the same data key is used so the ID is persistent*
* Technically the key server doesn't return a key, it generates partial key material that can be used to derive the data key in the app. It can do this at up to 10,000 keys per second. * You can also tag each value with the table/column name and the row-id to link everything together
The 3 values form the "descriptor" of a value: `table/column/id`.