alt Hacker NewsIt's still not piecing together 100% for me, sorry I'm not trying to be obtuse or anything.
So maybe let me simplify my question: If I set up both a copy of a database with values encrypted by CipherStash, and an application server connected to it, and the application server has enough access to do queries on sensitive data (eg "WHERE sensitiveField = ?", pretend it needs that for a migration), and a developer has root access on the application box while it's running, and a gdb session connected to the app, can they see any sensitive data or no?
If they can't, then that's genuinely cool, and I probably need to look into the workings a bit more!
Applications do not have access - individual authenticated users have access. A user must be authenticated & authorised in order to be able to create encrypted query terms. This is enforced by CipherStash's key server (ZeroKMS), not the application.
Having a copy of the production database and a local copy of the application and a debugger is insufficient to be able to encrypt/decrypt any values or run any queries involving encrypted search terms: you'd still need to authenticate with ZeroKMS.
Having root access to a production server running an application is a different matter because you'd have access to the entire address space of the app that real authenticated users are interacting with. A sufficiently motivated adversary would be able to intercept auth tokens allowing impersonation of an authorised user.
The application server process is a trust boundary in this model and thus requires appropriate access controls.
To address this last point, we now support decryption in edge workers like Cloudflare or Supabase Edge Functions. We also have browser-based encryption/decryption in the works. Both of these approaches mean data is never decrypted in the app, not even in production.