Supabase Announces Searchable Encryption with CipherStash Integration
Supabase just announced searchable encryption
We are thrilled to introduce CipherStash integration for Supabase, enabling field-level encryption without sacrificing search capabilities. This solution allows you to encrypt sensitive data with unique keys per value while still running efficient queries, joins, and sorts. You maintain full control over your keys through ZeroKMS, ensuring that neither Supabase nor CipherStash can access your plaintext data, offering a secure third option between traditional encryption and skipping security entirely.
Most teams that handle regulated data end up choosing between two bad options: use traditional field-level encryption that breaks search, or skip encryption and risk a massive breach.
- maxrmk
I’m having a hard time wrapping my head around what guarantees this does and does not make.
If you can run “select * where secret_col == 10”… why does it matter that the column is encrypted?
- sorenbs
We worked with the CipherStash team to build a Prisma Next extension that provides full type safety for their additional query shapes, and a fully managed experience for applying schema changes. It was a great experience working with the team, and we were particularly excited about this, as it helped us prove out the new extensibility mechanisms we have been working so hard for in Prisma Next.
Docs here: https://cipherstash.com/docs/stack/cipherstash/encryption/pr...
And a mention in our April update on Prisma Next: https://www.prisma.io/blog/prisma-next-roadmap-april-milesto...
If you want to give CipherStash on Supabase a try, using Prisma Next is the smoothest experience.
- tekacs
I came here to say that this is presumably ORE/OPE (order-revealing/preserving) encryption, not FHE, but...
It is both remarkable and depressing how _little_ information is given, and how buried it is on the CipherStash website... _any_ information on what their security and/or threat model is, what is actually stored, how encryption and search works, or any trade-offs involved.
Just to list a few pages that tell you next to nothing:
https://cipherstash.com/docs/stack/reference/what-is-ciphers...
https://cipherstash.com/docs/stack/cipherstash/encryption/se...
https://cipherstash.com/docs/stack/cipherstash/encryption
I eventually found:
https://cipherstash.com/docs/stack/reference/security-archit...
Which... it sounds like 'searched without being decrypted' means... it encrypts your query against their fast KMS and uses that to compare against indexes that were also encrypted with the same KMS? And ORE/OPE is an optional mode when you want range support.
- jph
> Anywhere you need direct database access outside your application, CipherStash Proxy provides a secure escape hatch.
This sounds like a back door. Is it?
To me, the whole article feels super-unclear about what exactly is involved.
Can HN folks who know more weigh in?
- localhoster
Looking at their website, reading through abit, and seeing the comments here.
Guys, this website is entirely ai generated, which might indicate about their product some.
Not saying that they are lieing or anything, but expect a wall of text that no one really read through, and expect to (pun intended) cipher out the details.