I am using the ActiveRecord serialize method with a class of my own, AESCoder. This will uses aes-256-cbc with a random initialization vector every time. This initialization vector is prepended to the field when I store it in the database, and is of course extracted before deserializing.
Now, this scheme prevents me from using any finders on those attributes. I have to select all the rows I need, which will be automatically decrypted, and the perform a ruby select on the item list. This is, of course, a huge performance bottleneck, which I can’t afford for this application.
One solution would be not to use a random IV, but then aes-256-cbc wouldn’t be as secure any more.
Am I overlooking something here?
As others have noted, there will be no way around the need to decrypt rows you want to search through. Still you might improve performance by letting Postgres do the heavy lifting with the help of its pgcrypto extension, instead of selecting everything and sorting it out on the application layer.
Heroku recently started offering Postgres 9.1 and seems to support pgcrypto. According to the blog post, you may have to migrate your database in order to be switched over to Postgres 9.1.
Please note that Herokus paid ‘shared database’ plans still seem to run on Postgres 8 and do not support pgcrypto yet, but are supposed to be upgraded shortly. Postgres 9 introduced a new way to enable and use extensions that makes it easier to offer them in a shared hosting environment.