Option for Vault to return the same cipher text for an input over multiple encrypt calls

Vault
1

Hello,
When I try to encrypt the same plain text twice (with the same encryption key), Vault returns me different cipher text.

Request 1:
$ curl -H 'X-Vault-Token:myroot' --request POST --data '{"plaintext":"MTAw"}' http://localhost:8200/v1/transit/encrypt/k1                                       
{"request_id":"7d90b451-1434-c838-9de8-d83f22580cdc","lease_id":"","renewable":false,"lease_duration":0,"data":{"ciphertext":"vault:v1:KrU7NR2hgCI5hp6NSPF74jmhPF7giyt7W5T9AO4gCw==","key_version":1},"wrap_info":null,"warnings":null,"auth":null}

Request 2:
$ curl -H 'X-Vault-Token:myroot' --request POST --data '{"plaintext":"MTAw"}' http://localhost:8200/v1/transit/encrypt/k1
{"request_id":"faa57068-16c5-d9cb-6225-1bad72eedf09","lease_id":"","renewable":false,"lease_duration":0,"data":{"ciphertext":"vault:v1:roTV1ebLDFVuDXj0TilLvjo4QPV8rqANeUOwI02Ccw==","key_version":1},"wrap_info":null,"warnings":null,"auth":null}

I want to know if there is any way I could get the same cipher text no matter how many times I call the encrypt API for the same plain text.

Thank you

2

Since the transit engine is not a one way encryption why would you want it to? That would expose the key.

If you’re looking for tokenization then that’s a different Enterprise function, known as transform.

3

Thanks for the response @aram
As part of persisting the sensitive data in database, we are storing cipher texts in database tables and want to query the table based on the cipher text.
Hence our requirement is to get the same cipher text through which we can query the desired record.

4

Read this bit of the docs, it specifically addresses your use case: Transit - Secrets Engines | Vault by HashiCorp

1 Like
5

Thank you @maxb. Convergent Encryption solves our use case. Thanks again.