# Option for Vault to return the same cipher text for an input over multiple encrypt calls

**URL:** <https://discuss.hashicorp.com/t/option-for-vault-to-return-the-same-cipher-text-for-an-input-over-multiple-encrypt-calls/39231>\
**Category:** Vault\
**Created:** [May 9, 2022, 6:03am UTC](https://discuss.hashicorp.com/t/option-for-vault-to-return-the-same-cipher-text-for-an-input-over-multiple-encrypt-calls/39231 "2022-05-09T06:03:49Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![MayurDhande-GSLab](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/mayurdhande-gslab/32/27972_2.png) [@MayurDhande-GSLab](https://discuss.hashicorp.com/u/MayurDhande-GSLab)\
**Post date:** [May 9, 2022, 6:03am UTC](https://discuss.hashicorp.com/t/option-for-vault-to-return-the-same-cipher-text-for-an-input-over-multiple-encrypt-calls/39231/1 "2022-05-09T06:03:49Z")

</div>

Hello,  
When I try to encrypt the same plain text twice (with the same encryption key), Vault returns me different cipher text.

```auto
Request 1:
$ curl -H 'X-Vault-Token:myroot' --request POST --data '{"plaintext":"MTAw"}' http://localhost:8200/v1/transit/encrypt/k1                                       
{"request_id":"7d90b451-1434-c838-9de8-d83f22580cdc","lease_id":"","renewable":false,"lease_duration":0,"data":{"ciphertext":"vault:v1:KrU7NR2hgCI5hp6NSPF74jmhPF7giyt7W5T9AO4gCw==","key_version":1},"wrap_info":null,"warnings":null,"auth":null}

Request 2:
$ curl -H 'X-Vault-Token:myroot' --request POST --data '{"plaintext":"MTAw"}' http://localhost:8200/v1/transit/encrypt/k1
{"request_id":"faa57068-16c5-d9cb-6225-1bad72eedf09","lease_id":"","renewable":false,"lease_duration":0,"data":{"ciphertext":"vault:v1:roTV1ebLDFVuDXj0TilLvjo4QPV8rqANeUOwI02Ccw==","key_version":1},"wrap_info":null,"warnings":null,"auth":null}

```

I want to know if there is any way I could get the same cipher text no matter how many times I call the encrypt API for the same plain text.

Thank you

---

<div class="post-metadata">

**Author:** ![aram](https://avatars.discourse-cdn.com/v4/letter/a/a183cd/32.png) [@aram](https://discuss.hashicorp.com/u/aram)\
**Post date:** [May 9, 2022, 7:07am UTC](https://discuss.hashicorp.com/t/option-for-vault-to-return-the-same-cipher-text-for-an-input-over-multiple-encrypt-calls/39231/2 "2022-05-09T07:07:26Z")

</div>

Since the transit engine is not a one way encryption why would you want it to? That would expose the key.

If you’re looking for tokenization then that’s a different Enterprise function, known as transform.

> **[Tokenize Data with Transform Secrets Engine | Vault - HashiCorp Learn](https://learn.hashicorp.com/tutorials/vault/tokenization)**
>
> Learn how the Transform secrets engine's data tokenization works to provide
> maximum resistance to data being compromised.

---

<div class="post-metadata">

**Author:** ![MayurDhande-GSLab](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/mayurdhande-gslab/32/27972_2.png) [@MayurDhande-GSLab](https://discuss.hashicorp.com/u/MayurDhande-GSLab)\
**Post date:** [May 9, 2022, 7:14am UTC](https://discuss.hashicorp.com/t/option-for-vault-to-return-the-same-cipher-text-for-an-input-over-multiple-encrypt-calls/39231/3 "2022-05-09T07:14:04Z")

</div>

Thanks for the response @aram  
As part of persisting the sensitive data in database, we are storing cipher texts in database tables and want to query the table based on the cipher text.  
Hence our requirement is to get the same cipher text through which we can query the desired record.

---

<div class="post-metadata">

**Author:** ![maxb](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/maxb/32/26655_2.png) [@maxb](https://discuss.hashicorp.com/u/maxb)\
**Post date:** [May 9, 2022, 7:19am UTC](https://discuss.hashicorp.com/t/option-for-vault-to-return-the-same-cipher-text-for-an-input-over-multiple-encrypt-calls/39231/4 "2022-05-09T07:19:02Z")

</div>

Read this bit of the docs, it specifically addresses your use case: [Transit - Secrets Engines | Vault by HashiCorp](https://www.vaultproject.io/docs/secrets/transit#convergent-encryption)

---

<div class="post-metadata">

**Author:** ![MayurDhande-GSLab](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/mayurdhande-gslab/32/27972_2.png) [@MayurDhande-GSLab](https://discuss.hashicorp.com/u/MayurDhande-GSLab)\
**Post date:** [May 9, 2022, 7:39am UTC](https://discuss.hashicorp.com/t/option-for-vault-to-return-the-same-cipher-text-for-an-input-over-multiple-encrypt-calls/39231/5 "2022-05-09T07:39:44Z")

</div>

Thank you @maxb. Convergent Encryption solves our use case. Thanks again.