Skip to content
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 8 additions & 6 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -318,9 +318,11 @@ In general, therefore, you should try to ensure that the string you search for i

An ste_vec index on a encrypted JSONB column enables the use of PostgreSQL's `@>` and `<@` [containment operators](https://www.postgresql.org/docs/16/functions-json.html#FUNCTIONS-JSONB-OP-TABLE).

An ste_vec index requires one piece of configuration: the `prefix` (a string) which is functionally similar to a salt for the hashing process.
An ste_vec index requires one piece of configuration: the `context` (a string) which is passed as an info string to a MAC (Message Authenticated Code).
This ensures that all of the encrypted values are unique to that context.
It is generally recommended to use the table and column name as a the context (e.g. `users/name`).

Within a dataset, encrypted columns indexed using an ste_vec that use different prefixes can never compare as equal.
Within a dataset, encrypted columns indexed using an `ste_vec` that use different contexts cannot be compared.
Containment queries that manage to mix index terms from multiple columns will never return a positive result.
This is by design.

Expand Down Expand Up @@ -355,7 +357,7 @@ For a document like this:

Hashes would be produced from the following list of entries:

```json
```js
[
[Obj, Key("account"), Obj, Key("email"), String("alice@example.com")],
[Obj, Key("account"), Obj, Key("name"), Obj, Key("first_name"), String("Alice")],
Expand All @@ -367,13 +369,13 @@ Hashes would be produced from the following list of entries:

Using the first entry to illustrate how an entry is converted to hashes:

```json
```js
[Obj, Key("account"), Obj, Key("email"), String("alice@example.com")]
```

The hashes would be generated for all prefixes of the full path to the leaf node.

```json
```js
[
[Obj],
[Obj, Key("account")],
Expand All @@ -396,7 +398,7 @@ The expression `cs_ste_vec_v1(encrypted_account) @> cs_ste_vec_v1($query)` would

When reduced to a prefix list, it would look like this:

```json
```js
[
[Obj],
[Obj, Key("account")],
Expand Down