It's certain that it's shit. They pull words out of strings and AES encrypt each one with the provided key (deterministically, either no IV, or a constant one). "Hi, Alice" -> <AES "Hi"> + ", " + <AES "Alice"> + ".".
That way a query for strings containing "Alice" (through virtue of symmetry and determinism) can have the expected results, as well as allowing them virtually any storage back end.
This makes them vulnerable to frequency analysis and known-plaintext attacks, as well as probably not working at all for CJK languages or any other type of value which isn't trivial to split into useful tokens.
Comments
Oh, and given that 'CipherCloud' seems intent on suppressing information about their cryptography it's probably a very safe bet that it's utter shit.
It's certain that it's shit. They pull words out of strings and AES encrypt each one with the provided key (deterministically, either no IV, or a constant one). "Hi, Alice" -> <AES "Hi"> + ", " + <AES "Alice"> + ".".
That way a query for strings containing "Alice" (through virtue of symmetry and determinism) can have the expected results, as well as allowing them virtually any storage back end.
This makes them vulnerable to frequency analysis and known-plaintext attacks, as well as probably not working at all for CJK languages or any other type of value which isn't trivial to split into useful tokens.