Cryptographic key generation for logically sharded data stores

A system, comprising:

• a processor;
• and
• a memory having instructions stored thereon which, when executed by the processor, causes the processor to perform an operation for generating cryptographic keys to secure sensitive data in data queries, the operation comprising:
• receiving, from a querying device, a request for a cryptographic key, the request including cryptographic hash of a plaintext value to be encrypted and an indication of a type of the plaintext value to be encrypted;
• generating a cryptographic key based, at least in part, on at least a portion of the cryptographic hash of the plaintext value to be encrypted and the type of the plaintext value to be encrypted, wherein:
• the at least the portion of the cryptographic hash of the plaintext value to be encrypted comprises a truncated version of the cryptographic hash of the plaintext value to be encrypted having a length of n characters, and
• n is less than a length of the cryptographic hash of the plaintext value to be encrypted;
• and
• transmitting the generated cryptographic key to the querying device.

A non-transitory computer-readable medium having instructions stored thereon which, when executed by a processor, performs an operation for generating cryptographic keys to secure sensitive data in data queries, the operation comprising:

• receiving, from a querying device, a request for a cryptographic key, the request including cryptographic hash of a plaintext value to be encrypted and an indication of a type of the plaintext value to be encrypted;
• generating the cryptographic key based, at least in part, on at least a portion of the cryptographic hash of the plaintext value to be encrypted and the type of the plaintext value to be encrypted, wherein:
• the at least the portion of the cryptographic hash of the plaintext value to be encrypted comprises a truncated version of the cryptographic hash of the plaintext value to be encrypted having a length of n characters, and
• n is less than a length of the cryptographic hash of the plaintext value to be encrypted;
• and
• transmitting the generated cryptographic key to the querying device.