After Michael's post originally appeared on the intersystems-public-cache Google Group (as a result of the automatic crossposting being done by a username intersystems.dc) my colleague George James responded in the Google Group (GG). However, whatever mechanism the user intersystems.dc has set up for crossposting only handles the initial DC post, and nor does it feed GG responses back to DC. So I'm re-posting George's response here where I think it will get a wider audience.

George wrote:

It seems to me that your ixdLastName index might be usable as some kind of rainbow table to attack the data contained in the AES encrypted field.
 

If I were able to perform a chosen-plaintext attack then querying with like 'J%', then 'Ja%', then 'Jam%' would trivially discover where my name was in the database. 

 
Have you carried out a cryptographic analysis of the strength of this approach?  Logically it must be weaker than just AES on its own.  My question is how much weaker?

Amplifying what Dmitry wrote, here's the web app I defined to make your example class work:

I also had to change your classmethods so they Quit $$$OK instead of simply quitting.

And to test from the browser I used http://localhost:57772/csp/user/testing/print because that's the route you have defined as accepting the GET method from the browser.

There's a REST sample (REST.DocServer) in the SAMPLES namespace. To use it you need to enable the /csp/samples/docserver web application by setting this checkbox:

Then this URL will return the source of the Cinema.Review class from the SAMPLES namespace:

http://localhost:57772/csp/samples/docserver/class/samples/Cinema.Review

Given that this REST sample will return the source of any class from any namespace, it's understandable that the /csp/samples/docserver application is disabled by default on a new installation.

I had assumed that if the "Serve Files" setting isn't "Always and cached" then the Gateway wouldn't cache them.

Doc at http://docs.intersystems.com/latest/csp/docbook/DocBook.UI.Page.cls?KEY=... seems to imply this.

That doc also states that the "Serve Files Timeout" is to do with caching by the browser.

Anyway, it'll be interesting to hear what your tests show.