deterministic_key is a powerful feature when used only for queryable, high-entropy attributes and when the threat model excludes frequency analysis attacks. For maximum security, default to non-deterministic mode and add blind indexes only when necessary.
config.active_record.encryption.primary_key = ENV["ENCRYPTION_PRIMARY_KEY"] config.active_record.encryption.deterministic_key = ENV["ENCRYPTION_DETERMINISTIC_KEY"] Example model usage: active_record_encryption_deterministic_key