Deterministic versus probabilistic encryption
Key Takeaway
Probabilistic encryption is the default and more secure scheme, but it blocks filtering and exact matches. To filter or report on an encrypted field by exact value, use deterministic encryption. Then sync existing data to the active key material so those records return correct results.
Shield Platform Encryption encrypts sensitive field data at rest. Each encrypted field uses one of two encryption schemes. Probabilistic encryption, the default, turns the same value into a different random encrypted string every time, so it's the stronger choice. However, it blocks filtering and exact-match searches. Deterministic encryption always turns the same value into the same encrypted string within a field. As a result, the field can be filtered, at the cost of a slight loss of randomness. The scheme you pick decides whether users can still filter on an encrypted field.
How the two schemes work
Shield Platform Encryption encrypts sensitive field data at rest. Each encrypted field uses one of two encryption schemes: probabilistic encryption or deterministic encryption. Shield Platform Encryption is available in Enterprise, Performance, and Unlimited Editions with the Salesforce Shield or Shield Platform Encryption licenses. It's free in Developer Edition.
Probabilistic encryption, the default scheme, uses AES with 256-bit keys in Cipher Block Chaining (CBC) mode and a random initialization vector (IV). Because the IV is random, encrypting the same value twice produces two different ciphertext strings. Probabilistic ciphertext has no pattern, so the database can't compare it to a value. As a result, fields encrypted this way can't be referenced in SOQL WHERE queries. For example, a SOQL query on Contact with WHERE LastName = 'Smith' can't run if LastName uses probabilistic encryption.
Deterministic encryption also uses AES 256-bit CBC keys, but with a static IV instead of a random one. Each static IV is unique to a given field in a given org. Only the org-specific encryption key can decrypt it. Because the same plaintext always gives the same ciphertext in that field, filtering and equality comparisons work.
Two employee records both have the badge code K-4471 in an encrypted custom text field. With probabilistic encryption, the database stores two different ciphertext strings for the same badge code. The database can't compare those strings to K-4471, so a filter for K-4471 can't find either record. With deterministic encryption, both records store the same ciphertext for K-4471 in that field, so a filter for K-4471 finds both.