status-im/sqlcipher
1
0
Fork 0
mirror of https://github.com/status-im/sqlcipher.git synced 2026-08-31 14:31:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

64k iterations plus pragma cipher_default_kdf_iter function

Browse Source
This commit is contained in:
Stephen Lombardo
2013-06-27 19:07:58 -04:00
parent 581876802e
commit a2bb641e48
5 changed files with 77 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
sqlcipher-2.3-testkey.db
BIN
View File
Binary file not shown.
src/crypto.c
+9
View File
@@ -110,6 +110,15 @@ int codec_pragma(sqlite3* db, int iDb, Parse *pParse, const char *zLeft, const c
if( sqlite3StrICmp(zLeft, "rekey_cipher")==0 && zRight ){
if(ctx) sqlcipher_codec_ctx_set_cipher(ctx, zRight, 1); // change write cipher only
}else
if( sqlite3StrICmp(zLeft,"cipher_default_kdf_iter")==0 ){
if( zRight ) {
sqlcipher_set_default_kdf_iter(atoi(zRight)); // change default KDF iterations
} else {
char *kdf_iter = sqlite3_mprintf("%d", sqlcipher_get_default_kdf_iter());
codec_vdbe_return_static_string(pParse, "cipher_default_kdf_iter", kdf_iter);
sqlite3_free(kdf_iter);
}
}else
if( sqlite3StrICmp(zLeft, "kdf_iter")==0 ){
if(ctx) {
if( zRight ) {
src/crypto.h
+4 -1
View File
@@ -59,7 +59,7 @@
#define CIPHER_READWRITE_CTX 2
#ifndef PBKDF2_ITER
#define PBKDF2_ITER 4000
#define PBKDF2_ITER 64000
#endif
/* possible flags for cipher_ctx->flags */
@@ -173,6 +173,9 @@ int sqlcipher_codec_ctx_set_pagesize(codec_ctx *, int);
int sqlcipher_codec_ctx_get_pagesize(codec_ctx *);
int sqlcipher_codec_ctx_get_reservesize(codec_ctx *);
void sqlcipher_set_default_kdf_iter(int iter);
int sqlcipher_get_default_kdf_iter();
int sqlcipher_codec_ctx_set_kdf_iter(codec_ctx *, int, int);
int sqlcipher_codec_ctx_get_kdf_iter(codec_ctx *ctx, int);
src/crypto_impl.c
+11 -1
View File
@@ -66,6 +66,7 @@ typedef struct {
static unsigned int default_flags = DEFAULT_CIPHER_FLAGS;
static unsigned char hmac_salt_mask = HMAC_SALT_MASK;
static int default_kdf_iter = PBKDF2_ITER;
static sqlcipher_provider *default_provider = NULL;
@@ -386,6 +387,15 @@ const char* sqlcipher_codec_ctx_get_cipher(codec_ctx *ctx, int for_ctx) {
return c_ctx->provider->get_cipher(c_ctx->provider_ctx);
}
/* set the global default KDF iteration */
void sqlcipher_set_default_kdf_iter(int iter) {
default_kdf_iter = iter;
}
int sqlcipher_get_default_kdf_iter() {
return default_kdf_iter;
}
int sqlcipher_codec_ctx_set_kdf_iter(codec_ctx *ctx, int kdf_iter, int for_ctx) {
cipher_ctx *c_ctx = for_ctx ? ctx->write_ctx : ctx->read_ctx;
int rc;
@@ -572,7 +582,7 @@ int sqlcipher_codec_ctx_init(codec_ctx **iCtx, Db *pDb, Pager *pPager, sqlite3_f
}
if((rc = sqlcipher_codec_ctx_set_cipher(ctx, CIPHER, 0)) != SQLITE_OK) return rc;
if((rc = sqlcipher_codec_ctx_set_kdf_iter(ctx, PBKDF2_ITER, 0)) != SQLITE_OK) return rc;
if((rc = sqlcipher_codec_ctx_set_kdf_iter(ctx, default_kdf_iter, 0)) != SQLITE_OK) return rc;
if((rc = sqlcipher_codec_ctx_set_fast_kdf_iter(ctx, FAST_PBKDF2_ITER, 0)) != SQLITE_OK) return rc;
if((rc = sqlcipher_codec_ctx_set_pass(ctx, zKey, nKey, 0)) != SQLITE_OK) return rc;
test/crypto.test
+53 -5
View File
@@ -879,6 +879,7 @@ do_test open-1.1.8-database {
execsql {
PRAGMA key = 'testkey';
PRAGMA cipher_use_hmac = OFF;
PRAGMA kdf_iter = 4000;
SELECT count(*) FROM t1;
SELECT * FROM t1;
}
@@ -893,6 +894,7 @@ do_test attach-and-copy-1.1.8 {
execsql {
PRAGMA key = 'testkey';
PRAGMA cipher_use_hmac = OFF;
PRAGMA kdf_iter = 4000;
ATTACH DATABASE 'test.db' AS db2 KEY 'testkey-hmac';
CREATE TABLE db2.t1(a,b);
INSERT INTO db2.t1 SELECT * FROM main.t1;
@@ -1350,20 +1352,22 @@ do_test cipher-options-before-keys {
db close
file delete -force test.db
# open a 1.1.8 database (no HMAC), then
# open a 1.1.8 database (no HMAC, 4K iter), then
# try to open another 1.1.8 database. The
# attached database should have the same hmac
# setting as the original
do_test default-use-hmac-attach {
do_test default-hmac-kdf-attach {
file copy -force sqlcipher-1.1.8-testkey.db test.db
sqlite_orig db test.db
execsql {
PRAGMA cipher_default_use_hmac = OFF;
PRAGMA cipher_default_kdf_iter = 4000;
PRAGMA key = 'testkey';
SELECT count(*) FROM t1;
ATTACH 'sqlcipher-1.1.8-testkey.db' AS db2;
SELECT count(*) from db2.t1;
PRAGMA cipher_default_use_hmac = ON;
PRAGMA cipher_default_kdf_iter = 64000;
}
} {4 4}
db close
@@ -1384,12 +1388,12 @@ do_test attach-1.1.8-database-from-2.0-fails {
db close
file delete -force test.db
# open a 2.0 database (with HMAC), then
# open a 2.0 database (with HMAC, 4k iter), then
# set the default hmac setting to OFF.
# try to a 1.1.8 database. this should
# succeed now that hmac is off by default
# before the attach
do_test change-default-use-hmac-attach {
do_test change-default-hmac-kdf-attach {
sqlite_orig db test.db
execsql {
PRAGMA key = 'testkey';
@@ -1402,9 +1406,11 @@ do_test change-default-use-hmac-attach {
PRAGMA key = 'testkey';
SELECT count(*) FROM t1;
PRAGMA cipher_default_use_hmac = OFF;
PRAGMA cipher_default_kdf_iter = 4000;
ATTACH 'sqlcipher-1.1.8-testkey.db' AS db2;
SELECT count(*) from db2.t1;
PRAGMA cipher_default_use_hmac = ON;
PRAGMA cipher_default_kdf_iter = 64000;
}
} {1 4}
db close
@@ -1580,12 +1586,25 @@ do_test multipage-schema-autovacuum-shortread-wal {
db close
file delete -force test.db
# open a 2.3 database with little endian hmac page numbers (default)
# verify it can be opened
do_test open-2.3-le-database {
sqlite_orig db sqlcipher-2.3-testkey.db
execsql {
PRAGMA key = 'testkey';
SELECT count(*) FROM t1;
SELECT * FROM t1;
}
} {4 1 1 one one 1 2 one two}
db close
# open a 2.0 database with little endian hmac page numbers (default)
# verify it can be opened
do_test open-2.0-le-database {
sqlite_orig db sqlcipher-2.0-le-testkey.db
execsql {
PRAGMA key = 'testkey';
PRAGMA kdf_iter = 4000;
SELECT count(*) FROM t1;
SELECT * FROM t1;
}
@@ -1599,6 +1618,7 @@ do_test open-2.0-be-database {
execsql {
PRAGMA key = 'testkey';
PRAGMA cipher_hmac_pgno = be;
PRAGMA kdf_iter = 4000;
SELECT count(*) FROM t1;
SELECT * FROM t1;
}
@@ -1615,6 +1635,7 @@ do_test be-to-le-migration {
execsql {
PRAGMA key = 'testkey';
PRAGMA cipher_hmac_pgno = be;
PRAGMA kdf_iter = 4000;
ATTACH DATABASE 'test.db' AS db2 KEY 'testkey';
CREATE TABLE db2.t1(a,b);
INSERT INTO db2.t1 SELECT * FROM main.t1;
@@ -1684,6 +1705,31 @@ do_test verify-pragma-cipher-default-use-hmac-off {
db close
file delete -force test.db
# verify the pragma default_cipher_kdf_iter
# is set to 64000 by default
do_test verify-pragma-cipher-default-kdf-iter-default {
sqlite_orig db test.db
execsql {
PRAGMA cipher_default_kdf_iter;
}
} {64000}
db close
file delete -force test.db
# verify the pragma default_cipher_kdf_ter
# reports changes
do_test verify-pragma-cipher-default-use-hmac-off {
sqlite_orig db test.db
execsql {
PRAGMA cipher_default_kdf_iter = 1000;
PRAGMA cipher_default_kdf_iter;
PRAGMA cipher_default_kdf_iter = 64000;
}
} {1000}
db close
file delete -force test.db
# verify the pragma kdf_iter
# reports the default value
do_test verify-pragma-kdf-iter-reports-default {
@@ -1692,7 +1738,7 @@ do_test verify-pragma-kdf-iter-reports-default {
PRAGMA key = 'test';
PRAGMA kdf_iter;
}
} {4000}
} {64000}
db close
file delete -force test.db
@@ -1843,6 +1889,7 @@ do_test open-2.0-beta-database {
sqlite_orig db sqlcipher-2.0-beta-testkey.db
execsql {
PRAGMA key = 'testkey';
PRAGMA kdf_iter = 4000;
PRAGMA fast_kdf_iter = 4000;
PRAGMA cipher_hmac_salt_mask = "x'00'";
SELECT count(*) FROM t1;
@@ -1861,6 +1908,7 @@ do_test 2.0-beta-to-2.0-migration {
execsql {
PRAGMA key = 'testkey';
PRAGMA cipher_hmac_salt_mask = "x'00'";
PRAGMA kdf_iter = 4000;
PRAGMA fast_kdf_iter = 4000;
SELECT count(*) FROM sqlite_master;