103 lines
4.0 KiB
Plaintext
103 lines
4.0 KiB
Plaintext
== SQLite Cipher ==
|
|
|
|
SQLite Cipher is an SQLite extension that provides transparent 256 bit AES encryption of database files.
|
|
Pages are encrypted before being written to disk and are decrypted when read back.
|
|
|
|
Encryption is provided by the OpenSSL crypto library.
|
|
|
|
SQLite Cipher was developed by Stephen Lombardo at Zetetic LLC.
|
|
sjlombardo at zetetic.net
|
|
http://zetetic.net
|
|
|
|
[Compiling]
|
|
|
|
Building SQLite Cipher is almost the same as compiling a regular version of SQLite with three small exceptions:
|
|
|
|
1. building via 'amalgamation' isn't supported (where all sqlite source is merged into one file)
|
|
2. you must define SQLITE_HAS_CODEC
|
|
3. You need to link against a OpenSSL's libcrypto with sha256 support compiled in
|
|
|
|
Example Static linking (replace /opt/local/lib with the path to libcrypto.a)
|
|
|
|
./configure --disable-amalgamation CFLAGS="-DSQLITE_HAS_CODEC" LDFLAGS="/opt/local/lib/libcrypto.a"
|
|
make
|
|
|
|
Example Dynamic linking
|
|
|
|
./configure --disable-amalgamation CFLAGS="-DSQLITE_HAS_CODEC -lcrypto"
|
|
make
|
|
|
|
[Encrypting a database]
|
|
|
|
To specify an encryption passphrase for the database you can use a pragma. The passphrase
|
|
you enter is hashed using sha256 and the result is used as the encryption key for the
|
|
database.
|
|
|
|
PRAGMA key = 'passphrase';
|
|
|
|
Alternately, you can specify an exact byte sequence using a blob literal. If you
|
|
use this method it is your responsibility to ensure that the data you provide a
|
|
64 character hex string, which will be converted directly to 32 bytes (256 bits) of
|
|
key data.
|
|
|
|
PRAGMA key = "x'2DD29CA851E7B56E4697B0E1F08507293D761A05CE4D1B628663F411A8086D99'";
|
|
|
|
To encrypt a database programatically you can use the sqlite3_key function. The data provided
|
|
in pKey is converted to an encryption key according to the same rules as PRAGMA key.
|
|
|
|
int sqlite3_key(sqlite3 *db, const void *pKey, int nKey);
|
|
|
|
PRAGMA key or sqlite3_key should be called as the first operation when a database is open.
|
|
|
|
Note: It is not currently possible to change the encryption key once a database is created. We're
|
|
working on implementing rekey functionality.
|
|
|
|
[License]
|
|
|
|
This code is released under the same public domain terms as SQLite itself.
|
|
|
|
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
|
|
THE SOFTWARE.
|
|
|
|
== End SQLite Cipher ==
|
|
|
|
This directory contains source code to
|
|
|
|
SQLite: An Embeddable SQL Database Engine
|
|
|
|
To compile the project, first create a directory in which to place
|
|
the build products. It is recommended, but not required, that the
|
|
build directory be separate from the source directory. Cd into the
|
|
build directory and then from the build directory run the configure
|
|
script found at the root of the source tree. Then run "make".
|
|
|
|
For example:
|
|
|
|
tar xzf sqlite.tar.gz ;# Unpack the source tree into "sqlite"
|
|
mkdir bld ;# Build will occur in a sibling directory
|
|
cd bld ;# Change to the build directory
|
|
../sqlite/configure ;# Run the configure script
|
|
make ;# Run the makefile.
|
|
make install ;# (Optional) Install the build products
|
|
|
|
The configure script uses autoconf 2.61 and libtool. If the configure
|
|
script does not work out for you, there is a generic makefile named
|
|
"Makefile.linux-gcc" in the top directory of the source tree that you
|
|
can copy and edit to suit your needs. Comments on the generic makefile
|
|
show what changes are needed.
|
|
|
|
The linux binaries on the website are created using the generic makefile,
|
|
not the configure script.
|
|
The windows binaries on the website are created using MinGW32 configured
|
|
as a cross-compiler running under Linux. For details, see the ./publish.sh
|
|
script at the top-level of the source tree.
|
|
|
|
Contacts:
|
|
|
|
http://www.sqlite.org/
|