github.com/ncruces/go-sqlite3@v0.15.1-0.20240520133447-53eef1510ff0/vfs/adiantum/README.md (about)

     1  # Go `"adiantum"` SQLite VFS
     2  
     3  This package wraps an SQLite VFS to offer encryption at rest.
     4  
     5  > [!WARNING]
     6  > This work was not certified by a cryptographer.
     7  > If you need vetted encryption, you should purchase the
     8  > [SQLite Encryption Extension](https://sqlite.org/see),
     9  > and either wrap it, or seek assistance wrapping it.
    10  
    11  The `"adiantum"` VFS wraps the default SQLite VFS using the
    12  [Adiantum](https://github.com/lukechampine/adiantum)
    13  tweakable and length-preserving encryption.\
    14  In general, any HBSH construction can be used to wrap any VFS.
    15  
    16  The default Adiantum construction uses XChaCha12 for its stream cipher,
    17  AES for its block cipher, and NH and Poly1305 for hashing.\
    18  Additionally, we use [Argon2id](https://pkg.go.dev/golang.org/x/crypto/argon2#hdr-Argon2id)
    19  to derive 256-bit keys from plain text where needed.
    20  File contents are encrypted in 4K blocks, matching the
    21  [default](https://sqlite.org/pgszchng2016.html) SQLite page size.
    22  
    23  The VFS encrypts all files _except_
    24  [super journals](https://sqlite.org/tempfiles.html#super_journal_files):
    25  these _never_ contain database data, only filenames,
    26  and padding them to the block size is problematic.
    27  Temporary files _are_ encrypted with **random** keys,
    28  as they _may_ contain database data.
    29  To avoid the overhead of encrypting temporary files,
    30  keep them in memory:
    31  
    32      PRAGMA temp_store = memory;
    33  
    34  > [!IMPORTANT]
    35  > Adiantum is a cipher composition for disk encryption.
    36  > The standard threat model for disk encryption considers an adversary
    37  > that can read multiple snapshots of a disk.
    38  > The only security property that disk encryption provides
    39  > is that all information such an adversary can obtain
    40  > is whether the data in a sector has or has not changed over time.
    41  
    42  The encryption offered by this package is fully deterministic.
    43  
    44  This means that an adversary who can get ahold of multiple snapshots
    45  (e.g. backups) of a database file can learn precisely:
    46  which blocks changed, which ones didn't, which got reverted.
    47  
    48  This is slightly weaker than other forms of SQLite encryption
    49  that include *some* nondeterminism; with limited nondeterminism,
    50  an adversary can't distinguish between
    51  blocks that actually changed, and blocks that got reverted.
    52  
    53  > [!CAUTION]
    54  > This package does not claim protect databases against tampering or forgery.
    55  
    56  The major practical consequence of the above point is that,
    57  if you're keeping `"adiantum"` encrypted backups of your database,
    58  and want to protect against forgery, you should sign your backups,
    59  and verify signatures before restoring them.
    60  
    61  This is slightly weaker than other forms of SQLite encryption
    62  that include block-level [MACs](https://en.wikipedia.org/wiki/Message_authentication_code).
    63  Block-level MACs can protect against forging individual blocks,
    64  but can't prevent them from being reverted to former versions of themselves.