I'm a bit confused as to how SQLCipher handles the PRAGMA key provided for encrypting the SQLite database

For background: I'm looking at options for encrypting application data at rest. From the research I've done, iOS has pretty robust security until the device is unlocked, then it's basically a free for all. What I'm looking to do is ensure that even if the device is compromised, it will make it significantly hard for an attacker to access the data within the application. For this, we've implemented an app password, and after a certain amount of incorrect guesses the application data is erased. However, my understanding is that if an attacker gets ahold of a device and unlocks it, they are able to dump any keychain data and also are able to see any of the application data stored in plaintext (as everything is decrypted once the device is unlocked).

From doing more research, it seems the only viable option would be to use SQLCipher and encrypt the database used in the application. I understand that to do that, we have to provide a PRAGMA key (passphrase) to SQLCipher so that it can run it through a PBKDF2 function and calculate page HMACs for each page it's encrypting. So from the passphrase, it derives a key.

My question is: does passing in the application's password as the database's PRAGMA key pose any security threat? If so, how can I minimize that threat? My idea was to use the application password to create a key by stretching and salting the password (using PBKDF2) and along with some other piece of data (i.e. the device UID or something similar) to create an HMAC that I can use as the passphrase to pass along to SQLCipher.

The goal here is to try and avoid storing any piece of revealing information that an attacker can use to decrypt the database without a bit of work on their part (i.e. avoid storing keys/passwords in the keychain for the application, easily guessable PRAGMA key, etc.). If there are any suggestions for how to achieve that, please let me know.

Thanks in advance for any help you can provide.

  • Ever sorted this out for yourself? – Volsk Dec 30 '16 at 13:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.