sqlcipher/sqlcipher
Sqlcipher
SQLCipher is an encrypted SQLite database engine and secure relational database that provides transparent AES-256 encryption for database files and stored data. It functions as a cryptographic storage engine that requires a passphrase or binary key to unlock and access content.
The engine ensures data confidentiality through page-level encryption and protects data integrity using cryptographic hashes to detect unauthorized modifications. It includes capabilities for encryption key rotation to update passphrases and secure memory locking to prevent sensitive keys from being swapped from RAM to disk.
The project covers a broad set of capabilities including database file management, SQL query execution via a command-line interface, and support for external engine extensions. It also provides mechanisms for cross-database data migration and database format migration to maintain compatibility between versions.
The source code can be compiled into a functional engine or command-line tool for Unix and Windows platforms using a C compiler.
Features
- Database Page Encryption - Provides transparent AES-256 encryption of individual database pages to ensure data is unreadable without the key.
- Secure - Ensures sensitive information is stored securely using cryptographic verification and memory locking to prevent leaks.
- Encrypted Implementations - Provides an encrypted extension of the SQLite engine with transparent 256-bit AES encryption.
- Relational Data Stores - Implements a relational data store that requires cryptographic keys to unlock and access structured content.
- Storage Engine Forks - Extends the standard SQLite B-tree and pager logic to integrate transparent encryption directly into the storage layer.
- Cryptographic - Provides a specialized storage engine that protects data integrity via page hashes and prevents key leakage through secure memory handling.
- Encrypted Database Managers - Provides an interface for creating and accessing password-protected database files using high-grade encryption.
- Local Data Storage - Enables secure local persistence of application data using passphrase-based encryption and key derivation.
- Passphrase-Based Database Access - Requires a passphrase or binary key through key derivation to unlock and access encrypted database content.
- Key Derivation Functions - Uses key derivation functions to transform user passphrases into strong cryptographic keys for database encryption.
- Integrity Verifications - Implements page-level HMACs to detect unauthorized modifications or data corruption within the database file.
- SQL Query Execution - Enables the execution, formatting, and management of SQL queries through a terminal interface or batch scripts.
- Memory Locking - Prevents sensitive encryption keys from being swapped to disk by locking memory pages in the OS.
- Application Data Security - Provides a secure way to store application settings and user data in encrypted files to prevent unauthorized access.
- Cryptographic Providers - Supports pluggable cryptographic providers, allowing the engine to use different compliant encryption libraries at build time.
- Data Protection - Protects sensitive information by detecting unauthorized tampering and sanitizing memory to prevent leaks.
- Encryption Key Management - Provides capabilities for updating the security keys or passphrases of an existing encrypted database.
- Data Persistence - Provides 256-bit AES encryption for SQLite databases.
- Seguridad y privacidad - Provides AES-256 encryption for SQLite database files.
