Thursday, June 21, 2012

Unable to attach() or open() encrypted SQLite databases in AIR

Today I'll discuss issues related to opening and attaching encrypted databases.

While working on KirSQLite I've encountered some problems dealing with encrypted databases.

The problems began when I noticed that I was unable to attach() encrypted databases, even though I was certain that the key I was using is the correct one. The proof of that was the fact that I could open() the same encrypted databases without any problems, using the same key.

After researching this case on the internet I found quite a few people having the same problems. There was no solution, though.

Then I began experimenting with encrypting and reading encrypted databases to get to the core of the problem. After several tests, I found a weird pattern in encrypted database behavior.

It turned out that I could open() databases that were initially created and encrypted using the open() method. Similarly, I could only attach() databases that were initially created and encrypted using the attach() method.

The reason behind this weird behavior is unclear to me. At first I thought that the cause might be the salts that are randomly generated to enhance the security of the database. However, after analyzing the EncryptionKeyGenerator class from the as3core library I have been using, I found no evidence that the generated salt was somehow dependent on whether the database was created using open() or attach() method.

Sadly, I still have not found any solution to this problem. I have managed to identify when it occurs and how to prevent it, as I already stated above, but not more than that.

On a bright side, however, encrypted databases are rarely (if ever) used without being attached to a certain application. If the application is initially designed to create and work with that specific encrypted database, then there will be no problems with compatibility between the program and the database.

If you found a solution to this problem, or more information you want to share, please leave a comment below.

Thanks for reading!

No comments:

Post a Comment