ForestDB encryption

Mobile Couchbase Lite
1

Is encryption already turned on in the ForestDB storage engine, or does it need to be registered, like with SQLite?

2

I’m not sure what you mean by “registered”. You don’t need to add any extra software to use ForestDB encryption.

1 Like
3

By “registered” I meant something like:

var key = new SymmetricKey("password123456");
var options = new DatabaseOptions
{
    EncryptionKey = key,
    Create = true,
    StorageType = StorageEngineTypes.SQLite
};
Database database = manager.OpenDatabase("db", options);

Ok, cool thanks.

4

It is already there. You don’t need a separate package like SQLite vs sqlcipher.

1 Like
5

Wait that looks different than what I thought. You still need to set the encryption key to encrypt a forestdb database you just don’t need to download and register a second Nuget package.

1 Like
6

You can’t encrypt anything without a key; that’s just how encryption works. So yes, you have to specify a key when creating and opening a database. And of course the key has to be unguessable; either entered by the user or kept in a secure store like the Mac/iOS Keychain.

1 Like
7

Would it be a good idea to use the user’s password as the key?

8

Yes, you can use a password entered by a user. In our API the key can be given as a string or as binary data. If it’s a string, we run it through a secure key-derivation function to convert it to an AES256 key internally.

9

I would say you should do this with caution, though. Relying on user passwords opens you to a dictionary attack. If an attacker can get hold of the encrypted database, it’s not hard to run an exhaustive search. As with all security, you need weigh trade-offs.

10

That’s true of anything that uses passwords, though. The key derivation function (PBKDF2) is deliberately made very CPU-intensive so that a brute force attack will take a long time. This is the same strategy used by servers that store encrypted/digested passwords.

Another good strategy is to generate a random key (32 bytes of random data generated by a secure random number generator, i.e. /dev/random NOT rand()) and store that in the system’s secure password store. That would be the Keychain on iOS or macOS; I don’t know what it’s called on other platforms.