[{"data":1,"prerenderedAt":359},["ShallowReactive",2],{"project-40208800":3},{"id":4,"name":5,"line":6,"line_source":7,"title":8,"url":9,"domain":10,"maker":11,"posted_at":12,"year":13,"points":14,"comments":15,"rank_in_year":16,"shown_in_year":17,"top":18,"tier":19,"category":20,"subcategory":21,"format":22,"keywords":23,"reception":29,"sentiment":30,"stance_mix":31,"scored_comments":36,"aspects":37,"strip":44,"post_text":47,"what":48,"said":91,"maker_in_thread":188,"shape":199,"grid":204,"attempts":321,"same_week":322,"maker_shows":45,"maker_hidden":351,"reader_version":352,"card":353},"40208800","go-sqlite3 Adiantum VFS","Roast my SQLite encryption at-rest","title","Show HN: Roast my SQLite encryption at-rest","https:\u002F\u002Fgithub.com\u002Fncruces\u002Fgo-sqlite3\u002Ftree\u002Fmain\u002Fvfs\u002Fadiantum","github.com","ncruces",1714468347,2024,99,50,841,3515,24,"notable","security_privacy","database encryption at rest","library",[24,25,26,27,28],"sqlite encryption","at-rest encryption","adiantum","go sqlite","vfs","mixed",-0.026,{"positive":32,"neutral":33,"mixed":34,"critical":35},4,7,1,6,18,{"performance":38,"privacy":40,"idea":41,"docs":43},{"positive":34,"critical":39},0,{"positive":39,"critical":32},{"positive":42,"critical":42},2,{"positive":39,"critical":39},[45,39,45,46,39,39,34,39,34,39,34,34,39,45,39,45,34,46,34,39,46,39,45,39,39,39,39,39,39,45,45,45,39,39,39,39,39,39,39,46],3,5,"SQLite encryption at-rest is a hot requested feature of both the “default” CGo driver [1] and the transpiled alternative driver [2]. So, this is a feature I wanted to bring to my own Wasm based Go driver\u002Fbindings [3].\n\nOpen-source SQLite encryption extensions have had a troubled last few years. For whatever reason, in 2020 the (undocumented) feature that made it easy to offer page-level encryption was removed [4]. Some solutions are stuck with SQLite 3.31.1, but Ulrich Telle stepped up with a VFS approach [5].\n\nStill, their solution seemed harder than something I'd want to maintain, as it requ",{"problem":49,"audience":58,"pricing":63,"motivation":64,"time_to_build":63,"stack":69,"openness":88,"stage":89,"team_size":90},{"value":50,"source":51,"evidence":52},"Encrypting SQLite database files at rest without relying on SQLITE_HAS_CODEC or forked SQLite","maker",[53,55],{"id":54},"post",{"id":56,"by":11,"text":57},"40212868","So, I haven't studied their solution much, but ISTM what they did was fork SQLite at (around) the time of the commit that removed SQLITE_HAS_CODEC, and forward port the 4 years…",{"value":59,"source":60,"evidence":61},"Go developers using SQLite who need encryption at rest","inferred",[62],{"id":54},null,{"value":65,"source":51,"evidence":66},"Bring encryption at rest to the Go SQLite driver without maintaining a fork of SQLite",[67,68],{"id":54},{"id":56,"by":11,"text":57},[70,74,78,82],{"value":71,"source":51,"evidence":72},"Go",[73],{"id":54},{"value":75,"source":51,"evidence":76},"WebAssembly",[77],{"id":54},{"value":79,"source":51,"evidence":80},"Adiantum",[81],{"id":54},{"value":83,"source":51,"evidence":84},"Argon2id",[85],{"id":86,"by":11,"text":87},"40222882","I used the parameters suggested in the documentation [1], which follow the RFC. The KDF is invoked every time a connection is opened iff you specify your key with the textkey=…","open_source","beta","solo",{"praise":92,"objections":101,"requests":124,"questions":140,"alternatives":156},[93],{"value":94,"source":95,"evidence":96},"Thanks for sharing this","commenter",[97],{"id":98,"by":99,"text":100},"40221536","Hakeed1990","Thanks for sharing this.",[102,109,116,120],{"value":103,"source":95,"evidence":104},"Deterministic encryption without nonces leaks whether blocks changed or reverted",[105],{"id":106,"by":107,"text":108},"40215694","580515975","A couple of thoughts: First, great job on the readme! One way you could improve it is by expanding on the \"Caution\" section. What's written is the beginnings of a threat model,…",{"value":110,"source":95,"evidence":111},"Static public Argon2 salt allows precomputation of keys",[112],{"id":113,"by":114,"text":115},"40221926","d-z-m","For your KDF, how did you select the parameters for Argon2id? How often is the KDF invoked \u002F what are your requirements for speed in KDF'ing? Nit, but your \"pepper\" is…",{"value":117,"source":95,"evidence":118},"Threat model in README is incomplete and needs explicit attacks",[119],{"id":106,"by":107,"text":108},{"value":121,"source":95,"evidence":122},"Pepper name is misleading since it is not secret",[123],{"id":113,"by":114,"text":115},[125,129,133],{"value":126,"source":95,"evidence":127},"Clarify the threat model in the documentation",[128],{"id":106,"by":107,"text":108},{"value":130,"source":51,"evidence":131},"Port to C or Rust as a loadable extension",[132],{"id":54},{"value":134,"source":95,"evidence":135},"Add Append variants to avoid allocations",[136],{"id":137,"by":138,"text":139},"40212315","nemo1618","Hey, it's my Adiantum package! How's the performance? Revisiting the API now, I see that Encrypt and Decrypt return newly-allocated slices, which is unfortunate. Should I add…",[141,148,152],{"value":142,"source":95,"evidence":143},"How does it compare with SQLCipher performance and design?",[144],{"id":145,"by":146,"text":147},"40212190","justinclift","How do you feel yours compares with (say) SQLCipher, which is a very popular C based one, and keeps fairly close to the upstream SQLite releases? *…",{"value":149,"source":95,"evidence":150},"How were Argon2id parameters chosen?",[151],{"id":113,"by":114,"text":115},{"value":153,"source":95,"evidence":154},"Is padding to block size safe and what are atomicity guarantees?",[155],{"id":106,"by":107,"text":108},[157,161,168,174,181],{"value":158,"source":95,"evidence":159},"SQLCipher",[160],{"id":145,"by":146,"text":147},{"value":162,"source":95,"evidence":163},"SQLite Encryption Extension",[164],{"id":165,"by":166,"text":167},"40214315","pyuser583","SQLite has a paid version. One of the paid features is encryption. They’re not going to make it easy.",{"value":169,"source":95,"evidence":170},"SQLite3 Multiple Ciphers",[171],{"id":172,"by":11,"text":173},"40221515","FTA: \"One project in particular was very suitable for us, SQLite Multiple Ciphers. Since it is licensed under MIT, we have just moved the code into libSQL.\" See, this is what I…",{"value":175,"source":95,"evidence":176},"libSQL",[177],{"id":178,"by":179,"text":180},"40215007","bityard","Have you considered targeting libSQL for this instead? https:\u002F\u002Fgithub.com\u002Ftursodatabase\u002Flibsql SQLite is a great product and I use it a lot, but it does not have a great history…",{"value":182,"source":95,"evidence":183},"ZFS encryption",[184],{"id":185,"by":186,"text":187},"40216138","cryptonector","The threat model has to exclude: - attacks on a running app that has the keys loaded, naturally The threat model has to include at least: - passive attacks against the DB itself,…",{"comments":189,"answered":190,"key":191},14,9,[192,193,196],{"id":56,"text":57},{"id":194,"text":195},"40213231","Hey! That's amazing that you found this. I haven't benchmarked much, but I think I measured a 15% hit on speedtest1 [1] (with about 10% inside your library). Less if I kept…",{"id":197,"text":198},"40214479","Of course, nor would I expect them to make it so. In fact, I mention the SEE in my package's documentation. If you have a license to the paid extension, it should be easy to…",{"commenters":200,"max_depth":201,"maker_replies":189,"first_comment_mins":202,"lifespan_hours":203},19,10,381,116,[205,207,209,211,212,215,217,219,223,225,228,229,231,233,235,237,239,241,243,245,247,251,255,258,261,265,268,271,273,275,279,282,284,286,287,290,293,295,296,298,300,303,305,307,309,311,313,315,317,319],[145,39,45,206,146,39],"project\u002Fneutral\u002Fnone",[56,39,39,208,11,34],"project\u002Fneutral\u002Fdesign",[137,34,45,210,138,39],"project\u002Fneutral\u002Fperformance",[194,34,39,210,11,34],[213,34,46,214,138,39],"40213848","project\u002Fpositive\u002Fperformance",[165,42,39,216,166,39],"other\u002Fneutral\u002Fnone",[197,42,39,218,11,34],"project\u002Fneutral\u002Fpricing",[220,42,34,221,222,39],"40215543","project\u002Fcritical\u002Fprivacy","cipherboy",[224,42,39,206,11,34],"40215622",[226,42,39,216,227,39],"40215816","acheong08",[113,45,34,221,114,39],[86,45,39,230,11,34],"project\u002Fneutral\u002Fprivacy",[232,45,34,221,114,39],"40238424",[234,45,39,230,11,34],"40239161",[236,45,34,221,114,39],"40243531",[238,45,39,230,11,34],"40246872",[240,45,45,230,114,39],"40248125",[242,45,39,210,11,34],"40250383",[244,45,45,230,114,39],"40255736",[246,45,39,230,11,34],"40256207",[248,32,34,249,250,39],"40222188","project\u002Fcritical\u002Fidea","slifin",[252,32,46,253,254,39],"40222601","project\u002Fpositive\u002Fidea","dig1",[256,32,34,249,257,39],"40231031","GauntletWizard",[259,32,39,260,254,39],"40234190","commenter\u002Fneutral\u002Fidea",[262,32,39,263,264,39],"40236973","commenter\u002Fneutral\u002Fnone","CRConrad",[266,32,46,253,267,39],"40226530","laurent123456",[269,32,39,263,270,39],"40246132","deskr",[178,46,45,272,179,39],"project\u002Fneutral\u002Fidea",[274,46,39,272,11,34],"40215205",[276,46,39,277,278,39],"40220266","other\u002Fneutral\u002Fdocs","avinassh",[280,46,39,281,11,34],"40221919","project\u002Fcritical\u002Fdocs",[283,46,39,277,278,39],"40262352",[285,46,39,216,278,39],"40220091",[172,46,39,216,11,34],[288,46,39,216,289,39],"40227078","utelle",[291,46,39,292,278,39],"40262335","other\u002Fneutral\u002Fpricing",[106,35,45,294,107,39],"project\u002Fmixed\u002Fdocs",[185,35,45,230,186,39],[297,35,39,230,11,34],"40217168",[299,35,45,230,186,39],"40217256",[301,35,39,302,146,39],"40225928","commenter\u002Fneutral\u002Fprivacy",[304,35,39,263,186,39],"40226153",[306,35,39,263,146,39],"40226331",[308,35,39,263,186,39],"40229961",[310,35,39,263,146,39],"40232211",[312,35,39,263,146,39],"40226422",[314,35,39,216,186,39],"40228441",[316,35,39,216,146,39],"40232221",[318,35,39,230,11,34],"40217132",[98,33,46,320,99,39],"project\u002Fpositive\u002Fnone",[],[323,328,332,337,341,346],{"id":324,"name":325,"points":326,"category":327},"40159278","NAND",420,"learning_science",{"id":329,"name":330,"points":202,"category":331},"40210627","Extension.js","dev_tools",{"id":333,"name":334,"points":335,"category":336},"40213562","where to stream",335,"consumer_social",{"id":338,"name":339,"points":340,"category":331},"40191510","Dotenv",225,{"id":342,"name":343,"points":344,"category":345},"40222051","Factful",222,"ai",{"id":347,"name":348,"points":349,"category":350},"40173237","Lanki",206,"productivity",false,"v2",{"id":354,"name":5,"line":6,"ai":351,"cat":20,"year":13,"points":14,"comments":15,"rec":29,"s":355,"top":18,"kw":356,"maker":11,"domain":10,"tier":19,"attempts":39,"strip":357,"url":9,"mix":358,"praise":94,"objection":103,"sub":21},40208800,-0.03,[24,25,26,27,28],"3035001010110303151050300000033300000005",[32,33,34,35],1793991090143]