Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

encrypted data can be viewed through simple "cat database.db" #13

Closed
ghost opened this issue Sep 16, 2011 · 5 comments
Closed

encrypted data can be viewed through simple "cat database.db" #13

ghost opened this issue Sep 16, 2011 · 5 comments

Comments

@ghost
Copy link

ghost commented Sep 16, 2011

encrypted data can be viewed through simple "cat database.db"

you must be joking, this has nothing to do with data security.

@sjlombardo
Copy link
Member

If you can see the plaintext data by dumping the database then you either:

  1. haven't built and linked SQLCipher properly with your application; or
  2. haven't set a key on the database as the first operation before use, in which case SQLCipher operates exactly like standard SQLite.

Please carefully review the documentation for how to use SQLCipher at http://sqlcipher.net/sqlcipher-api/. If you provide a full log of what you're doing we can try to make recommendations about what you've missed.

As an aside, snarky comments like "you must be joking, this has nothing to do with data security" aren't a very good way to get support from open source projects.

@ghost
Copy link
Author

ghost commented Sep 18, 2011

sorry for the delay. I was just double checking in my vm and I have linked and built my SQlite3 with SQLcipher. I did it with dynamic linking like in the docs:

./configure --enable-tempstore=yes CFLAGS="-DSQLITE_HAS_CODEC" LDFLAGS="-lcrypto" make

I also have set the PARAM key and so on. And of course, you are right: when trying to access the data without key or with an sqlite-shellexecuteable that is not linked and built with SQLCipher you cannot access the data.

But the nasty thing is, as I just wrote above: You can make a simple "cat dbfile.db" and you will see sensible data, if the tables have a certain length.

That shouldn't be a problem, because I came across other databases where this is the same. Although the maintainers firebird say their data is encrypted, you can simply do a "cat security2.fb" and you will see the passwords in clean text format.

In my opinion this is a strange thinking about encryption and security of data.

@sjlombardo
Copy link
Member

Lenzcom - the observations you've made are not correct, so I suspect there is still something wrong with your testing.

As the following terminal listing shows, once the database is properly initialized and encrypted it is not possible to see any plaintext data in the database. You will not be able to see any plain text data in an encrypted SQLCipher database via cat.

Are you sure you are using the proper version of sqlite3, local to the build directory or installation directory? If you are on a system with an existing sqlite3 in the default path you will not be using sqlcipher unless you provide the fully qualified path to the binary.

If you are still having problems, please provide a full listing of everything you are doing to reproduce.

zenzic:sjlombardo sqlcipher:master$ ./configure --enable-tempstore=yes CFLAGS="-DSQLITE_HAS_CODEC" LDFLAGS="-lcrypto"
zenzic:sjlombardo sqlcipher:master$ make
zenzic:sjlombardo sqlcipher:master$ ./sqlite3 test.db
SQLite version 3.7.2
Enter ".help" for instructions
Enter SQL statements terminated with a ";"
sqlite> pragma key = 'test123';
sqlite> create table t1(a,b);
sqlite> insert into t1(a,b) values ('column a', 'column b');
sqlite> select * from t1;
column a|column b
sqlite> .quit
zenzic:sjlombardo sqlcipher:master$ ./sqlite3 test.db
SQLite version 3.7.2
Enter ".help" for instructions
Enter SQL statements terminated with a ";"
sqlite> select * from t1;
Error: file is encrypted or is not a database
sqlite> .quit
zenzic:sjlombardo sqlcipher:master$ ./sqlite3 test.db
SQLite version 3.7.2
Enter ".help" for instructions
Enter SQL statements terminated with a ";"
sqlite> pragma key = 'test123';
sqlite> select * from t1;
column a|column b
sqlite> .quit
zenzic:sjlombardo sqlcipher:master$ hexdump -C test.db 
00000000  01 76 e7 54 32 dd e8 a4  45 0c 56 e8 5f d2 09 98  |.v.T2...E.V._...|
00000010  23 47 29 f2 21 f3 ef 80  6e 21 5d 37 36 fd 61 d4  |#G).!...n!]76.a.|
00000020  ed 52 25 5a d5 ec c6 72  f5 e5 a2 3a 1b bc f9 e0  |.R%Z...r...:....|
00000030  9e d5 6a a3 1a b6 28 d9  61 82 69 63 c5 11 7f a2  |..j...(.a.ic....|
00000040  e2 5c c9 48 46 2d 30 72  40 84 69 98 dd 6f f5 8f  |.\.HF-0r@.i..o..|
00000050  73 a4 57 ad 38 59 e7 88  fc 6b 25 43 b2 e7 d4 35  |s.W.8Y...k%C...5|
00000060  49 b4 ed b2 66 18 d5 ee  ad ff eb 14 14 d5 24 10  |I...f.........$.|
00000070  f1 98 ce 2f 48 98 3d c1  63 c8 ea 4a 2e d1 b9 d2  |.../H.=.c..J....|
00000080  eb 19 8a 08 b2 7e 7f 7e  24 e2 1b 15 88 0b 14 14  |.....~.~$.......|
00000090  a4 c6 8d 09 c5 a2 35 24  15 95 f0 17 8c f6 df b3  |......5$........|
000000a0  43 ac cc 4d b8 2a 9d da  35 31 e9 4d af f9 b5 e8  |C..M.*..51.M....|
000000b0  4c bf ad 79 4c d1 f4 b3  94 ef 61 33 5a bf 2d 02  |L..yL.....a3Z.-.|
000000c0  9f 59 6a 77 ce 0a a8 b2  09 96 ce 40 c2 44 4d 2b  |.Yjw.......@.DM+|
000000d0  e4 e8 fc 0d f1 6a 3d 02  07 33 f4 f5 40 b5 88 87  |.....j=..3..@...|
000000e0  aa fa 37 e2 61 f4 c6 f7  4f 8f a9 2b 31 57 26 85  |..7.a...O..+1W&.|
000000f0  8f 51 3c f1 0f 7a c5 fa  9c d7 ef 14 62 e8 5a 50  |.Q<..z......b.ZP|
00000100  9b 2d 59 f1 0d a9 03 3d  ba c0 68 db d6 4e 0b 73  |.-Y....=..h..N.s|
00000110  e2 4b a2 6c 05 b2 c3 8b  fa e9 32 97 d4 32 35 4e  |.K.l......2..25N|
00000120  c3 73 bd 83 db 36 14 25  78 8f 8f 7b 93 10 4b b4  |.s...6.%x..{..K.|
00000130  90 98 e0 9e c3 10 c1 e6  25 31 d4 d2 51 40 30 e5  |........%1..Q@0.|
00000140  ca a4 0d 4b 23 12 7e c9  cb 6b f6 67 8e c7 73 88  |...K#.~..k.g..s.|
00000150  e0 36 bf 92 0e e1 e5 70  7c d3 f3 35 dd 8d ef 9f  |.6.....p|..5....|
00000160  11 5f e3 91 1f ea c7 f5  72 1f 8b 92 12 b3 33 d8  |._......r.....3.|
00000170  0e 7b 48 ad f9 fb af f7  7b fd 58 4f 60 8a 25 16  |.{H.....{.XO`.%.|
00000180  da ab c0 31 80 55 ec da  dd fd 7d b6 73 b2 d6 3e  |...1.U....}.s..>|
00000190  9a 5c 7a a8 63 ad 86 ad  f0 26 74 e5 3d c1 f0 50  |.\z.c....&t.=..P|
000001a0  19 78 f0 53 a2 eb 6a 5d  f6 1c 20 ba 01 dc cc 61  |.x.S..j].. ....a|
000001b0  27 d1 32 93 46 56 a4 07  d1 9a fe a7 63 36 cf ef  |'.2.FV......c6..|
000001c0  a4 36 4e 05 c3 ce e2 a9  cd 85 ad 7b ae fe 34 75  |.6N........{..4u|
000001d0  66 16 c2 54 ea 5e c1 a0  a2 59 d6 63 0f f2 65 0d  |f..T.^...Y.c..e.|
000001e0  9d 4a b8 d2 bd af 87 e9  98 d9 a0 13 ee d5 f2 a2  |.J..............|
000001f0  d8 db bf ed a7 a2 f4 b8  aa 2b 89 b4 df f1 8a a4  |.........+......|
00000200  e8 01 2e 5f 5e 79 7f f3  8d 33 32 c3 6c 46 99 f4  |..._^y...32.lF..|
00000210  c7 d9 0d 34 77 22 3a 11  d1 10 cd c5 a8 55 b4 52  |...4w":......U.R|
00000220  24 ad bf 08 06 d4 d0 3b  40 8c 49 8f a0 56 30 9b  |$......;@.I..V0.|
00000230  be e2 f3 56 02 a5 5f e2  fc 55 9b 7e f1 4d 8c 67  |...V.._..U.~.M.g|
00000240  73 af 01 c4 8e 34 d9 62  dc 67 77 4a f5 fc f8 8e  |s....4.b.gwJ....|
00000250  24 9c 99 7a af 19 79 c4  96 86 09 7e 54 18 4e 18  |$..z..y....~T.N.|
00000260  ea 36 79 18 36 bd 4d 31  d3 32 3b 2b 5b af 74 06  |.6y.6.M1.2;+[.t.|
00000270  df 6d 56 5f fe 3b 44 30  f9 23 33 6c ab d1 bd 34  |.mV_.;D0.#3l...4|
00000280  88 28 5d 2b 47 53 0f 61  e0 d3 0b 31 74 47 3c 39  |.(]+GS.a...1tG<9|
00000290  7e 5d 83 20 79 6b 7c de  bf 55 61 6a 24 39 36 70  |~]. yk|..Uaj$96p|
000002a0  26 53 94 7e 89 06 e4 cb  e6 cb 19 fc 49 57 b4 71  |&S.~........IW.q|
000002b0  58 03 5b 62 8e 3e 2a 10  5a 39 68 c9 98 b5 6b 95  |X.[b.>*.Z9h...k.|
000002c0  d4 35 2b fc c1 27 97 00  d6 76 3f d1 fe 33 a1 e3  |.5+..'...v?..3..|
000002d0  a4 c6 73 a2 46 21 2f 8b  ad 00 18 5e 41 6f cf 7b  |..s.F!/....^Ao.{|
000002e0  4d 8d c3 5d eb 50 61 ce  0e d5 42 1e f3 6e 7d c7  |M..].Pa...B..n}.|
000002f0  79 76 ed 0a f7 0c 1b 87  6d f8 e9 d9 06 c1 7c 12  |yv......m.....|.|
00000300  b2 9c af 17 15 a7 bd 2c  67 4c 1c bd 74 e1 70 89  |.......,gL..t.p.|
00000310  6e f3 fc df fe 0f 1c 9c  b8 d1 89 bc 01 dc e3 24  |n..............$|
00000320  33 4f 05 69 06 6d 5a a5  90 89 52 87 a2 38 6f 76  |3O.i.mZ...R..8ov|
00000330  c7 53 a6 d6 29 c6 54 6a  02 c6 2e b7 f2 9a f1 63  |.S..).Tj.......c|
00000340  78 72 d2 dd fb 42 4f 43  13 7d f2 0e 2a ca b0 54  |xr...BOC.}..*..T|
00000350  68 c7 a0 e0 8f f5 b2 9b  5f bb a0 89 52 05 4d e7  |h......._...R.M.|
00000360  2f 1c d4 44 1f fc 6f ef  e6 71 92 da 46 51 d1 88  |/..D..o..q..FQ..|
00000370  d1 e0 1f 10 4d 76 18 6b  50 65 e4 b3 e4 28 11 12  |....Mv.kPe...(..|
00000380  9a c2 3b 53 50 98 e3 f4  93 31 b1 c4 5c ed a4 b4  |..;SP....1..\...|
00000390  56 76 01 8b 6c 1d 47 ac  e3 09 0f 17 fb cb c3 db  |Vv..l.G.........|
000003a0  f3 71 31 f6 e1 0f d7 aa  b5 32 32 77 c9 f7 7d 33  |.q1......22w..}3|
000003b0  8c fb 20 9b 31 e0 25 53  61 75 b2 66 45 10 92 86  |.. .1.%Sau.fE...|
000003c0  1e a2 db ce 8e c6 eb bf  7d aa 86 1d 07 01 2d 85  |........}.....-.|
000003d0  85 97 32 76 87 80 f5 52  f7 d1 e5 d3 27 46 b2 b5  |..2v...R....'F..|
000003e0  a9 71 6d 52 bd ad 1e e2  13 73 ff 2a c8 3c 41 06  |.qmR.....s.*..+|
00000590  74 e0 58 eb 10 62 4d b4  0b cc da 24 e3 df 66 b7  |t.X..bM....$..f.|
000005a0  96 10 ad 17 dd 72 86 29  1c 73 5a 41 53 78 39 3b  |.....r.).sZASx9;|
000005b0  64 ec 78 9c 5c 85 2d 0c  56 cb be a1 d5 75 dc 95  |d.x.\.-.V....u..|
000005c0  5c 79 2b 97 bd dc 1c f5  0d 99 4c b8 54 db 71 af  |\y+.......L.T.q.|
000005d0  ff 2e 1e 38 80 dc bc 76  12 50 6a ab 1e 26 45 23  |...8...v.Pj..&E#|
000005e0  5e 8d 16 c2 37 86 f4 0b  1a 3b f2 76 46 f6 5e d4  |^...7....;.vF.^.|
000005f0  2c 02 79 73 a1 b5 73 a3  94 cd 85 84 c2 16 22 d8  |,.ys..s.......".|
00000600  4e fc b7 cb c4 aa 57 f2  8a 55 a4 3e 21 b8 26 d2  |N.....W..U.>!.&.|
00000610  68 20 6e bd 43 a0 d9 13  1d d1 1f 29 1a ea 7c c1  |h n.C......)..|.|
00000620  99 9c 9d 9d 1b b7 a8 05  7d d0 99 32 c3 98 2a 4f  |........}..2..*O|
00000630  84 ae e0 04 d8 5c 9f ec  72 86 a7 bc 42 cf d9 58  |.....\..r...B..X|
00000640  ce 33 5a 71 54 31 27 9c  8d ad de f4 49 37 71 44  |.3ZqT1'.....I7qD|
00000650  55 ea 6e f4 c0 72 35 ae  0c bf d2 59 1b 80 77 1a  |U.n..r5....Y..w.|
00000660  3d 25 a0 72 df e2 08 60  0f 70 65 da db 4e f4 ad  |=%.r...`.pe..N..|
00000670  41 d7 eb 2b 81 9a 3f b3  be 89 d2 be 87 36 a9 22  |A..+..?......6."|
00000680  43 8b 74 1b d9 bd 34 1f  3d ce 1e 33 48 84 e6 e0  |C.t...4.=..3H...|
00000690  56 f9 03 37 74 4a 12 de  b3 f7 aa 22 81 f9 9b b0  |V..7tJ....."....|
000006a0  6e 6b 9b bc 2e 38 7d 6e  bb 90 a6 9d 64 90 ed 7a  |nk...8}n....d..z|
000006b0  c4 14 9e f2 35 f7 4b 57  69 eb 44 65 c0 4f 44 11  |....5.KWi.De.OD.|
000006c0  31 a0 7e 52 25 d3 d5 e6  72 33 e6 20 22 98 d2 70  |1.~R%...r3. "..p|
000006d0  32 9b 9b 68 27 57 8a 85  52 f0 21 cd 7e b6 e2 e6  |2..h'W..R.!.~...|
000006e0  96 87 ea 17 35 60 5b 67  3a e8 39 de 70 8f 35 45  |....5`[g:.9.p.5E|
000006f0  c1 6f 99 a8 9f e4 bc 0d  4e 44 1f 01 ef ff cb c3  |.o......ND......|
00000700  d3 7e a8 40 93 03 1c c6  cc bd 7c 20 5f 57 a1 49  |.~.@......| _W.I|
00000710  3a 6d 29 94 d4 58 6a 41  1b 19 b8 54 29 5a e8 1a  |:m)..XjA...T)Z..|
00000720  ee 47 bf d2 5a f8 47 fe  77 34 ba 9a 0b e0 be 81  |.G..Z.G.w4......|
00000730  c8 06 99 73 6e bd b5 17  74 a1 33 df d2 84 c7 52  |...sn...t.3....R|
00000740  8d a7 f5 6f f1 cc 39 d3  cd 44 bd 73 ba 6a 00 7d  |...o..9..D.s.j.}|
00000750  c6 64 22 bf 82 8a 55 9f  23 c6 63 98 80 84 83 ef  |.d"...U.#.c.....|
00000760  fa 04 bb 73 7a f9 fc 77  b3 28 bc ec cb 32 54 7f  |...sz..w.(...2T.|
00000770  5e 86 4d 98 bd ea 5b df  3f 0d e4 5c 9c bc 53 68  |^.M...[.?..\..Sh|
00000780  68 31 08 fc a9 be d7 47  8b 01 39 56 f6 f0 a7 3d  |h1.....G..9V...=|
00000790  b8 03 1c c6 17 44 3b e3  e5 a6 48 d2 c1 da 04 68  |.....D;...H....h|
000007a0  64 e6 cb 8c 7b fa e5 79  48 fe 0c ae 71 44 bb 60  |d...{..yH...qD.`|
000007b0  2b da f8 f3 d1 5b 45 c3  b5 f2 dd 37 af 47 85 3e  |+....[E....7.G.>|
000007c0  52 11 4d d7 bd e4 38 a2  f7 7a ac 55 75 8f 55 a1  |R.M...8..z.Uu.U.|
000007d0  72 3e dc 4f cb e3 7c c5  13 a8 1c 8d d7 ab 91 49  |r>.O..|........I|
000007e0  c9 62 88 95 d9 e5 6c 2c  f1 aa c2 fe 1f ce 2a 5d  |.b....l,......*]|
000007f0  6b ca 06 c4 0d 3e a6 b3  e6 f9 27 6d 84 68 2f 95  |k....>....'m.h/.|
00000800
zenzic:sjlombardo sqlcipher:master$ cat test.db 
v?T2??E
       V?_? ?#G)?!??n!]76?a??R%Z???r??:???j??(?a?ic?�??\?HF-0r@?i??o?s?W?8Y??k%C???5I??f?????$??/H?=?c??J.ѹ???~�~$??
                                                                                                                        ?ƍ Ţ5$????߳C??M?*??51?M???L??yL???a3Z?-?Yjw?
?=??h??N????7?a???O??+1W&??Q~TN?6y6?M1?2;+[?t?mV_?;D0?#3l?ѽ4?(]+GSa????6N???ͅ?{??4uf?T?^??Y?c?e
                                                                                                         1tG<9~]? yk|޿Uaj$96p&S?~??????IW?qX[b?>*Z9hɘ?k??5+??'??v???3???s?F!/??^Ao?{M??]?Pa??B?n}?yv?
?
 m????|?????,gL?t?p?n??????щ???$3OimZ???R??8ov?S??)?Tj?.???cxr???BOC}?*ʰThǠ??_???RM?/?D?o??q??FQш??MvkPe??(??;SP???1??\?Vv?lG?? ?????q1??ת?22w??}3?? ?1?%Sau?fE????Ύ??}??-???2v???R????'F???qmR???s?*??+t?X?bM?
                                                                                                 ??$??f????r?)sZASx9;d?x?\?-
?L?T?q??.8?ܼvPj?&E#^??7??                                                                                                    V˾??uܕ\y+????
                        ;?vF?^?,ys??s??ͅ??"?N??ĪW?U?>!?&?h n?C???)?|?????}Й2Ø*O????\??r???B??X?3ZqT1'?????I7qDU?n??r5?
                                                                                                                     ??Yw=%?r?`pe??N?A??+??????Ҿ?6?"C?t?4=?3H???V?7tJ޳?"??nk??.8}n????d??z???5?KWi?DeND?????~?@??̽| _W?I:m)??XjA?T)Z??G??Z?G?w4??9?p?5E?o????
?\??Shh??G?9V??=??D;??H???hd?ˌ{??yH?        ཱྀ??sn??t?3?҄?R???o??9??D?s?j}?d"???U?#?c???????sz??w?(???2T�^?M???[??
>????'m?h/?zenzic:sjlombardo sqlcipher:master$ Eõ??7?G?>RM׽?8??z?Uu?U?r>?O??|???׫?I?b????l,????*]k??

@ghost
Copy link
Author

ghost commented Sep 19, 2011

man, a hexdump nearly always looks like someting encrypted.

But you are right, I fiunally figured it out. My first build seemed that it did not encrypt with the sha256 crypting.

Now it works perfectly. So we can close this. Thanks for communicating.

@kanwarpalSinghKalsi
Copy link

I am following your instructions given above.
when i try to run command "./sqlite3 test.db" it says "-bash: ./sqlite3: No such file or directory"

screen shot 2013-09-05 at 4 26 15 pm

This issue was closed.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants