SQLite encrypted database Symbian/QT

[rostymartin]

I'm trying to create an encrypted database for symbian devices (mainly S^3).
I try to compile sqlcipher following this tutorial http://www.qtcentre.org/wiki/index.p...ndows/MinGW%29 but I couldn't make it work.
There is another way to add encryption to a sqlite database in symbian?

Thanks

[danhicksbyron]

Unfortunately, there's no public domain port of SqlCipher to Symbian (that I know of). I have a port I did for a customer, but can't release it without clearance.

Porting is non-trivial.

You can encrypt individual cells, but that's much, much "weaker", and slower as well.

[rostymartin]

but you were able to port the sqlcipher to symbian/qt, and make it work. Right?

[danhicksbyron]

Yes. It took about a month, looking back at file dates. Plus maybe a couple of weeks prior to that with much time spent studying up on crypto techniques. And I'd already spent a month or so studying Symbian C++, so wasn't totally in the dark there.

Be aware of the Symbian crypto support here: http://wiki.forum.nokia.com/index.ph...ptography_APIs

[rostymartin]

thanks danhicksbyron, but i think I will take a different path for my project.

[petrib]

thanks danhicksbyron, but i think I will take a different path for my project.

For most practical purposes, it should be enough to install/create the database in the application's private directory in phone memory (C-drive) without any encryption. Whether that's enough in your case depends on the case, of course.

[rostymartin]

I don't think that installing the database in the private directory is enough, because with a hacked phone any user can acces to the database. And there is, as far as I know, any device that couldn't be hacked or installed a custom firmware that allows access to the private directory. So to ensure the data protection, the database has to be encrypted.

If i'm wrong, or there is another way to ensure that the data can be protected, please let me know.

[danhicksbyron]

In any case you have the problem of storing the key. Do you require the user to re-enter the key on every use?

Is the data private to the person or private to you? If private to the person then one can assume that if they root their phone they're taking responsibility for the security. (I'm not sure if it's possible to root a phone without deleting applications stored on it.)

[rostymartin]

No, the user doesn't have to know the key.
The data stored is used by the app to "draw" the info that is showed to the user. But the data by itself, needs to be secure. I'm not sure if this explains very well....

[danhicksbyron]

Then you have the problem of securely storing the key somewhere -- basically an impossible task, especially on a rooted phone.

[rostymartin]

But if the key is hardcoded in the source code, the key will no be "secure enough"?

[petrib]

But if the key is hardcoded in the source code, the key will no be "secure enough"?

Secure enough for a regular user, but not secure for a hacker that wants to get at it. If all copies of your app has the same key, it only needs one hacker to find the key and publish it to the world. See http://en.wikipedia.org/wiki/Jon_Lech_Johansen

[rostymartin]

Ok, you have right. But I think that this will be "secure enough" for my app. Because to get the data is needed a way more "expert user" that to put the DB in the private folder, and let "(almost) any user" can get the data.
If someone finds a way to encrypt / decript data, please let me know.

[danhicksbyron]

How much data needs to be protected? If it's only a small amount (out of a larger DB), you can store the critical info as a large blob (or perhaps a separate file) and decrypt it on app start, keeping it in a Qt structure in heap. When the app ends the decrypted data goes away.

[rostymartin]

It's a lot of data. But there is a small amount in each "screen", so what i was thinking in save all encrypted in each row of the DB, an decrypt when I have to work with the data, but the problem is that I cannot find a way to encrypt / decrypt data in Symbian phones, I tried SymbianCryptographyLibraries but I cannot make it work in Qt Creator :s