db_crypt.c File Reference

#include <cwist/security/db_crypt/db_crypt.h>
#include <openssl/evp.h>
#include <openssl/mem.h>
#include <openssl/rand.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

Include dependency graph for db_crypt.c:

Go to the source code of this file.

Functions
unsigned char *	cwist_db_crypt_seal (const cwist_db_crypt_ctx_t *ctx, const unsigned char *sqlite_bytes, size_t sqlite_len, size_t *out_len)
	Encrypt an SQLite database blob.
unsigned char *	cwist_db_crypt_open (const cwist_db_crypt_ctx_t *ctx, const unsigned char *blob, size_t blob_len, size_t *out_len)
	Decrypt a sealed blob produced by cwist_db_crypt_seal().

Function Documentation

cwist_db_crypt_open()

unsigned char * cwist_db_crypt_open	(	const cwist_db_crypt_ctx_t *	ctx,
		const unsigned char *	blob,
		size_t	blob_len,
		size_t *	out_len
	)

Decrypt a sealed blob produced by cwist_db_crypt_seal().

Recovers the DEK from the blob header, decrypts the SQLite bytes, and returns the original database content.

Parameters

	ctx	Key context (kek must match the one used for sealing).
	blob	Sealed blob.
	blob_len	Length of blob.
[out]	out_len	Length of the returned plaintext.

Returns

Heap-allocated SQLite bytes, or NULL on error. Caller must free().

Definition at line 160 of file db_crypt.c.

References cap, CWIST_DB_CRYPT_HDR_LEN, CWIST_DB_CRYPT_IV_LEN, CWIST_DB_CRYPT_KEY_LEN, cwist_db_crypt_ctx_t::kek, and OPENSSL_cleanse.

Referenced by cwist_db_sync_pull().

cwist_db_crypt_seal()

unsigned char * cwist_db_crypt_seal	(	const cwist_db_crypt_ctx_t *	ctx,
		const unsigned char *	sqlite_bytes,
		size_t	sqlite_len,
		size_t *	out_len
	)

Encrypt an SQLite database blob.

Generates a random DEK and IV pair, encrypts sqlite_bytes with the DEK, wraps the DEK under the KEK, and returns the complete sealed blob.

Parameters

	ctx	Key context (kek must be filled).
	sqlite_bytes	Raw SQLite database bytes (from sqlite3_serialize or a file read).
	sqlite_len	Length of sqlite_bytes.
[out]	out_len	Length of the returned blob.

Returns

Heap-allocated sealed blob, or NULL on error. Caller must free() the returned pointer.

Definition at line 68 of file db_crypt.c.

References cap, CWIST_DB_CRYPT_IV_LEN, CWIST_DB_CRYPT_KEY_LEN, cwist_db_crypt_ctx_t::kek, OPENSSL_cleanse, and RAND_bytes.

Referenced by cwist_db_sync_serve().