We are pleased to announce the immediate availability of SQLCipher 5.0.0-beta.1. This beta includes two significant changes from SQLCipher 5.0.0-beta and a number of bug fixes identified during testing.
WARNING: This should only be used for beta testing at this time, not in production. It includes major functional, API, and behavioral changes that are NOT COMPATIBLE with SQLCipher 4 and earlier by default.
To recap, the beta includes the following major changes:
See the SQLCipher 5.0.0-beta announcement for additional details.
SQLCipher 5.0.0-beta.1 goes back to using the codec architecture for encrypting database pages, journal records, and WAL frames. Following the initial beta round, we determined that the VFS approach’s edge cases, compatibility, and performance characteristics warrant additional consideration before widespread use. The codec approach is very mature and well understood, so sticking with it is the more conservative decision for SQLCipher 5. It has also been reworked to provide more reliable error handling and reporting, bringing it closer to par with the VFS design. This does not mean that the VFS-based approach is abandoned. It will continue to be worked on and evaluated internally for possible future release.
The default iteration count for PBKDF2-HMAC-SHA512 has been reduced back down to 256K. That value already exceeds the OWASP recommendation of 220K iterations, and the widespread availability of keystore and keychain APIs means more systems are using high-entropy key material. It did not make sense to impose a default performance penalty by increasing the KDF iterations at this time. High security applications still have an option for increasing KDF iterations when needed for a specific threat model or key material type.
SQLCipher 5.0.0-beta.1 also incorporates several changes found during testing by internal and external beta testers, including:
cipher_hmac_fast_kdf could write the page HMAC past the reserved areaPRAGMA cipher_selftest for verifying internal implementationsThe default v5 database settings are not backwards-compatible with SQLCipher 4 databases. Application code changes are required to take advantage of the new defaults. To open or migrate existing databases, the following options are available:
PRAGMA cipher_migrate.PRAGMA cipher_compatibility to adjust settings back to their previous values. For example, to open a SQLCipher 4 database using 5.0.0-beta.1:
PRAGMA key = 'YourKeyGoesHere';
PRAGMA cipher_compatibility = 4;
PRAGMA cipher_default_compatibility. All attached databases inherit this setting. For example, to set the process default before opening any encrypted databases:
PRAGMA cipher_default_compatibility = 4;
PRAGMA key = 'YourKeyGoesHere';
PRAGMA rekey support.SQLCipher 5.0.0-beta.1 is available for download starting today, separate from the existing SQLCipher 4 releases, so you can begin testing in parallel with your current deployment.
Commercial and Enterprise - Your organization will find the new beta packages on the “Prerelease” tab of the Customer Downloads fulfillment site. Don’t forget to update the license code in your application(s) when you upgrade!
Community Edition - The source for SQLCipher 5.0.0-beta.1 is available at the main repository beta tag on GitHub. SQLCipher for Apple is available from the SQLCipher.swift beta tag. SQLCipher for Android is available as source or a downloadable AAR package from the SQLCipher Android beta tag.
We recommend testing this beta thoroughly to prepare applications and identify potential upgrade issues. For the time being, please direct feedback and questions to support@zetetic.net so all beta issues are reported in one place. We appreciate your help validating SQLCipher 5.0.0-beta.1 in advance of an official release at a later date!