SQLCipher 4.4.1 Release

2020-11-06 07:00:00 -0500

We are pleased to announce that SQLCipher 4.4.1 is now available. It includes the following important changes:

SQLCipher Core

  • Updates baseline to upstream SQLite 3.33.0
  • Fixes double-free bug in cipher_default_plaintext_header_size
  • Changes SQLCipher tests to use suite runner
  • Improvement to cipher_integrity_check tests to minimize false negatives
  • Deprecates PRAGMA cipher_store_pass

SQLCipher Commercial and Enterprise

A new benchmarking and performance test extension provides a way to perform comparative analysis between different encryption settings, application releases, SQLCipher versions, database designs, and queries. This new feature will prove useful to developers interested in optimizing their applications when using SQLCipher.

We are pleased to add official Linux native and .NET packages for the latest version of SQLCipher. These new packages contain full support for SQLCipher Commercial and Enterprise edition extensions like Value Level Encryption, Encrypted Virtual Tables, Performance Counters, and the new benchmarking feature.

SQLCipher’s cross-platform .NET based packages for Windows, macOS, Xamarin.iOS, Xamarin.Android, and Linux have now been updated to support the latest Microsoft.EntityFrameworkCore.Sqlite.Core 3 and Microsoft.Data.Sqlite.Core 3. The new minimum supported framework version for these SQLCipher packages is .NET Standard 2.x. Note that SQLCipher is now using SQLitePCLRaw 2.x. On UWP platforms, applications may need to call sqlite3_win32_set_directory() explicitly using this version.

The SQLCipher for ADO.NET compatibility package for System.Data.Sqlite on Windows now requires .NET Framework 4.6 or higher.

SQLCipher for Windows Enterprise packages using a FIPS 140-2 validated cryptographic module have been updated to depend on Visual C++ 2015 redistributable runtime files. Customers using Zetetic’s special FIPS packages and upgrading to the new version must ensure installation of the proper runtime components alongside SQLCipher.

Availability

Commercial and Enterprise - On-demand access to new releases of SQLCipher packages are available to all licensees with an active support subscription from the Customer Downloads fulfillment site. Licensees will also receive a separate email notification regarding the update and can contact us at any time for private support directly from the SQLCipher development team.

Community Edition - SQLCipher 4.4.1 in source format is directly available on GitHub. The Community Edition of SQLCipher for Android is available via AAR packaging. The Community Edition of SQLCipher for iOS can be compiled from source or using CocoaPods.

Codebook: Why You Should Backup Your Sync Key

2020-09-15 04:00:00 -0400

Since the introduction of the Sync Key to Codebook in version 4, we have heard from customers who are concerned about backing up the Sync Key and potentially having to manage a Sync Key separate from their Master Password, lest they lose access to all the critical passwords and other information they have stored in Codebook.

We can say with confidence that is definitely not the case, and we’d like to clarify how the Sync Key fits into Codebook, and when and why to keep a backup of it outside of Codebook. In addition, if you lose your Sync Key Backup, it won’t make your data inaccessible, because each copy of Codebook you sync with has a copy of the Sync Key.

First, it’s important to note that we haven’t replaced your Master Password with the Sync Key. Your Codebook data is still stored in a single file, encrypted with your Master Password. You can even take a backup of the single database file, and then restore it to a new computer, without any need for the Sync Key.

So where does the Sync Key come into play? It’s used to encrypt all your Sync data, the changes that are passed back and forth. Whether you are syncing with WiFi, a local folder, or a cloud service (i.e. Dropbox or Google Drive), that data is encrypted with your Sync Key instead of the Master Password.

The Sync Key is stored by Codebook in your encrypted database on your device. And because it’s required to add the Sync Key to every new device you setup (so that all your devices can encrypt and decrypt the sync changes), there’s a copy of the Sync Key in the encrypted Codebook database on every device you sync with.

If you were to delete Codebook from one of these devices, or you lost and replaced one of these devices you sync with, all you need to set up the new device is to set the master password, add the Sync Key from one of your other devices, and perform a Restore.

So why do we ask you to Backup the Sync Key?

Say you use Codebook on an Android phone and a Windows laptop, and you’ve got a Google Drive account that you sync with. Or, maybe you use Codebook exclusively on an iPhone and an iPad, or maybe just one iPhone and sync with Google Drive. This means there is a copy of your encrypted sync data up in Google Drive that you could restore from if you were to lose access to one of your devices. Now let’s say you lose access to all your devices at the same time, perhaps in a house fire or burglary. So, you buy a new device, download Codebook, and you want to restore your passwords and other data. The data is still available in Google Drive, but it’s encrypted with your Sync Key, which you no longer have access to.

That’s where the Sync Key Backup comes in: the catastrophic scenario where you lose every copy of Codebook, and thus every copy of your Sync Key, and the only copy of your data is encrypted in your cloud service, for instance, encrypted with your Sync Key. The Sync Key Backup allows you to restore your data from an encrypted remote to a new device after access to all your other devices have been lost.

If the prompts in Codebook to Backup Your Sync Key come on a little strong, that’s a result of our trying to do some due diligence to help ensure this unlikely and catastrophic scenario is not possible. We tried to make the Sync Key Backup feature flexible by offering more than one option for creating a hard copy backup (printing an encrypted QR Code, or writing down a Word List), and to allow those who would prefer not to maintain a physical backup to ignore the feature and go about their business.

Where should you store the Sync Key Backup?

If you do choose to backup the Sync Key, you’ll want to store it in a secure place, as a determined attacker could use it to decrypt any sync data you might have on a remote service, since that data is encrypted with the Sync Key. Where to store the Sync Key Backup is a personal decision that will have a different answer for everybody depending on their needs and circumstances, but it may help to know that you should only need the Sync Key Backup in rare and catastrophic circumstances. Without endorsing any option in particular, here are some ideas:

  • A secure hiding place
  • A fire-proof safe
  • A bank deposit box
  • With a trusted family friend
  • A personal attorney

As always, if you have any questions about the Sync Key or any other feedback on Codebook, please get in touch.

Codebook 4.1.0 Released - Sync Operations and Desktop WiFi

2020-05-21 02:00:00 -0400

Yesterday we released an important update to Codebook, version 4.1.0, on Android, iOS, macOS, and Windows. The new version supports a new Sync Operation feature, and provides a ton of excellent adjustments, improvements, and bug fixes. We’ve got a run-down of the new Operations and a full listing of all changes to the apps available on the discussion forum.

Note: Customers on Codebook 4.0 who use Desktop WiFi sync must upgrade!

If you attempt to sync 4.0 with 4.1 over Desktop WiFi you will run into an error. Sorry about that, we had to update the WiFi protocol to support the new Operation feature.

SQLCipher 4.4.0 Release

2020-05-12 08:00:00 -0400

We are pleased to announce that SQLCipher 4.4.0 is now available. It includes the following important changes:

SQLCipher Core

  • Updates baseline to upstream SQLite 3.31.0
  • Adjusts shell to report SQLCipher version alongside SQLite version
  • Fixes various build warnings under several compilers
  • Removes unused id and status functions from provider interface

SQLCipher for Android

Support/Room API queries have been improved so that parameters are bound using the appropriate type to avoid conversion issues.

SQLCipher Commercial and Enterprise

The new sqlcipher_vle_cipher Value Level Encryption function provides a low-level interface to invoke AES-256-CBC encryption and decryption operations without type encoding, PKCS#7 padding, or HMAC authentication.

Availability

Commercial and Enterprise - On-demand access to new releases of SQLCipher packages are available to all licensees with an active support subscription from the Customer Downloads fulfillment site. Licensees will also receive a separate email notification regarding the update and can contact us at any time for private support directly from the SQLCipher development team.

Community Edition - SQLCipher 4.4.0 in source format is directly available on GitHub. The Community Edition of SQLCipher for Android (4.4.0) is available via AAR packaging. The Community Edition of SQLCipher for iOS can be compiled from source or using CocoaPods.

SQLCipher 4.3.0 Release

2019-12-20 07:00:00 -0500

SQLCipher 4.3.0, which includes the following important changes, is now available:

SQLCipher Core

  • Updates baseline to upstream SQLite 3.30.1
  • PRAGMA key now returns text result value “ok” after execution (consistent with upstream)
  • Adjusts backup API so that encrypted-to-encrypted backups are permitted
  • Adds a NSS crypto provider implementation
  • Improves OpenSSL provider compatibility with BoringSSL
  • Corrects output of PRAGMA cipher_integrity_check on big endian platforms
  • General cryptographic provider interface cleanup
  • Improvements to mutex allocation and management
  • Separates memory related traces to reduce verbosity of logging
  • Resolves miscellaneous build warnings
  • Forces error state at database pager level if SQLCipher initialization fails

SQLCipher for Android

SQLCipher for Android now includes support for utilizing Android Room. Room is a Google supported ORM library that provides an abstraction layer over direct database access. Integration instructions for the library can be found here. Thank you to Mark Murphy for providing the necessary contributions from the CWAC-SafeRoom project for this addition.

SQLCipher Commercial and Enterprise

Starting with the release of SQLCipher 4.3.0, Commercial and Enterprise packages now include exclusive features that are not available in Community Edition distributions:

The SQLCipher Value Level Encryption (VLE) and Encrypted Virtual Table features extend SQLCipher to allow partial encryption of data. Instead of applying encryption to the entire database, they selectively expose convenient SQL Functions and a Virtual Table module that operate transparently to encrypt and decrypt data. These features still use SQLCipher’s well-trusted underlying cryptographic providers. While not intended as a substitute for full-database encryption, these features can serve the needs of several classes of applications, for instance when:

  1. Only a subset of database information needs to be secured
  2. Multiple overlapping layers of security with separate keys are required (e.g. multiple keys for different data sets)
  3. Full-database encryption is not appropriate due to other considerations (e.g. performance, compression, etc.)

The new 4.3.0 features also include a special extension that exposes internal performance counters for SQLCipher’s encryption module. These additional statistics provide deeper insight to applications which can be useful for performance optimization and tuning purposes.

In additon to these new features, the official iOS native package for Xcode now include framework support for Mac Catalyst, which allows iPad applications to be built for and run on macOS computers.

Availability

Commercial Edition - On-demand access to new releases of SQLCipher Commercial Edition are available to licensees with an active CipherCare subscriber subscription, along with private, prioritized support directly from Zetetic. CipherCare subscribers will receive a separate email notification regarding the update and can contact us to request the latest SQLCipher distribution and applicable software license codes.

SQLCipher Enterprise Program - Enterprise Program Subscription customers will receive a separate email notification about the release, and the latest SQLCipher packages and license codes will be provided directly via your organization’s private online software delivery share.

Community Edition - SQLCipher 4.3.0 in source format is directly available on GitHub. The Community Edition of SQLCipher for Android (4.3.0) is available via AAR packaging. The Community Edition of SQLCipher for iOS can be compiled from source or using CocoaPods.