-
Notifications
You must be signed in to change notification settings - Fork 568
unable to provide raw key data to sqlcipher #94
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Comments
I use SQLiteDatabaseHook for that:
|
Interesting. I suppose the subsequent call to IMHO, this is still a workaround though. And I'm still not convinced there isn't a SQL injection here :P |
Alright, I've found an alternative workaround that doesn't make use of hooks. SQL allows you to escape single quotes with another quote character. So in Java you can form your string like so: String pass = "x''4f07ef26f41aa3384a861992334fc9c664de810d6ddaaeeb6d59420e0b51cf39''" I've verified this does indeed skip the key derivation by enabling CODEC_DEBUG and running a unit test:
|
I'll close this and open another ticket for the SQL injection. |
If the database is bundled within the apk file, how can I verify if key derivation? Basically I want to verify of the raw key is used from hex. |
Hello git-jeeva, Openning a connection via a raw hex key requires that you provide the key in the correct format. Please see the documentation here covering the details of the format. |
Hi, The previous post stated that "....verified this does indeed skip the key derivation by enabling CODEC_DEBUG..." How is this configuration done to verify the key generation steps? Thanks, Jeeva |
Hello @git-jeeva,
|
SQLCipher supports bypassing the key derivation by passing the raw 256bit AES key directly. (as per example #2)
However, the Android Java API makes this feature impossible to use. Or rather, I haven't quite figured it out :)
The format in which you're supposed to supply the raw key is
x'HEX BYTES'
, however the way in which the Java wrapper passes the key to SQLCipher (here) causes SQL to choke on the single quote characters in thex'foo'
construction:I've tried various escaping strategies, but to no avail:
Also, I think this might allow for SQL injection.
The text was updated successfully, but these errors were encountered: