Portable database for storing secrets

Question

I'm developing a application that needs storing secrets in a database.

I need a portable database (like Firebird, Sqlite, etc) where the data will be stored encrypted or password protected or both...

Let's take as example that I want create a password manager. I will need store that passwords in a database. I'm accustomed to use Embed Firebird, but not for secret data.

Another solution is to use the database naturally and encrypt the database file when I'm not connected to file, but I'm not sure of the security or performance implications.

What the best method that you recommend?

Answer 1

Honestly? Use TrueCrypt or KeePass.

Answer 2

There is a project called sqlite-crypt. Which should be your best bet. sqlite db with all data on disk encrypted.

Answer 3

I agree with CJM, but if you're dead-set on writing your own, you should encrypt the stream at write-time and decrypt it at read-time. Any published algorithm that's somewhat strong should keep things secure.

Answer 4

REALbasic's built-in support for working with encrypted SQLite databases has worked well for me on a couple of projects.

Answer 5

You could also have a look at SQL Server Compact edition, which only requires a DLL and will store the data in a single file, just like SQLite or Access, Firebird, etc.

It also has encryption capabilities built-in.

Some references:

• Security and Encryption for SQL Server Compact
• Tutorials on using SQL Server Compact Edition (second and third sections down the page).

Password encryption

See my answer to your other question os SO.

Answer 6

I highly recommend you check out SQLCipher (full-disclosure, I'm one of the developers!) It's a free and open-source implementation of transparent, page-level encryption for SQLite. The implementation is fairly robust, it's under active development, and it's very easy to use (relatively speaking).

Answer 7

Can i use SQLCipher on Symbian platform?? If yes, then please guide me!! I could not find any relevant information on internet.