Encrypt SQLite database in C#

Question

What is the best approach to encrypting a SQLite database file in .Net/C#? I'm using sqlite-dotnet2 wrapper.

There are tools like SQLite Encryption Extension and SQLite Crypt, but both are non-free, while my project is under GPL.

The naive approach I thought of using was to let SQLite handle a temporary file, then to encrypt it on program exit, and overwrite (zero-out) the original. The obvious drawback is that if program crashes (and while it is running), the plain text DB is accessible.

Is there a better way to approach this? Can I pass an encrypted stream to the wrapper (instead of using SQLiteConnection.CreateFile) ?

[edit] Maybe I am overthinking this. Is is sufficient to use Password option in the connection string? Would the file be encrypted properly in that case (or is it some weaker protection)?

Answer 1

I recommend using the System.Data.Sqlite wrapper, which includes encryption. It works great, it's easy to use, and it's a complete ADO.Net implementation. You can get the wrapper from http://sqlite.phxsoftware.com/, and the developer describes how to use the encryption on his forum at: http://sqlite.phxsoftware.com/forums/t/130.aspx. Hint - you just set the password property. He also describes how he does the encryption using the Microsoft Crypto API elsewhere in the forum.

Answer 2

This method is not specific to SQLite per se but is a general file encryption suggestion.

(1) Use TrueCrypt (free/opensource) to create an encrypted wrapper file. This file should be larger than the expected max size of your database.

(2) When you mount this file, it will appear as a logical hard drive in you machine.

(3) Keep your sqlite databases in this logical hard drive.

Mount the drive before you are accessing your database via either odbc/jdbc or any other method.

The advantage of doing this is: Even if someone has access to your database password, they can't access the file since it is encrypted. They will need your Truecrypt password to open it.

Answer 3

I would try http://code.google.com/p/csharp-sqlite/, it's rewrite of sqlite 3.6.16 in C#, under MIT License. I supose it will be easy to tweak it.

Answer 4

Take a look at:

http://zetetic.net/software/sqlcipher

It is open source.

You can chek also the code for the wxsqlite3.