android database encryption

Question

android uses sqlite database to store data, I need to encrypt the sqlite database, how can this be done? I understand that application data is private. However I need to explictly encrypt the sqlite database that my app is using.

Answer 1

Why not just encrypt that data going into the database and only store the key for some-odd amount of time before having the user re-enter it?

Check out http://www.androidsnippets.org/snippets/39/

Answer 2

What you want is not possible. First, there's no way to write it -- Ryan's answer is the closest you can get. Second, anybody who has the ability to access the database file will have the ability to decrypt it, by simply ripping the encryption key/algorithm out of your application.

Answer 3

http://sqlite-crypt.com/ may help you to create an encrypted database, though I've never used it on android seems to be possible with the source code.

Answer 4

If the database will be small, then you could gain a small amount of security by decrypting the whole file to a temp location (not on sd card), then re-encrypting when you've closed it. Problems: premature app death, ghost image on media.

A slightly better solution to encrypt the data fields. This causes a problem for WHERE and ORDER BY clauses. If the encrypted fields need to be indexed for equivalence searching, then you can store a cryptographic hash of the field and search for that. But that doesn't help with range searches or ordering.

If you want to get fancier, you could delve into the Android NDK and hack some crypto into C code for SQLite.

Considering all these problems and partial solutions, are you sure you really need a SQL database for the application? You might be better off with something like a file that contains an encrypted serialized object.