Roast my SQLite encryption at-rest

Hacker News

SQLite encryption at-rest is a hot requested feature of both the “default” CGo driver [1] and the transpiled alternative driver [2]. So, this is a feature I wanted to bring to my own Wasm based Go driver/bindings [3]. Open-source SQLite encryption extensions have had a troubled last few years. For whatever reason, in 2020 the (undocumented) feature that made it easy to offer page-level encryption was removed [4]. Some solutions are stuck with SQLite 3.31.1, but Ulrich Telle stepped up with a VFS approach [5]. Still, their solution seemed harder than something I'd want to maintain, as it requires understanding the structure of what's being written to disk at the VFS layer. So, I looked at full disk encryption for something with less of an impedance mismatch. Specifically, I'm using the Adiantum tweakable and length-preserving encryption (with 4K blocks, matching the default SQLite page size), and encrypting whole files (rather than page content). I'm not a cryptographer, so I'd really appreciate some roasting before release. There is nothing very Go specific about this (apart from the implementation) so if there are no obvious flaws, it may make sense to port it to C/Rust/etc and make it a loadable extension. [1] https://github.com/mattn/go-sqlite3/pull/1109 [2] https://gitlab.com/cznic/sqlite/-/issues/105 [3] https://github.com/ncruces/go-sqlite3/issues/55 [4] https://github.com/sqlite/sqlite/commit/b48c0d59 [5] https://github.com/utelle/SQLite3MultipleCiphers

Visit product View on Hacker NewsApr 30, 2024

Share card

Actual performance

99points

50comments

Made the leaderboard

Launch Intel predictions

Analyze your own launch →

Hacker NewsStrong engagement from HN community · Strong signals: io · Missing: https docs, excited, just released

56%56% predicted probability of success on Hacker News, based on ML models trained on real launch data.

nativeThis product was originally launched on this platform.

Product HuntOn track for Day 1 leaderboard · Strong signals: using, open · Missing: mac, agents, macos

53%53% predicted probability of success on Product Hunt, based on ML models trained on real launch data.

Indie HackersIH features products with proven revenue · Missing: supports, reddit linkedin, podcasting

45%45% predicted probability of success on Indie Hackers, based on ML models trained on real launch data.

TrustMRRLess likely to generate early MRR · Missing: mobile apps, ios, personal

45%45% predicted probability of success on TrustMRR, based on ML models trained on real launch data.

AppSumoMay struggle as an AppSumo deal · Missing: plus, platform, intuitive

40%40% predicted probability of success on AppSumo, based on ML models trained on real launch data.

Acquire.comPre-revenue stage for this audience · Missing: arr, mrr, revenue

12%12% predicted probability of success on Acquire.com, based on ML models trained on real launch data.

BetaListMay not resonate with beta-testers · Strong signals: crypto · Missing: web3, chat, cryptocurrency

0%0% predicted probability of success on BetaList, based on ML models trained on real launch data.

Correct prediction on native model

Similar products

awspm – rvm for aws credentials and encryption at rest48%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

awspm – rvm for aws credentials and encryption at rest

Hacker News3

Notesnook v3 is here with note linking, at rest encryption and more44%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Notesnook v3 is here with note linking, at rest encryption and more

Hacker News3

Zip It – Encryption Anywhere45%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Zip It – Encryption Anywhere

Hacker News10

Additive Homomorphic Encryption on Ethereum50%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Additive Homomorphic Encryption on Ethereum

Hacker News1

RSME:A Reactive Stability Mutation Encryption47%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

RSME:A Reactive Stability Mutation Encryption

Hacker News1

Serket – A gem for distributed encryption50%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Serket – A gem for distributed encryption

Hacker News1

TextPert20%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Autocorrect on steroids, from polish to nuclear roast

Indie Hackerscommitment-full-time

Krptn: User Auth and Encryption of data at rest73%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Krptn: User Auth and Encryption of data at rest

Hacker News2

Mobx-rest47%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Mobx-rest

Hacker News7

openpoll, a democracy for the rest of us46%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

openpoll, a democracy for the rest of us

Hacker News1

Browse all products Analyze your launch