go/sqlite3
1
0
Fork 0
mirror of https://github.com/ncruces/go-sqlite3.git synced 2026-01-11 21:49:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

Wrap FilePersistentWAL.

Browse Source
This commit is contained in:
Nuno Cruces
2024-10-18 11:59:36 +01:00
parent d6aebe67cc
commit 89f750a6e9
5 changed files with 49 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
vfs/adiantum/README.md
View File

@@ -39,10 +39,12 @@ This means that an adversary who can get ahold of multiple snapshots
(e.g. backups) of a database file can learn precisely:
which blocks changed, which ones didn't, which got reverted.
This is slightly weaker than other forms of SQLite encryption
that include *some* nondeterminism; with limited nondeterminism,
an adversary can't distinguish between
blocks that actually changed, and blocks that got reverted.
This is weaker than other forms of SQLite encryption
that include *some* nondeterminism.
With limited nondeterminism, an adversary can't distinguish between
pages that actually changed, and pages that got reverted;
a `VACUUM` can fully rebuild the database file,
preventing this differential analysis.
> [!CAUTION]
> This package does not claim protect databases against tampering or forgery.
@@ -52,11 +54,11 @@ if you're keeping `"adiantum"` encrypted backups of your database,
and want to protect against forgery, you should sign your backups,
and verify signatures before restoring them.
This is slightly weaker than other forms of SQLite encryption
This is weaker than other forms of SQLite encryption
that include page-level [MACs](https://en.wikipedia.org/wiki/Message_authentication_code).
Page-level MACs can protect against forging individual pages,
but can't prevent them from being reverted to former versions of themselves.
> [!TIP]
> The [`"xts"`](../xts/README.md) package also offers encryption at rest.
> AES-XTS uses _only_ NIST and FIPS-140 approved cryptographic primitives.
> The [`"xts"`](../xts/README.md) VFS also offers encryption at rest.
> AES-XTS uses _only_ NIST and FIPS 140 approved cryptographic primitives.