On 2017-06-09 00:13, Wout Mertens wrote: > Isn't it all just obfuscation? Any root user can read your key, if not from > disk then from memory. Any normal user can't read your key, nor from disk, > nor from memory; and they can't read your db file either. > > So if the adversary is someone with access to your disk image, disk > encryption trumps db encryption (unless the disk encryption is vulnerable > to known-plaintext attacks, but I guess they probably apply to sqlite too). > > If the adversary is another process on the same host, encrypting the db > just adds obfuscation, which is security against lazy hackers.
When the discussion about DRM and Trusted Computing was more active, this was widely discussed. Cory Doctorow gave a talk about DRM at Microsoft that illustrates this misuse of cryptography [1]. Mark Stefik described a scary vision of DRM over two decades ago [2]. Richard Stallman has said and written a lot about DRM as well. So perhaps we should not start another debate on this mailing list and read what has already been written and said about it at great length. My personal conclusion from the discussion about DRM and Trusted Computing is that DRM will never work unless we don't own our computers but someone else who controls a cryptographic chip in them does. Unfortunately, this is reality for devices with iOS and other similar products. SEE only protects the database if an attacker only has access the storage medium of the database but not the encryption key. Not more and not less. You can of course argue about how difficult it is to obtain the encryption key but has nothing to do with SEE. It depends only concrete use cases, scenarios and threat models but not SEE. So can we have the discussion about this on another mailing list? [1] http://craphound.com/msftdrm.txt [2] http://www2.parc.com/istl/groups/uir/publications/items/UIR-1996-10-Stefik-InternetCommerce-IgnitingDreams.pdf _______________________________________________ sqlite-users mailing list sqlite-users@mailinglists.sqlite.org http://mailinglists.sqlite.org/cgi-bin/mailman/listinfo/sqlite-users
