CSPP Phase 2: Database encryption & migration

[praveenperera]

Summary

• Encrypt all redb databases (main + per-wallet) at rest using EncryptedBackend (XChaCha20-Poly1305 block-level AEAD)
• Encrypt all BDK SQLite databases using SQLCipher
• Migrate existing plaintext databases on first launch with crash recovery
• Backward compatible: fresh installs create encrypted, upgrades migrate automatically

Commits

1. Create encrypted backend for redb — EncryptedBackend implementing redb::StorageBackend with per-block encryption, block-index AAD, and COVE magic header
2. Wire EncryptedBackend into database init — Fix compile error, add open_or_create_database() helper with backward compatibility for plaintext legacy DBs
3. Add redb migration (plaintext → encrypted) — Generic copy_table helper, main DB migration (7 tables), per-wallet migration (5 tables), crash recovery via atomic rename
4. Encrypt BDK SQLite with SQLCipher — Add rusqlite with bundled-sqlcipher-vendored-openssl, apply PRAGMA key in BdkStore::try_new()
5. Add BDK SQLite migration (plaintext → SQLCipher) — sqlcipher_export based migration, crash recovery, wired into app startup

Startup sequence (after all changes)

App::new():
  1. logging::init()
  2. Derive encryption key (Cspp → MasterKey → sensitive_data_key)
  3. set_encryption_key(key)
  4. recover_interrupted_migrations()        // redb crash recovery
  5. migrate_main_database_if_needed()       // redb plaintext → encrypted
  6. migrate_wallet_databases_if_needed()    // redb per-wallet
  7. recover_interrupted_bdk_migrations()    // BDK crash recovery
  8. migrate_bdk_databases_if_needed()       // BDK plaintext → SQLCipher
  9. ... rest of App::new() ...

CSPP Phase 2 progress

Closes #589, closes #591, closes #592, closes #590, closes #559, closes #560

Remaining phase 2 issue: #561 (cloud backup config flags to GlobalConfig)

Test plan

• cargo test -p cove — 111 tests pass (encrypted backend, migration, BDK migration, crash recovery)
• just fmt && just clippy — clean
• Fresh install: databases created encrypted from the start
• Upgrade path: existing plaintext databases migrated on first launch
• Crash during migration: recovered on next launch

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch cspp-phase-2-encryption

Tip

Issue Planner is now in beta. Read the docs and try it out! Share your feedback on Discord.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}