Closed
Description
SQLCipher supports bypassing the key derivation by passing the raw 256bit AES key directly. (as per example #2)
However, the Android Java API makes this feature impossible to use. Or rather, I haven't quite figured it out :)
The format in which you're supposed to supply the raw key is x'HEX BYTES'
, however the way in which the Java wrapper passes the key to SQLCipher (here) causes SQL to choke on the single quote characters in the x'foo'
construction:
execSQL("PRAGMA key = '" + password + "'");
I've tried various escaping strategies, but to no avail:
E/Database(21936): Failure 1 (unrecognized token: "5c18f7e2a5bbe1ca50abfcb41bc9dedc01355d4755e7d0ad6cedc942f9d89902") on
0x5dd05510 when preparing 'PRAGMA key = 'x\'5c18f7e2a5bbe1ca50abfcb41bc9dedc01355d4755e7d0ad6cedc942f9d89902\'''
Also, I think this might allow for SQL injection.
Metadata
Metadata
Assignees
Labels
No labels