1. Mobile Data Encryption
Enhanced Application Security with SQLCipher
Stephen Lombardo | Zetetic LLC | @sjlombardo

2. Unique Challenges

3. Pin Codes
Short
Low Entropy
Predictable
Source: DataGenetics, http://www.datagenetics.com/blog/september32012/
26.83% could be guessed by attempting 20 combinations

4. Face Recognition
Photo Bypass
Poor Performance
Inconvenient

5. Pattern Lock
Low Entropy
Smudge Attacks
See Also: Smudge Attacks on Smartphone Touch Screens ,
static.usenix.org/event/woot10/tech/full_papers/Aviv.pdfA

6. Passwords
Inconvenient
Dictionary Based
Frequently Reused
Source: 10,000 Top Passwords, Mark Burnett
http://xato.net/passwords/more-top-worst-passwords/

7. Device Encryption
Inconvenient
Uses Lock Key

8. Default Insecure
Original photo by Jean-Etienne Poirrier (jepoirrier) on Flickr
https://secure.flickr.com/photos/30077353@N05/7107568421

9. Threat Landscape
•Forensic Analysis
•Rooting / Jail breaking
•OS Issues
•Infrequent Updates
•Removable Storage
•Cloud Services
•Targeted Attacks
•Device Sharing

10. Responsibility
Compliance
Corporate
Liability
Government Threats
Respect

11. Defense in Depth
Make attacks
difficult with
multiple layers of
security

12. Principle of
Least Privilege
Access to device
should not allow
access to all apps
and data

13. Data Security
Minimize impact of
unauthorized
access, on and off
device

14. Strategies
1. Authentication
2. Encryption
3. Authenticity

15. SQLite Extension
Full Database
Encryption
Good Performance
Portable
Open Source Core
SQLite by D. Richard Hipp, Hwaci, SQLite.org

16. Features
• AES 256 CBC
• Random IVs
• Random salt
• Key Derivation
• MAC
• OpenSSL
• Fast startup
• No size limit

17. How it Works
Pager Codec
Key Derivation
Encryption
MAC
Database
Salt
Encrypted Data
Encrypted Data IV
MA
C
Encrypted Data
Encrypted Data IV
MA
C
Encrypted Data
Encrypted Data IV
MA
C
Page
1
Page
2
Page
3

18. Xamarin
Drop-in Replacement
iOS & Android
Component Store
Free for Enterprise
Trial Available

19. Installation

20. Mono
.Data
.Sqlcipher
using Mono.Data.Sqlcipher;
using(var conn = new SqliteConnection(ConnectionString))
{
conn.SetPassword(secret);
conn.Open();
using (var cmd = conn.CreateCommand())
{
cmd.CommandText = “CREATE TABLE Model(“ +
“Id INTEGER PRIMARY KEY AUTOINCREMENT, Content TEXT)";
cmd.ExecuteNonQuery();
cmd.CommandText =
"INSERT INTO Model (Content) VALUES (@content)";
var p = cmd.CreateParameter();
p.ParameterName = "@content";
p.Value = content;
cmd.Parameters.Add(p);
cmd.CommandText =
“SELECT * FROM Model Where Id = 0";
var reader = command.ExecuteReader ();
while (reader.Read()) {}
}
}© The Mono Project
Robert Simpson & SQLite.org

21. sqlite-net
using SQLite;
public class Model
{
[PrimaryKey,AutoIncrement]
public int Id { get; set; }
public string Content { get; set; }
}
…
using(var conn = new SQLiteConnection (file, secret))
{
conn.CreateTable<Model>();
conn.InsertOrReplace(
new Model() {Id = 0, Content = content});
var models = conn.Table<Model>().Where(
x => x.Id == 0);
models = conn.Query<Model> (
"SELECT * FROM Model WHERE Id = ?", 0);
}
© Frank Krueger, Krueger Systems
https://github.com/praeclarum/sqlite-net

22. Results

23. Performance

24. Advanced
• PRAGMA rekey
• PRAGMA cipher
• PRAGMA kdf_iter
• PRAGMA cipher_page_size
• PRAGMA cipher_use_hmac
• ATTACH
• sqlcipher_export()

25. FAQ
• Key Management
• Lost Credentials
• Existing Databases
• Compression
• Portability
• Export

26. Resources
http://components.xamarin.com/view/sqlcipher-for-android
http://github.com/zeteticllc/sqlcipherapp-xamarin
http://github.com/zeteticllc/sqlcipherspeed-xamarin
http://bis.doc.gov/encryption
http://sqlcipher.net
http://zetetic.net

27. Q & A

28. Thank you!
Stephen Lombardo | Zetetic LLC | @sjlombardo