go-sqlite3 Adiantum VFS
Security and privacy
database encryption at rest
SHOW HN2024
How HN took it
4 positive, 7 neutral or asking, 1 mixed, 6 critical, out of 18 comments about the project. Thread score -0.03.
Privacy: 0 for, 4 againstIdea: 2 for, 2 againstPerformance: 1 for, 0 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Thanks for sharing this
From 1 comment
Thanks for sharing this.
Hakeed1990 on HN
Objections
Deterministic encryption without nonces leaks whether blocks changed or reverted
From 1 comment
A couple of thoughts: First, great job on the readme! One way you could improve it is by expanding on the "Caution" section. What's written is the beginnings of a threat model,…
580515975 on HN
Static public Argon2 salt allows precomputation of keys
From 1 comment
For your KDF, how did you select the parameters for Argon2id? How often is the KDF invoked / what are your requirements for speed in KDF'ing? Nit, but your "pepper" is…
d-z-m on HN
Threat model in README is incomplete and needs explicit attacks
From 1 comment
A couple of thoughts: First, great job on the readme! One way you could improve it is by expanding on the "Caution" section. What's written is the beginnings of a threat model,…
580515975 on HN
Pepper name is misleading since it is not secret
From 1 comment
For your KDF, how did you select the parameters for Argon2id? How often is the KDF invoked / what are your requirements for speed in KDF'ing? Nit, but your "pepper" is…
d-z-m on HN
Requests
Clarify the threat model in the documentation
From 1 comment
A couple of thoughts: First, great job on the readme! One way you could improve it is by expanding on the "Caution" section. What's written is the beginnings of a threat model,…
580515975 on HN
Port to C or Rust as a loadable extension
From 1 comment
Add Append variants to avoid allocations
From 1 comment
Hey, it's my Adiantum package! How's the performance? Revisiting the API now, I see that Encrypt and Decrypt return newly-allocated slices, which is unfortunate. Should I add…
nemo1618 on HN
Questions
How does it compare with SQLCipher performance and design?
From 1 comment
How do you feel yours compares with (say) SQLCipher, which is a very popular C based one, and keeps fairly close to the upstream SQLite releases? *…
justinclift on HN
How were Argon2id parameters chosen?
From 1 comment
For your KDF, how did you select the parameters for Argon2id? How often is the KDF invoked / what are your requirements for speed in KDF'ing? Nit, but your "pepper" is…
d-z-m on HN
Is padding to block size safe and what are atomicity guarantees?
From 1 comment
A couple of thoughts: First, great job on the readme! One way you could improve it is by expanding on the "Caution" section. What's written is the beginnings of a threat model,…
580515975 on HN
Alternatives named
SQLCipher
From 1 comment
How do you feel yours compares with (say) SQLCipher, which is a very popular C based one, and keeps fairly close to the upstream SQLite releases? *…
justinclift on HN
SQLite Encryption Extension
From 1 comment
SQLite has a paid version. One of the paid features is encryption. They’re not going to make it easy.
pyuser583 on HN
SQLite3 Multiple Ciphers
From 1 comment
FTA: "One project in particular was very suitable for us, SQLite Multiple Ciphers. Since it is licensed under MIT, we have just moved the code into libSQL." See, this is what I…
ncruces on HN
libSQL
From 1 comment
Have you considered targeting libSQL for this instead? https://github.com/tursodatabase/libsql SQLite is a great product and I use it a lot, but it does not have a great history…
bityard on HN
ZFS encryption
From 1 comment
The threat model has to exclude: - attacks on a running app that has the keys loaded, naturally The threat model has to include at least: - passive attacks against the DB itself,…
cryptonector on HN