Encryption and Key Management
Encryption is two separate problems: protect the bytes and protect the keys. Most failures happen in key management.
Start With A Threat Model
| Threat | Example | Useful controls |
|---|---|---|
| casual device access | friend opens unlocked laptop | app lock, biometric/PIN, OS account lock |
| stolen device | phone or laptop is lost | OS disk encryption, app lock, encrypted backups |
| backup reader | cloud drive or exported file leaks | backup encryption with separate key/password |
| rooted/malware device | attacker controls OS | limited protection; focus on minimizing stored secrets |
| cloud compromise | server backup leaks | local-only or end-to-end encrypted backup/sync |
Storage Rules
- Store keys in Android Keystore, iOS Keychain, macOS Keychain, Windows Credential Manager, libsecret, Tauri Stronghold, or equivalent platform vaults.
- Do not store encryption keys next to plaintext data.
- Do not hardcode secrets in source code.
- Design key loss behavior before shipping encryption.
- Encrypt backups separately from the live database when users move files through cloud storage.
Full-DB vs Field Encryption
| Approach | Pros | Cons |
|---|---|---|
| Full-database encryption | broad coverage, simple mental model | library integration and migration constraints; exact SQLCipher docs still need verification here |
| Field encryption | selective protection, works with existing DB | query/index limits, easy to miss fields |
| Encrypted backup only | simple recovery protection | live local DB still relies on OS/app lock |
| OS disk encryption only | low implementation cost | weak if app/account is unlocked |
Recovery Design
Every encrypted app needs answers to these questions:
- Can the user restore on a new device?
- Is the restore key a password, platform vault item, recovery code, or account key?
- What happens when the password is forgotten?
- Can support recover the data? Should they be able to?
- Are backups encrypted before leaving the device?
Warning: SQLCipher/full-database encryption needs fresh official verification before this topic prescribes exact Android or desktop integration steps.