com.bloomberg:selekt-android

Selekt

Selekt is a Kotlin and familiar Android SQLite database library that by default wraps the community edition of SQLCipher, an SQLite extension that provides 256-bit AES encryption of database files. Selekt realises the maximum concurrency offered by SQLite3: When enabled for WAL-journal mode, "readers do not block writers and a writer does not block readers. Reading and writing can proceed concurrently."

The Selekt project is used to securely and efficiently store data in the Bloomberg Professional application for Android.

Menu

• Rationale
• Quick start
• Contributions
• Licenses
• Code of Conduct
• Security Vulnerability Reporting

Rationale

The two most popular publicly available alternatives to Selekt are the Android SDK's own SQLite database, and SQLCipher for Android. The Android SDK's SQLite database does not encrypt databases, instead relying on the OS's user security model to restrict access. SQLCipher for Android uses the SQLCipher library to encrypt databases, but because the derivation of every key is by design expensive it can't also be allowed to make full use of the concurrency offered by SQLite3: Each database must have only one connection, connections cannot be ephemeral and must persist even if idling.

Selekt sits somewhere between the two: Selekt also uses SQLCipher to encrypt databases with AES-256, but uses SQLCipher in a mode that moves the responsibility for deriving keys to the caller. This sacrifices some of the security guarantee offered by the default operating mode of SQLCipher, in return for allowing greater concurrency and efficient resource use by pooling connections while still retaining pretty good security.

Quick Start

Please refer to the main documentation.

Contributions

We :heart: contributions.

Have you had a good experience with this project? Why not share some love and contribute code, or just let us know about any issues you had with it?

We welcome issue reports here; be sure to choose the proper issue template for your issue, so that we can be sure you're providing the necessary information.

Before sending a Pull Request, please make sure you read our Contribution Guidelines.

Licenses

Please read the LICENSE, OPENSSL_LICENSE and SQLCIPHER_LICENSE files.

Code of Conduct

This project has adopted a Code of Conduct. If you have any concerns about the Code, or behavior which you have experienced in the project, please contact us at [e-mail].

Security Vulnerability Reporting

If you believe you have identified a security vulnerability in this project, please send an email to the project team at [e-mail], detailing the suspected issue and any methods you've found to reproduce it.

Please do NOT open an issue in the GitHub repository, as we'd prefer to keep vulnerability reports private until we've had an opportunity to review and address them.