# SQLCipher Future Features

**URL:** <https://discuss.zetetic.net/t/sqlcipher-future-features/236>\
**Category:** SQLCipher\
**Created:** [October 31, 2014, 4:16pm UTC](https://discuss.zetetic.net/t/sqlcipher-future-features/236 "2014-10-31T16:16:08Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![developernotes](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.zetetic.net/developernotes/32/1309_2.png) [@developernotes](https://discuss.zetetic.net/u/developernotes)\
**Post date:** [October 31, 2014, 4:16pm UTC](https://discuss.zetetic.net/t/sqlcipher-future-features/236/1 "2014-10-31T16:16:08Z")

</div>

What would you like to see in future SQLCipher releases?

---

<div class="post-metadata">

**Author:** ![commonsguy](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.zetetic.net/commonsguy/32/75_2.png) [@commonsguy](https://discuss.zetetic.net/u/commonsguy)\
**Post date:** [October 31, 2014, 7:23pm UTC](https://discuss.zetetic.net/t/sqlcipher-future-features/236/2 "2014-10-31T19:23:27Z")

</div>

I’m not sure if this is a “feature” or just a blog post, but a recipe for using SQLCipher for Android with [the Android `KeyStore` provider](https://developer.android.com/training/articles/keystore.html) would be handy. I’m assuming the answer is to use the `KeyStore` to sign an app-generated passphrase for use with SQLCipher, but if there are other/better solutions, that’d be cool to know.

---

<div class="post-metadata">

**Author:** ![developernotes](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.zetetic.net/developernotes/32/1309_2.png) [@developernotes](https://discuss.zetetic.net/u/developernotes)\
**Post date:** [November 10, 2014, 10:45pm UTC](https://discuss.zetetic.net/t/sqlcipher-future-features/236/3 "2014-11-10T22:45:21Z")

</div>

Hi Mark,

That would be interesting to see, we don’t use the KeyStore within our  
own product but there may be folks out there interested in seeing how  
the two would integrate. Is that something you use often?

---

<div class="post-metadata">

**Author:** ![commonsguy](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.zetetic.net/commonsguy/32/75_2.png) [@commonsguy](https://discuss.zetetic.net/u/commonsguy)\
**Post date:** [November 10, 2014, 11:12pm UTC](https://discuss.zetetic.net/t/sqlcipher-future-features/236/4 "2014-11-10T23:12:26Z")

</div>

No, in part because apparently there are bugs that means that it is only a practical solution on Android 5.0+. IIRC, on earlier versions, if you changed your lockscreen type (e.g., PIN-\>password), it would wipe out the secure element, and you’d lose your keys.

However, it would be useful to have a hardware-backed key for SQLCipher, at least as an option. For users who steadfastly refuse to provide their own passphrase, a hardware-backed key means having a generated passphrase isn’t completely ridiculous.

---

<div class="post-metadata">

**Author:** ![developernotes](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.zetetic.net/developernotes/32/1309_2.png) [@developernotes](https://discuss.zetetic.net/u/developernotes)\
**Post date:** [November 11, 2014, 8:06pm UTC](https://discuss.zetetic.net/t/sqlcipher-future-features/236/5 "2014-11-11T20:06:32Z")

</div>

Hi Mark,

With regard to hardware backed key support, we did some work on this  
over the summer, as part of one of our presentations at PasswordsCon.  
The vfs branch [1] of SQLCipher includes support for persisting  
SQLCipher configuration data directly within the SQLCipher database  
header. We have built on top of this to have sample integrations with  
both Yubikey and DaPlug. Note this feature is not complete, however it  
is functional.

We have other features included within that branch such as computing a  
KDF iteration length constrained by time. These are topics we would  
like to delve into further with the SQLCipher community in the near future.

[1] [https://github.com/sqlcipher/sqlcipher/tree/vfs](https://github.com/sqlcipher/sqlcipher/tree/vfs)