SQLCipher and passphrase for encryption

Question

I have recently changed my app to use SQLCipher API rather than the standard android.database.sqlite.

Originally a user would type their username and password when logging into the app for the first time. The app verifies the credentials against our server. If they are correct i store the username and password in the sqllite Db on the phone. Subsequent logins are then done against the phone's DB without the need for a webcall.

i also obfuscate the apk.

The stored password is also used to get a user's rota, which has senitive client data. eg numeric code to gain entry to clients house, address etc. This is what needs securing, incase the phone is stolen, rooted or decompiled.

My question is I understand that SQLCipher encryption/decryption all happens automatically with each call to

SQLiteDatabase db = dbhelper.getWritableDatabase("12345");

12345 is just some String i have hardcoded for now. I want this to be the password that the user has for their login.

What would be the best way to do this. I need to find a way where the user's password is stored securely and is used for encryption. I don't want any password hardcoded in the app(unless this is the only way to do it).

The problem is how can i call

SQLiteDatabase db = dbhelper.getWritableDatabase("STORED PASSOWRD IN DB");
return db.query(DBHelper.TABLECARER, null, null, null, null, null, null);

when the cursor has the password in it?

Thanks

Answer 1

Please refer to this link: http://www.informit.com/articles/article.aspx?p=2268753&seqNum=4

Keep in mind that you should not store the key on your device with protected data

Answer 2

From "Practical Advice for Building Secure Android Databases in SQLite":

There is a tradeoff between security and user convenience.

• Ask the user for the key every time. The most secure, the least convenient.
• Save in a preferences file on the device. Can be hacked.
• Save in the code on the device. Can be reverse engineered.
• Call out to the web to get the decryption key. Requires an Internet connection.

Overall, if the key is on the device anywhere, it can be dug out if a hacker is motivated, but if it's not, it requires an Internet connection or something inconvenient.