Encrypt SQLite databases from mozStorageService

[Not-Nik]

Encrypt SQLite database whose connections are created in mozStorageService. Cloned and ATTACHed connections are also affected. The mechanism is behind a new security.storage.keystore.enabled. The keys for the connections are stored, encrypted by the SDR, in a new bikeshed/keystore.enc.

[gcp]

Weird naming here.

[gcp]

I think this wants tests as well. For Foxfooding we can deal with some flakyness but causing all SQLite databases to get corrupted will probably get old soon for the poor testers 😄

[mozkeeler]

This uses 3DES. You want PK11SDR_EncryptWithMechanism.

[mozkeeler]

Is there a particular reason to have this in its own directory? These kinds of files tend to belong in security/manager (or at least a subdirectory therein).

[mozkeeler]

Generally speaking, you probably don't need to do the whole new SECItem() ... SECITEM_MakeItem(...) - you can do something like SECItem key = { siBuffer, (unsigned char*)encryptedKey.Data(), encryptedKey.Length() }; (assuming the NSS functions you call either copy the data or only borrow it for the length of the call, which is most of them).

[Not-Nik]

That particular example needs a "proper" SECItem (on the heap), because it is later stored in KEY_MAP, which is static and thus outlives encryptedKey. I already tried to reduce buffer allocation, and I'll move to a stack SECItem in the path == SYSTEM_KEY_NAME path, but if I missed anything else do let me know.

[mozkeeler]

Some of this code seems very similar to NSSKeyStore - is there a reason to not re-use that? (currently it's only used as a fallback on Linux, but you could use it unconditionally here)

[Not-Nik]

For one the custom solution allows us some flexibility right away, only requiring the token to be unlocked once for loading all the keys. Later database open operations can then rely on the master key to do their work (create new key, decrypt existing key). Additionally, there is a plan to turn the keystore into the lockstore module which Benjamin has been working on.