API reference › @evolu/sqlite-wasm › deriveLegacySqliteKey

function deriveLegacySqliteKey(
  key: Uint8Array<ArrayBufferLike> &
    Brand<"Entropy"> &
    Brand<"Length32"> &
    Brand<"EncryptionKey">,
  salt: Uint8Array,
): Task<
  Uint8Array<ArrayBufferLike> &
    Brand<"Entropy"> &
    Brand<"Length32"> &
    Brand<"EncryptionKey">,
  never,
  SubtleCryptoDep
>;

Defined in: packages/sqlite-wasm/src/Database.ts:1793

Derives the key @evolu/sqlite-wasm 2.2.4 used: PBKDF2-HMAC-SHA512 with 256000 iterations and a 32-byte output, over the UTF-8 text x' followed by the key in lowercase hex and ', salted with the database's first 16 bytes.

It exists because of a bug in SQLite3 Multiple Ciphers 2.2.4, which 2.2.4 packaged. x'<hex>' is SQLCipher's notation for a raw key, which @evolu/web used, but that version took it as a passphrase and derived the key from the text (https://github.com/utelle/SQLite3MultipleCiphers/issues/218, fixed in 2.2.5). So the databases it encrypted are keyed with this derivation, and opening them needs it for as long as they exist, because nothing rekeys them.

The text is built byte by byte, so no string holds the key, and zeroed once WebCrypto has imported it.

Markdown for LLMs