Merge 'Add some docs on encryption' from Avinash Sajjanshetty

Reviewed-by: Preston Thorpe <preston@turso.tech>
Reviewed-by: bit-aloo (@Shourya742)

Closes #2805
This commit is contained in:
Pekka Enberg
2025-08-27 13:27:00 +03:00
committed by GitHub

View File

@@ -37,6 +37,7 @@ Welcome to Turso database manual!
- [`sqlite3_column`](#sqlite3_column)
- [WAL manipulation](#wal-manipulation)
- [`libsql_wal_frame_count`](#libsql_wal_frame_count)
- [Encryption](#encryption)
- [Appendix A: Turso Internals](#appendix-a-turso-internals)
- [Frontend](#frontend)
- [Parser](#parser)
@@ -489,6 +490,26 @@ in the `p_frame_count` parameter.
* The `p_frame_count` must be a valid pointer to a `u32` that will store the
* number of frames in the WAL file.
## Encryption
The work-in-progress RFC is [here](https://github.com/tursodatabase/turso/issues/2447).
To use encryption, you need to enable it via feature flag `encryption`.
To get started, generate a secure 32 byte key in hex:
```shell
$ openssl rand -hex 32
2d7a30108d3eb3e45c90a732041fe54778bdcf707c76749fab7da335d1b39c1d
```
Specify the key and cipher at the time of db creation to use encryption. Here is [sample test](https://github.com/tursodatabase/turso/blob/main/tests/integration/query_processing/encryption.rs):
```shell
$ cargo run --features encryption -- database.db
PRAGMA cipher = 'aegis256'; -- or 'aes256gcm'
PRAGMA hexkey = '2d7a30108d3eb3e45c90a732041fe54778bdcf707c76749fab7da335d1b39c1d';
```
## Appendix A: Turso Internals
Turso's architecture resembles SQLite's but differs primarily in its