diff --git a/docs/manual.md b/docs/manual.md index 06a3fea2b..cd042ebe8 100644 --- a/docs/manual.md +++ b/docs/manual.md @@ -37,6 +37,7 @@ Welcome to Turso database manual! - [`sqlite3_column`](#sqlite3_column) - [WAL manipulation](#wal-manipulation) - [`libsql_wal_frame_count`](#libsql_wal_frame_count) + - [Encryption](#encryption) - [Appendix A: Turso Internals](#appendix-a-turso-internals) - [Frontend](#frontend) - [Parser](#parser) @@ -489,6 +490,26 @@ in the `p_frame_count` parameter. * The `p_frame_count` must be a valid pointer to a `u32` that will store the * number of frames in the WAL file. +## Encryption + +The work-in-progress RFC is [here](https://github.com/tursodatabase/turso/issues/2447). +To use encryption, you need to enable it via feature flag `encryption`. +To get started, generate a secure 32 byte key in hex: + +```shell +$ openssl rand -hex 32 +2d7a30108d3eb3e45c90a732041fe54778bdcf707c76749fab7da335d1b39c1d +``` + +Specify the key and cipher at the time of db creation to use encryption. Here is [sample test](https://github.com/tursodatabase/turso/blob/main/tests/integration/query_processing/encryption.rs): + +```shell +$ cargo run --features encryption -- database.db + +PRAGMA cipher = 'aegis256'; -- or 'aes256gcm' +PRAGMA hexkey = '2d7a30108d3eb3e45c90a732041fe54778bdcf707c76749fab7da335d1b39c1d'; +``` + ## Appendix A: Turso Internals Turso's architecture resembles SQLite's but differs primarily in its