rework kdf salt flags

sjlombardo · sjlombardo · commit 15fe89b30f05 · 2023-08-16T12:53:52.000-04:00
diff --git a/src/crypto.h b/src/crypto.h
@@ -107,6 +107,7 @@ void sqlite3pager_reset(Pager *pPager);
 #define CIPHER_FLAG_LE_PGNO       (1 << 1)
 #define CIPHER_FLAG_BE_PGNO       (1 << 2)
 #define CIPHER_FLAG_KEY_USED      (1 << 3)
+#define CIPHER_FLAG_HAS_KDF_SALT  (1 << 4)
 
 #ifndef DEFAULT_CIPHER_FLAGS
 #define DEFAULT_CIPHER_FLAGS CIPHER_FLAG_HMAC | CIPHER_FLAG_LE_PGNO
@@ -215,7 +216,6 @@ typedef struct {
   int plaintext_header_sz;
   int hmac_algorithm;
   int kdf_algorithm;
-  unsigned int need_kdf_salt;
   unsigned int flags;
   unsigned char *kdf_salt;
   unsigned char *hmac_kdf_salt;
diff --git a/src/crypto_impl.c b/src/crypto_impl.c
@@ -792,7 +792,7 @@ void* sqlcipher_codec_ctx_get_data(codec_ctx *ctx) {
 static int sqlcipher_codec_ctx_init_kdf_salt(codec_ctx *ctx) {
   sqlite3_file *fd = sqlite3PagerFile(ctx->pBt->pBt->pPager);
 
-  if(!ctx->need_kdf_salt) {
+  if(sqlcipher_codec_ctx_get_flag(ctx, CIPHER_FLAG_HAS_KDF_SALT)) {
     return SQLITE_OK; /* don't reload salt when not needed */
   }
 
@@ -805,14 +805,14 @@ static int sqlcipher_codec_ctx_init_kdf_salt(codec_ctx *ctx) {
       return SQLITE_ERROR;
     }
   }
-  ctx->need_kdf_salt = 0;
+  sqlcipher_codec_ctx_set_flag(ctx, CIPHER_FLAG_HAS_KDF_SALT);
   return SQLITE_OK; 
 }
 
 int sqlcipher_codec_ctx_set_kdf_salt(codec_ctx *ctx, unsigned char *salt, int size) {
   if(size >= ctx->kdf_salt_sz) {
     memcpy(ctx->kdf_salt, salt, ctx->kdf_salt_sz);
-    ctx->need_kdf_salt = 0;
+    sqlcipher_codec_ctx_set_flag(ctx, CIPHER_FLAG_HAS_KDF_SALT);
     return SQLITE_OK;
   }
   sqlcipher_log(SQLCIPHER_LOG_ERROR, "sqlcipher_codec_ctx_set_kdf_salt: attempt to set salt of incorrect size %d", size);
@@ -821,7 +821,7 @@ int sqlcipher_codec_ctx_set_kdf_salt(codec_ctx *ctx, unsigned char *salt, int si
 
 int sqlcipher_codec_ctx_get_kdf_salt(codec_ctx *ctx, void** salt) {
   int rc = SQLITE_OK;
-  if(ctx->need_kdf_salt) {
+  if(!sqlcipher_codec_ctx_get_flag(ctx, CIPHER_FLAG_HAS_KDF_SALT)) {
     if((rc = sqlcipher_codec_ctx_init_kdf_salt(ctx)) != SQLITE_OK) {
       sqlcipher_log(SQLCIPHER_LOG_ERROR, "sqlcipher_codec_ctx_get_kdf_salt: error %d from sqlcipher_codec_ctx_init_kdf_salt", rc);
     }
@@ -914,9 +914,6 @@ int sqlcipher_codec_ctx_init(codec_ctx **iCtx, Db *pDb, Pager *pPager, const voi
   /* setup default flags */
   ctx->flags = default_flags;
 
-  /* defer attempt to read KDF salt until first use */
-  ctx->need_kdf_salt = 1;
-
   /* setup the crypto provider  */
   sqlcipher_log(SQLCIPHER_LOG_DEBUG, "sqlcipher_codec_ctx_init: allocating provider");
   ctx->provider = (sqlcipher_provider *) sqlcipher_malloc(sizeof(sqlcipher_provider));
@@ -1181,7 +1178,7 @@ static int sqlcipher_cipher_ctx_key_derive(codec_ctx *ctx, cipher_ctx *c_ctx) {
   if(c_ctx->pass && c_ctx->pass_sz) {  /* if key material is present on the context for derivation */ 
    
     /* if necessary, initialize the salt from the header or random source */
-    if(ctx->need_kdf_salt) {
+    if(!sqlcipher_codec_ctx_get_flag(ctx, CIPHER_FLAG_HAS_KDF_SALT)) {
       if((rc = sqlcipher_codec_ctx_init_kdf_salt(ctx)) != SQLITE_OK) {
         sqlcipher_log(SQLCIPHER_LOG_ERROR, "sqlcipher_cipher_ctx_key_derive: error %d from sqlcipher_codec_ctx_init_kdf_salt", rc);
         return rc;
