https://bugs.openldap.org/show_bug.cgi?id=10523
--- Comment #1 from Howard Chu hyc@openldap.org --- (In reply to Dan Shearer from comment #0)
In mdb.c , encryption and checksums cannot be used together even though it looks like that was the intention.
No. If you want encryption and checksums, you use authenticated encryption and leave it at that. Or you use a non-authenticated cipher, and plain checksum support. It makes no sense to use a plain checksum plus encrypted authentication.
`OVPAGES` accounts for both `me_sumsize` and `me_esumsize`, so that suggests there should be room. However, with checksums on, the authentication-data slot `enckeys[2]` (sized `me_esumsize`, placed at the end of the page) overlaps the region the per-page checksum (`me_sumsize`) already used. So the authentication data overwrites the checksum. There may also be an ordering problem with which of set_checksum and set_encrypt are called first, but that will go away if encryption stops tromping on checksums.
There are use cases for having both turned on, and the one I care about is that implementers of encryption often do a terrible job. I am currently being an implementer of encryption so I want to have a way to see if I'm doing a terrible job. One way is to switch on checksums, because the way LMDB works is that checksums verify that the plain text stays the same having been en/decrypted. It is possible (indeed relatively common) to have silently failing encryption pass tests because the rubbish it generates is consistent rubbish. Besides, it's a great stress test, or would be if LMDB didn't corrupt itself instantly.