https://bugs.openldap.org/show_bug.cgi?id=10523
Issue ID: 10523 Summary: LMDBv1.0 encryption tromps on checksums Product: LMDB Version: unspecified Hardware: All OS: All Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: liblmdb Assignee: bugs@openldap.org Reporter: dan@shearer.org Target Milestone: ---
In mdb.c , encryption and checksums cannot be used together even though it looks like that was the intention.
`OVPAGES` accounts for both `me_sumsize` and `me_esumsize`, so that suggests there should be room. However, with checksums on, the authentication-data slot `enckeys[2]` (sized `me_esumsize`, placed at the end of the page) overlaps the region the per-page checksum (`me_sumsize`) already used. So the authentication data overwrites the checksum. There may also be an ordering problem with which of set_checksum and set_encrypt are called first, but that will go away if encryption stops tromping on checksums.
There are use cases for having both turned on, and the one I care about is that implementers of encryption often do a terrible job. I am currently being an implementer of encryption so I want to have a way to see if I'm doing a terrible job. One way is to switch on checksums, because the way LMDB works is that checksums verify that the plain text stays the same having been en/decrypted. It is possible (indeed relatively common) to have silently failing encryption pass tests because the rubbish it generates is consistent rubbish. Besides, it's a great stress test, or would be if LMDB didn't corrupt itself instantly.