Hi all!

To follow-up on the discussion we had on encryption a while ago, it
seems to me that there are two different situations, which need to be
handled differently: FireBird embedded, and FireBird server:

1) Embedded engine
In the case of the embedded engine, things are very simple. There is 1
application (at a time), using a DB, and the two are designed to go
together. No particular setup is required, and so it is useful in
situations where the the server cannot be secured properly (or perhaps
at all), by, for example, putting the DB in a specific directory which
only root user has access to, etc. Such things can and should be done
for a fully-fledged, dedicated server, but probably can't be done in
situations where the embedded engine is used. For example, if I write an
application that I distribute as shareware over the internet, I have no
control over the way the DB is used.

So in such cases, I think it would be useful to allow encryption of the
DB file, as it would either allow me, as the developper, to put data in
the DB which I want the application to use, but not to divulgate, or
else, it could allow the user of the app to himself set a password on
the DB, and then share it with others in a secure way. The DB would be
decrypted by passing the key in the DB connection params. In the case of
the embedded engine, doing so would not compromise the security, since
the application and the engine would both be running on the same
machine. So the key would never be sent across the network.

2) Full server configuration
In the case of a full server configuration, things are different. For
starters, I think encrypting the DB file would be less useful in such
cases. And besides, passing the key in the DB connect params over the
network, entirely defeats the security. So in such cases, what I think
would be more useful, would be an SSL-style encryption of all
communication over the wire.

What do you think of this?

Regards,
Jonathan Neve.