Principle:Duckdb Duckdb TLS Cryptography

Knowledge Sources	TLS 1.3 Specification Mbed TLS Documentation AES Specification (FIPS 197) RSA Cryptosystem
Domains	Cryptography, Security, Networking
Last Updated	2026-02-07 12:00 GMT

Overview

A collection of cryptographic primitives and protocols that provide confidentiality, integrity, and authentication for secure communication and data verification, encompassing symmetric ciphers, asymmetric key operations, hash functions, and certificate management.

Description

Transport Layer Security (TLS) cryptography encompasses the set of algorithms and protocols used to establish secure communication channels over untrusted networks. The cryptographic foundation includes several categories of primitives, each serving a distinct purpose in the security architecture.

Symmetric encryption (AES) provides fast, bulk data encryption using a shared secret key. AES operates on 128-bit blocks with key sizes of 128, 192, or 256 bits, using substitution-permutation network rounds. Modes of operation like GCM (Galois/Counter Mode) and CCM (Counter with CBC-MAC) provide both confidentiality and authenticated encryption, ensuring data has not been tampered with.

Asymmetric encryption (RSA, Elliptic Curve) enables key exchange and digital signatures without pre-shared secrets. RSA is based on the difficulty of factoring large semiprimes, while elliptic curve cryptography (ECC) achieves equivalent security with smaller key sizes by leveraging the discrete logarithm problem on elliptic curves. Public key infrastructure (PKI) uses these primitives to issue and verify X.509 certificates that bind public keys to identities.

Hash functions (SHA-256, SHA-512) produce fixed-size digests from arbitrary input, providing one-way functions used for integrity verification, key derivation, and digital signature schemes. ASN.1 and PEM formats provide standardized encoding for keys, certificates, and other cryptographic objects.

Usage

TLS cryptography is used in DuckDB for two primary purposes. First, it provides HTTPS support for secure connections when downloading extensions or accessing remote data through the httpfs extension. Second, it powers the extension signing mechanism, where RSA signatures verify the authenticity and integrity of DuckDB extensions before they are loaded, preventing execution of tampered or unauthorized code.

Theoretical Basis

AES Encryption: The core AES round transformation:

// AES-128: 10 rounds, AES-256: 14 rounds
function aes_encrypt(plaintext, key):
    state = plaintext XOR round_keys[0]    // AddRoundKey
    for round in 1..Nr-1:
        SubBytes(state)      // S-box substitution
        ShiftRows(state)     // Cyclic row shifts
        MixColumns(state)    // Column mixing (GF(2^8))
        AddRoundKey(state, round_keys[round])
    // Final round (no MixColumns)
    SubBytes(state)
    ShiftRows(state)
    AddRoundKey(state, round_keys[Nr])
    return state

RSA Key Operations: Based on modular exponentiation:

// Key generation
p, q = large random primes
n = p * q                    // modulus
e = 65537                    // public exponent (commonly)
d = modular_inverse(e, lcm(p-1, q-1))  // private exponent

// Signing (PKCS#1 v1.5 or PSS)
signature = message_hash^d mod n

// Verification
recovered_hash = signature^e mod n
valid = (recovered_hash == hash(message))

Elliptic Curve Operations: Point arithmetic over finite fields:

// Curve equation: y^2 = x^3 + ax + b (mod p)
// Point addition: P + Q = R
// Point doubling: P + P = 2P

// ECDSA signing
k = random integer in [1, n-1]
(x1, y1) = k * G              // scalar multiplication
r = x1 mod n
s = k^(-1) * (hash + r * private_key) mod n
signature = (r, s)

GCM Authenticated Encryption: Combines CTR mode with GHASH:

// GCM encryption
H = AES_encrypt(0^128, key)   // hash subkey
for each block i:
    counter_i = increment(counter)
    ciphertext_i = plaintext_i XOR AES_encrypt(counter_i, key)
tag = GHASH(H, aad, ciphertext) XOR AES_encrypt(counter_0, key)
// Output: ciphertext || tag

Related Pages

Page Connections

Double-click a node to navigate. Hold to expand connections.

Principle

Implementation

Heuristic

Environment