Date: Thu, 8 Apr 2010 10:52:49 +0200
From: Andreas 'ads' Scherbaum <adsmail@wars-nicht.de>
To: pgsql-admin@postgresql.org
Subject: Re: Database level encryption
Message-ID: <20100408105249.0523f772@platin.wars-nicht.de>
In-Reply-To: <j2n5078d8af1004070345k3e08ca69l261d4dbb006b610e@mail.gmail.com>
References: <q2y5078d8af1004030635g624bf8f7r580cb3ebe7135b74@mail.gmail.com>
	<4BB774D4.3070306@joeconway.com>
	<m2r5078d8af1004051330n1874e532u3c88fd1bc31c8697@mail.gmail.com>
	<v2ldcc563d11004051334ledfcd2b2gf8db60ca48b43118@mail.gmail.com>
	<4BBA05E80200002500030493@gw.wicourts.gov>
	<4BBA6924.5050305@joeconway.com>
	<j2v5078d8af1004060245g35b87d5av329ab7a6af9a5579@mail.gmail.com>
	<4BBB009102000025000304D3@gw.wicourts.gov>
	<g2x5078d8af1004060759t1f6e0070u288201c87f925ca2@mail.gmail.com>
	<4BBB6A49020000250003052B@gw.wicourts.gov>
	<j2n5078d8af1004070345k3e08ca69l261d4dbb006b610e@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable


Hi Timothy,

On Wed, 7 Apr 2010 13:45:11 +0300 Timothy Madden wrote:

> On Wed, Apr 7, 2010 at 1:07 AM, Kevin Grittner
> <Kevin.Grittner@wicourts.gov> wrote:
> > Timothy Madden <terminatorul@gmail.com> wrote:
> >
> [...]
> > But the server needs to read certain data from the database
> > directory in order to start. =C2=A0In particular, WAL files need to be
> > read to get a clean start, and those can contain any data from the
> > database table. =C2=A0Any or all tables may need to be accessed to get
> > the database to a consistent point on startup. =C2=A0Plus there are all
> > the system catalogs, including the ones needed to authenticate
> > users.
>=20
> OK let's put the key logger issue aside from database encryption.

No, because that's one of the main problems.

If someone already goot root access on this laptop, he can snuff
keystrokes or the network traffic and capture all kind of passwords
(and other interesting information).

Basically your database, running on an unprivileged account, is only as
secure as the root account.


> I am willing to accept that the server may need to read the list of
> tables/schema-objects in the database, and some leftover data, in
> order to start, as long as the leftover data is immediately discarded
> upon start-up, and as long as it is likely that this data is not a
> large fraction of the data found in the database. It would still be
> nice if this check or clean-up could be delayed until such time some
> user really selects the database for use, and provides a password.

There's more:

- Vacuum reads whole memory pages, so any kind of encryption can only be
  on row level.
- Analyze stores the most common values per column, so it must be able
  to scan the columns without the password. Else the planer won't have
  reasonable good data. In addition: the statistics data is stored in
  system tables, so your password must apply here too.


Bye

--=20
				Andreas 'ads' Scherbaum
German PostgreSQL User Group
European PostgreSQL User Group - Board of Directors
Volunteer Regional Contact, Germany - PostgreSQL Project