DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma;
	h=mime-version:in-reply-to:references:date:message-id:subject:from:to
	:cc:content-type:content-transfer-encoding;
	b=jB2s/XkoS6vtdLpZkc+AOAafIPWTnxK0q32pJ5/BExV/AC+SHmHZR4AmPiwBZkRW4d
	571V58CAMATpry18Ec5yrbUIzQ/RYGhonyMSlwsRHohNZMb62YKtcX0qGyp2NHDm8w2Z
	Ratp/MGIBKzvFyddwkFXc4EMpCpx2I2MDbc7Y=
MIME-Version: 1.0
In-Reply-To: <4BBB6A49020000250003052B@gw.wicourts.gov>
References: <q2y5078d8af1004030635g624bf8f7r580cb3ebe7135b74@mail.gmail.com>
	<4BB774D4.3070306@joeconway.com>
	<m2r5078d8af1004051330n1874e532u3c88fd1bc31c8697@mail.gmail.com>
	<v2ldcc563d11004051334ledfcd2b2gf8db60ca48b43118@mail.gmail.com>
	<4BBA05E80200002500030493@gw.wicourts.gov>
	<4BBA6924.5050305@joeconway.com>
	<j2v5078d8af1004060245g35b87d5av329ab7a6af9a5579@mail.gmail.com>
	<4BBB009102000025000304D3@gw.wicourts.gov>
	<g2x5078d8af1004060759t1f6e0070u288201c87f925ca2@mail.gmail.com>
	<4BBB6A49020000250003052B@gw.wicourts.gov>
Date: Wed, 7 Apr 2010 13:45:11 +0300
Message-ID: <j2n5078d8af1004070345k3e08ca69l261d4dbb006b610e@mail.gmail.com>
Subject: Re: Database level encryption
From: Timothy Madden <terminatorul@gmail.com>
To: Kevin Grittner <Kevin.Grittner@wicourts.gov>
Cc: Scott Marlowe <scott.marlowe@gmail.com>, Joe Conway <mail@joeconway.com>,
	pgsql-admin@postgresql.org
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

On Wed, Apr 7, 2010 at 1:07 AM, Kevin Grittner
<Kevin.Grittner@wicourts.gov> wrote:
> Timothy Madden <terminatorul@gmail.com> wrote:
>
[...]
> But the server needs to read certain data from the database
> directory in order to start. =A0In particular, WAL files need to be
> read to get a clean start, and those can contain any data from the
> database table. =A0Any or all tables may need to be accessed to get
> the database to a consistent point on startup. =A0Plus there are all
> the system catalogs, including the ones needed to authenticate
> users.

OK let's put the key logger issue aside from database encryption.

I am willing to accept that the server may need to read the list of
tables/schema-objects in the database, and some leftover data, in
order to start, as long as the leftover data is immediately discarded
upon start-up, and as long as it is likely that this data is not a
large fraction of the data found in the database. It would still be
nice if this check or clean-up could be delayed until such time some
user really selects the database for use, and provides a password.

I would expect the database (or catalog, I guess, is it ?) to be
visible, but any attempt to connect without the password would fail as
if user has no rights on the database or the password is wrong. What I
perceive as a problem here might be that an encrypted database would
automatically need the privileges to be set up so that only the owner
can read or connect to it. That is its privileges would have to
indicate that even the postgres user can not read it. Except maybe for
the names of tables and schema objects, if the server insists that it
needs those for a clean start up, and so those shall remain clear
text.

User authentication should be unrelated to encrypting the database
owned by that user. You can think of it as if only the owner can ever
connect to such a database, and his/her password is the encryption
key, or as if any user that wishes to connect should provide the
encryption key first, and then the user name and password.

Thank you,
Timothy Madden