From: Antonin Houska <ah@cybertec.at>
To: Robert Haas <robertmhaas@gmail.com>
Cc: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Toshi Harada <harada.toshi@po.ntt-tx.co.jp>
Cc: pgsql-hackers@postgresql.org <pgsql-hackers@postgresql.org>
Subject: Re: "WIP: Data at rest encryption" patch and, PostgreSQL 11-beta3
Date: Fri, 05 Apr 2019 17:22:42 +0200
Message-ID: <13531.1554477762@localhost> (raw)
In-Reply-To: <CA+TgmoY1aWOGB06bDLDXY0O5Doc-NDvnbdz=Wajb2Fqcd9O_2g@mail.gmail.com>
References: <5907.1534140361@localhost>
<201808150211.w7F2ApMj023097@ccmail04.silk.ntt-tx.co.jp>
<19039.1536933944@localhost>
<CA+TgmoawhAmdVaSYt3YLA5dsgoc-oXf72O3ybFAqiARfyTL4iA@mail.gmail.com>
<14646.1552570130@localhost>
<CA+Tgmoawc7hQW2SrcvVSfw8JyYV8UU4fyQ56nxKn_BtPhXfhdQ@mail.gmail.com>
<13456.1552684223@sss.pgh.pa.us>
<27465.1553168779@localhost>
<CA+TgmoY1aWOGB06bDLDXY0O5Doc-NDvnbdz=Wajb2Fqcd9O_2g@mail.gmail.com>
Robert Haas <robertmhaas@gmail.com> wrote:
> On Thu, Mar 21, 2019 at 7:46 AM Antonin Houska <ah@cybertec.at> wrote:
> > Nevertheless, with the current version of our patch, PG should be resistant
> > against such a partial write anyway because we chose to align XLOG records to
> > 16 bytes (as long as the encryption is enabled) for the following reasons:
> >
> > If one XLOG record ends and the following one starts in the same encryption
> > block, both records can get corrupted during streaming replication. The
> > scenario looks like: 1) the first record is written on master (the unused part
> > of the block contains zeroes), 2) the block is encrypted and its initial part
> > (i.e. the number of bytes occupied by the first record in the plain text) is
> > streamed to slave, 3) the second record is written on master, 4) the
> > containing encryption block is encrypted again and the trailing part (i.e. the
> > number of bytes occupied by the second record) is streamed, 5) decryption of
> > the block on slave will produce garbage and thus corrupt both records. This is
> > because the trailing part of the block was filled with zeroes during
> > encryption, but it contains different data at decryption time.
>
> Wouldn't Tom's proposal to use a stream cipher fix all this?
Yes it would make the extra alignment unnecessary, but our solution tries to
meet specific requirements of disk encryption. Stream cipher appears to be
incompatible with these requirements:
https://en.wikipedia.org/wiki/Disk_encryption_theory
Currently we try to use the CBC-ESSIV mode. It's worth to mention that in this
mode, if the page is encrypted twice and if the plain data in the encryption
block N (i.e. block of 16 bytes) changes before the 2nd encryption, the
encrypted data will only change in blocks >= N. So the problem of losing
already flushed WAL records should not happen.
--
Antonin Houska
Web: https://www.cybertec-postgresql.com
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: ah@cybertec.at, robertmhaas@gmail.com, tgl@sss.pgh.pa.us, harada.toshi@po.ntt-tx.co.jp
Subject: Re: "WIP: Data at rest encryption" patch and, PostgreSQL 11-beta3
In-Reply-To: <13531.1554477762@localhost>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox