From: Bruce Momjian <bruce@momjian.us>
To: Joe Conway <mail@joeconway.com>
Cc: Robert Haas <robertmhaas@gmail.com>
Cc: Stephen Frost <sfrost@snowman.net>
Cc: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Cc: Ants Aasma <ants.aasma@eesti.ee>
Cc: PostgreSQL-development <pgsql-hackers@postgresql.org>
Subject: Re: WIP: Data at rest encryption
Date: Tue, 13 Jun 2017 12:58:36 -0400
Message-ID: <20170613165836.GE13873@momjian.us> (raw)
In-Reply-To: <26430417-5b4b-b647-9a23-3da213714ffe@joeconway.com>
References: <06b6db11-3a3f-4d24-6f57-450f96ecda84@2ndquadrant.com>
<CA+TgmoaXGx=7VEVz7eq9T=raZRHm3iNc244Sx=T1UxX-+szOUQ@mail.gmail.com>
<CA+CSw_uO6wGv2YF-RQvVOGeezJXWY+SGTKYomOY=fDNp6OmHqA@mail.gmail.com>
<20170613132416.GD3151@tamriel.snowman.net>
<a79fc30c-848a-cf88-a2ff-0234df45f1dc@2ndquadrant.com>
<20170613150421.GE3151@tamriel.snowman.net>
<20170613160434.GC13873@momjian.us>
<20170613162301.GF3151@tamriel.snowman.net>
<CA+TgmoYeEigW3ERT5AKUc-QWBOSuS5ZDFJDRJm1=hDv2Q=0zLw@mail.gmail.com>
<26430417-5b4b-b647-9a23-3da213714ffe@joeconway.com>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-hackers>
On Tue, Jun 13, 2017 at 09:55:10AM -0700, Joe Conway wrote:
> > That way, if the user wants to store the key in an unencrypted text
> > file, they can set the encryption_key_command = 'cat /not/very/secure'
> > and call it a day. If they want to prompt the user on the console or
> > request the key from an HSM or get it in any other way, they just have
> > to write the appropriate shell script. We just provide mechanism, not
> > policy, and the user can adopt any policy they like, from an extremely
> > insecure policy to one suitable for Fort Knox.
>
> Agreed, but as Bruce alluded to, we want this to be a master key, which
> is in turn used to encrypt the actual key, or keys, that are used to
> encrypt the data. The actual data encryption keys could be very long
> randomly generated binary, and there could be more than one of them
> (e.g. one per tablespace) in a file which is encrypted with the master
> key. This is more secure and allows, for example the master key to be
> changed without having to decrypt/re-encrypt the entire database.
Yes, thank you. Also, you can make multiple RSA-encrypted copies of the
symetric key, one for each role you want to view the data. And good
point on the ability to change the RSA key/password without having to
reencrypt the data.
--
Bruce Momjian <bruce@momjian.us> http://momjian.us
EnterpriseDB http://enterprisedb.com
+ As you are, so once was I. As I am, so you will be. +
+ Ancient Roman grave inscription +
--
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: bruce@momjian.us, mail@joeconway.com, robertmhaas@gmail.com, sfrost@snowman.net, peter.eisentraut@2ndquadrant.com, ants.aasma@eesti.ee
Subject: Re: WIP: Data at rest encryption
In-Reply-To: <20170613165836.GE13873@momjian.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox