From: Stephen Frost <sfrost@snowman.net>
To: Bruce Momjian <bruce@momjian.us>
Cc: Joe Conway <mail@joeconway.com>
Cc: Robert Haas <robertmhaas@gmail.com>
Cc: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Cc: Ants Aasma <ants.aasma@eesti.ee>
Cc: PostgreSQL-development <pgsql-hackers@postgresql.org>
Subject: Re: WIP: Data at rest encryption
Date: Tue, 13 Jun 2017 13:05:22 -0400
Message-ID: <20170613170522.GI3151@tamriel.snowman.net> (raw)
In-Reply-To: <20170613165836.GE13873@momjian.us>
References: <CA+TgmoaXGx=7VEVz7eq9T=raZRHm3iNc244Sx=T1UxX-+szOUQ@mail.gmail.com>
<CA+CSw_uO6wGv2YF-RQvVOGeezJXWY+SGTKYomOY=fDNp6OmHqA@mail.gmail.com>
<20170613132416.GD3151@tamriel.snowman.net>
<a79fc30c-848a-cf88-a2ff-0234df45f1dc@2ndquadrant.com>
<20170613150421.GE3151@tamriel.snowman.net>
<20170613160434.GC13873@momjian.us>
<20170613162301.GF3151@tamriel.snowman.net>
<CA+TgmoYeEigW3ERT5AKUc-QWBOSuS5ZDFJDRJm1=hDv2Q=0zLw@mail.gmail.com>
<26430417-5b4b-b647-9a23-3da213714ffe@joeconway.com>
<20170613165836.GE13873@momjian.us>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-hackers>
Bruce, Joe,
* Bruce Momjian (bruce@momjian.us) wrote:
> On Tue, Jun 13, 2017 at 09:55:10AM -0700, Joe Conway wrote:
> > > That way, if the user wants to store the key in an unencrypted text
> > > file, they can set the encryption_key_command = 'cat /not/very/secure'
> > > and call it a day. If they want to prompt the user on the console or
> > > request the key from an HSM or get it in any other way, they just have
> > > to write the appropriate shell script. We just provide mechanism, not
> > > policy, and the user can adopt any policy they like, from an extremely
> > > insecure policy to one suitable for Fort Knox.
> >
> > Agreed, but as Bruce alluded to, we want this to be a master key, which
> > is in turn used to encrypt the actual key, or keys, that are used to
> > encrypt the data. The actual data encryption keys could be very long
> > randomly generated binary, and there could be more than one of them
> > (e.g. one per tablespace) in a file which is encrypted with the master
> > key. This is more secure and allows, for example the master key to be
> > changed without having to decrypt/re-encrypt the entire database.
>
> Yes, thank you. Also, you can make multiple RSA-encrypted copies of the
> symetric key, one for each role you want to view the data. And good
> point on the ability to change the RSA key/password without having to
> reencrypt the data.
There's nothing in this proposal that prevents the user from using a
very long randomly generated binary key. We aren't talking about
prompting the user for a password unless that's what they decide the
shell script should do, unless the user decides to do that and if they
do then that's their choice.
Let us, please, stop stressing over the right way to do key management
as part of this discussion about providing encryption. The two are
different things and we do not need to solve both at once.
Further, yes, we will definitely want to get to a point where we can
encrypt subsets of the system in different ways, but that doesn't have
to be done in the first implementation either.
Thanks!
Stephen
Attachments:
signature.asc (application/pgp-signature, 818B) download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: sfrost@snowman.net, bruce@momjian.us, mail@joeconway.com, robertmhaas@gmail.com, peter.eisentraut@2ndquadrant.com, ants.aasma@eesti.ee
Subject: Re: WIP: Data at rest encryption
In-Reply-To: <20170613170522.GI3151@tamriel.snowman.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox