Date: Tue, 13 Jun 2017 14:38:58 -0400
From: Stephen Frost <sfrost@snowman.net>
To: Bruce Momjian <bruce@momjian.us>
Cc: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>,
	Ants Aasma <ants.aasma@eesti.ee>,
	Robert Haas <robertmhaas@gmail.com>,
	PostgreSQL-development <pgsql-hackers@postgresql.org>
Subject: Re: WIP: Data at rest encryption
Message-ID: <20170613183858.GR3151@tamriel.snowman.net>
References: <20170613150421.GE3151@tamriel.snowman.net>
 <20170613160434.GC13873@momjian.us>
 <20170613162301.GF3151@tamriel.snowman.net>
 <20170613164442.GD13873@momjian.us>
 <20170613170132.GH3151@tamriel.snowman.net>
 <20170613171356.GG13873@momjian.us>
 <20170613172459.GL3151@tamriel.snowman.net>
 <20170613174329.GK13873@momjian.us>
 <20170613182339.GP3151@tamriel.snowman.net>
 <20170613182910.GN13873@momjian.us>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="Yp2peGhYY/ncyJ3b"
Content-Disposition: inline
In-Reply-To: <20170613182910.GN13873@momjian.us>
User-Agent: Mutt/1.5.21 (2010-09-15)
Precedence: bulk
Sender: pgsql-hackers-owner@postgresql.org


--Yp2peGhYY/ncyJ3b
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Bruce,

* Bruce Momjian (bruce@momjian.us) wrote:
> On Tue, Jun 13, 2017 at 02:23:39PM -0400, Stephen Frost wrote:
> > I'm not trying to shut down discussion, I'm simply pointing out where
> > this feature will be helpful and where it won't be.  If there's a way to
> > make it better and able to address an attack where the OS permission
> > system is bypassed, that'd be great, but I certainly don't know of any
> > way to do that and we don't want to claim that this feature will protect
> > against an attack vector that it won't.
> >=20
> > If the lack of that means you don't support the feature, that's
> > unfortunate as it seems to imply, to me at least, that we'll never have
> > any kind of encryption because there's no way for it to prevent attacks
> > where the OS permission system is able to be bypassed.
>=20
> It means if we can't discuss the actual benefits that this feature
> brings, and doesn't bring, and how it will deal with future feature
> additions, then you are right we will never have it.

I apologize for having come across as trying to shut down discussion,
that was not my intent.

It's good to discuss what the feature would bring and what cases it
doesn't cover, as well as discussing how it can be designed to make sure
that later improvements are able to be done without having to change it
around.  I do think it's a good idea for us to consider taking an
incremental approach where we're adding pieces and building things up as
we go.  I'm concerned that if we try to do too much in the initial
implementation that we'll end up not having anything.

As it relates to the different attack vectors that this would address,
it's primairly the same ones which filesystem-level encryption also
addresses, but it's an improvement when it comes to ease of use.
Unfortunately, it won't address cases where the OS is compromised.

Thanks!

Stephen

--Yp2peGhYY/ncyJ3b
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJZQDFCAAoJEO1sijiDR2RVIWkQAL47Zx8GlAsUQwFSI1auYCmn
WaTYA8zIm6x/x5TO3AAj9g55qPuAKZJXBPpy0gLqOzyp6RLYEEb1AE8SsLEr7Zd4
9uRLv+dzyEVLSAv/uf9ZPBk9SL3SE8usk5Vr5e+6Jd3e7dtPGKAL5VNfgT51pjgC
hJwcreFOJmUzdnD8X70KRK90s77fV0BHTVVLKdohmZR0l2fsA7AtwBsLi1SRegax
b6cFdpNpklYtOh8cWx15lhcxuTbnvH9+ZKe9wV1E+MHBaSvWW4QVtOqeWeHAlzns
nTa0X8N1b/IaNDoFs76v3YWxVNnowrW2/KKESeLDP3KJz//xOIwnLKsdbBGZP8xT
tykZL3OFoa8aaZzoCjAa7+j5BflodQFp3B7DymXpAUYwg5AynmiBAKvdgBN8oo0M
S/qXiBeKzaZWrAVEOx1Jedlr3C8NQre/RxgOCHfWslzQwsJdemlbSKCUwBBxWsf/
IwUGhq+uHDvzyQQzAs8V0ooLZordg3d8UszqvNRlsd54egwDitfolsYmND7TD6oc
TB8WKDGIGvEfO9ipRARP7m5Ca2fdo4m+3s4Y7v4/DUCSII4f9BOI5GFGiAcEjBdN
REs64QKP0r6rbJg2y0SGcfjv0p1h2xslVfvBafPXKlnb1rhBGlx036D3qb5oh3yv
XemCjQKng3CQehPTV7El
=buV0
-----END PGP SIGNATURE-----

--Yp2peGhYY/ncyJ3b--