Date: Thu, 15 Jun 2017 19:27:55 -0400
From: Stephen Frost <sfrost@snowman.net>
To: Bruce Momjian <bruce@momjian.us>
Cc: Robert Haas <robertmhaas@gmail.com>,
	Peter Eisentraut <peter.eisentraut@2ndquadrant.com>,
	Ants Aasma <ants.aasma@eesti.ee>,
	PostgreSQL-development <pgsql-hackers@postgresql.org>
Subject: Re: WIP: Data at rest encryption
Message-ID: <20170615232755.GD1769@tamriel.snowman.net>
References: <20170613221104.GT3151@tamriel.snowman.net>
 <9cea5160-c64b-0b9e-d4b7-c57db2a696be@2ndquadrant.com>
 <20170614214119.GL1769@tamriel.snowman.net>
 <0b5611b8-af0f-152d-9c38-222b081c71ac@2ndquadrant.com>
 <CA+TgmoYrQvGkr-6j4fDxJ-SBjhiALzDZcukR2c9s0VeGbWoWaw@mail.gmail.com>
 <20170615202942.GA20904@momjian.us>
 <CA+TgmoaPbgzNytWPwD43s996eQkOwVATbhXCfhvQ8FkP8cG4JQ@mail.gmail.com>
 <20170615211201.GC8443@momjian.us>
 <20170615224108.GC1769@tamriel.snowman.net>
 <20170615231302.GA11450@momjian.us>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="GVmdUcABewnKtUm9"
Content-Disposition: inline
In-Reply-To: <20170615231302.GA11450@momjian.us>
User-Agent: Mutt/1.5.21 (2010-09-15)
Precedence: bulk
Sender: pgsql-hackers-owner@postgresql.org


--GVmdUcABewnKtUm9
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Bruce,

* Bruce Momjian (bruce@momjian.us) wrote:
> On Thu, Jun 15, 2017 at 06:41:08PM -0400, Stephen Frost wrote:
> > > > > One serious difference between in-database-encryption and SSH key=
s is
> > > > > that the use of passwords for SSH is well understood and reasonab=
le to
> > > > > use, while I think we all admit that use of passwords for database
> > > > > objects like SSL keys is murky.  Use of keys for OS-level encrypt=
ion is
> > > > > a little better handled, but not as clean as SSH keys.
> > > >=20
> > > > Peter pointed out upthread that our handling of SSL passphrases lea=
ves
> > > > a lot to be desired, and that maybe we should fix that problem firs=
t;
> > > > I agree.  But I don't think this is any kind of intrinsic limitation
> > > > of PostgreSQL vs. encrypted filesystems vs. SSH; it's just a
> > > > quality-of-implementation issue.
> >=20
> > I'm not thrilled with asking Ants to implement a solution to SSL
> > passphrases, and generalizing it to work for this, to get this feature
> > accepted.  I assume that the reason for asking for that work to be done
> > now is because we decided that the current approach for SSL sucks but we
> > couldn't actually drop support for it, but we don't want to add other
> > features which work in a similar way because, well, it sucks.
>=20
> My point is that if our support for db-level encryption is as bad as SSL
> key passwords, then it will be nearly useless, so we might as well not
> have it.  Isn't that obvious?

Well, no, because the reason we even have an approach at all for SSL key
passwords is because multiple people (myself and Magnus, at least, as I
recall) complained as we are aware of installations which are actively
using that approach.

That doesn't mean it's a great solution or that it doesn't suck- really,
I tend to agree that it does, but it's necessary because we need a
solution, it works, and users are using it.  Having a better solution
would be great and something agent-based might be the right answer (or
perhaps something where we have support for using hardware accellerators
through an existing library...).

I expect the same would happen with the shell-command approach suggested
up-thread and the prompt-on-stdin approach too, they aren't great but I
expect users would still use the feature.  As Robert and I have
mentioned, there is a good bit of value to having this feature simply
because it avoids the need to get someone with root privileges to set up
an encrypted volume and I don't think having to use a shell command or
providing the password on stdin at startup really changes that very
much.

Thanks!

Stephen

--GVmdUcABewnKtUm9
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJZQxf7AAoJEO1sijiDR2RV2SkQAMDIKrwxKeXpqW/iJOqipxiy
q0nh59M9alw8ftOqRZ++kcWmrHsCikFaNTjQehe6azsh1t7Wb+i+oPQ7/7Ekwj5q
qulP9iftoSPG+M3SEF4gX6M5aKkVllgu9RL88nIqVYksSfAsLFcs1qm4nOJOW/Dq
sOc7SWOqFC7n65TYv4WvuXoS3RYQ86Vm7fu0Bn2sC/AqnRhDsYA6UUcIh0Onl+3o
a+8E+AoWU/heSK3UhCwIK2lwKIb3xlArhJTl/EWfZgPEEWLmfbnZQaBDSwGFZpJP
iVc/46clNpoRk8K+FujfNVXEPTWoDo6VaV1WWtD8xBWE47vvaUianrYdHjZsCt1r
lN03k3f5Bqq3aXTQb/WhHdL/xZxdDrAu/tZj5mM+8VIn3T9tPm55MQHxEytIBaRy
Q5G6dIXi5W3QenKI0Nu040kzrnb3LDbOT1qM8nBv+AQZuLLVC9+NAUDdYW3DLG/L
QBfuKn8lj6MD3GUNs5fwpSuJygh++/frD9EuRwR8F19FggtLW9eXKDswYrxtDMKQ
ravsoe/lwZJLpASqHxlE4wy4SnRP3zuWlAaxLRWML4yr690Jrl47Shdyohn8Eshv
i16lPxZmFeFPFrbc5pWkJaudtShCxQdEffOj6nzNkV6476ira56GacBr1UXH750W
DcdVoyOY4VT4oDeT7kF0
=Gnu7
-----END PGP SIGNATURE-----

--GVmdUcABewnKtUm9--