pg.ddx.io  pgsql-hackers@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Stephen Frost <sfrost@snowman.net>
To: Michael Paquier <michael@paquier.xyz>
Cc: Bruce Momjian <bruce@momjian.us>
Cc: PostgreSQL-development <pgsql-hackers@postgresql.org>
Cc: Masahiko Sawada <masahiko.sawada@2ndquadrant.com>
Subject: Re: Proposed patch for key managment
Date: Fri, 18 Dec 2020 08:12:21 -0500
Message-ID: <20201218131221.GZ16415@tamriel.snowman.net> (raw)
In-Reply-To: <X9v/Yo8sLB/GKLvt@paquier.xyz>
References: <X9gL7bD9idE2hoFt@paquier.xyz>
	<20201215031902.GB14596@momjian.us>
	<X9hHoQcZ11pBtgnz@paquier.xyz>
	<20201215210212.GG14596@momjian.us>
	<X9lhi1ht04I+v/rV@paquier.xyz>
	<20201216220412.GB4527@momjian.us>
	<X9qXuLekePLRYrB2@paquier.xyz>
	<20201217163954.GY16415@tamriel.snowman.net>
	<20201217171022.GE23260@momjian.us>
	<X9v/Yo8sLB/GKLvt@paquier.xyz>

Greetings,

* Michael Paquier (michael@paquier.xyz) wrote:
> On Thu, Dec 17, 2020 at 12:10:22PM -0500, Bruce Momjian wrote:
> > Agreed.  I think there is serious risk we would do AES in a different
> > way than OpenSSL, especially if I did it.  ;-)  We can add a native AES
> > one day if we want, but as stated by Michael Paquier, it has to be
> > tested so we are sure it returns exactly the same values as OpenSSL.
> 
> I think that it would be good to put some generalization here, and
> look at options that are offered by other SSL libraries, like libnss
> so as we don't finish with a design that restricts the use of a given
> feature only to OpenSSL.

While I agree with the general idea proposed here, I don't know that we
need to push super hard on it to be somehow perfect right now because it
simply won't be until we actually add support for another library, and I
don't think that's really this patch's responsibility.

So, yes, let's lay the groundwork and structure and perhaps spend a bit
of time looking at other libraries, but not demand this patch also add
support for a second library today, and accept that that means that the
structure we put in place may not end up being exactly perfect.

Thanks,

Stephen

Attachments:

  signature.asc (application/pgp-signature, 818B) download

view thread (93+ messages)  latest in thread

Message-ID: <20201218131221.GZ16415@tamriel.snowman.net>
Permalink:  ../20201218131221.GZ16415@tamriel.snowman.net/
Also on:    postgresql.org/message-id/20201218131221.GZ16415@tamriel.snowman.net

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-hackers@postgresql.org
  Cc: sfrost@snowman.net, michael@paquier.xyz, bruce@momjian.us, masahiko.sawada@2ndquadrant.com
  Subject: Re: Proposed patch for key managment
  In-Reply-To: <20201218131221.GZ16415@tamriel.snowman.net>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox