From: Bruce Momjian <bruce@momjian.us>
To: Alastair Turner <minion@decodable.me>
Cc: Stephen Frost <sfrost@snowman.net>
Cc: Michael Paquier <michael@paquier.xyz>
Cc: PostgreSQL-development <pgsql-hackers@postgresql.org>
Cc: Masahiko Sawada <masahiko.sawada@2ndquadrant.com>
Subject: Re: Proposed patch for key managment
Date: Tue, 22 Dec 2020 16:13:06 -0500
Message-ID: <20201222211306.GA9170@momjian.us> (raw)
In-Reply-To: <CAC0Gmywn71eLHi7noyHv64m3+W2BdO5bAYs-grZ4VMxBZCHDxw@mail.gmail.com>
References: <20201218213624.GG16415@tamriel.snowman.net>
<20201219023844.GG28841@momjian.us>
<CAC0GmywbXOWqnU7poYapfnSSd8JuZ0=-fGiumdwA-TumJNuEYg@mail.gmail.com>
<20201219165837.GH28841@momjian.us>
<CAC0GmyymnoQEUTzqi9wCCJdg96SbLja4Tc29Wc+xtRpu9Pv76w@mail.gmail.com>
<20201220225909.GJ16415@tamriel.snowman.net>
<20201221213514.GK28841@momjian.us>
<20201222030748.GN28841@momjian.us>
<20201222154017.GO28841@momjian.us>
<CAC0Gmywn71eLHi7noyHv64m3+W2BdO5bAYs-grZ4VMxBZCHDxw@mail.gmail.com>
On Tue, Dec 22, 2020 at 08:15:27PM +0000, Alastair Turner wrote:
> Hi Bruce
>
> In ckey_passphrase.sh.sample
>
> +
> +echo "$PASS" | sha256sum | cut -d' ' -f1
> +
>
> Under the threat model discussed, a copy of the keyfile could be
> attacked offline. So getting from passphrase to DEKs should be as
> resource intensive as possible to slow down brute-force attempts.
> Instead of just a SHA hash, this should be at least a PBKDF2 (PKCS#5)
I am satisfied with the security of SHA256.
> On Tue, 22 Dec 2020 at 15:40, Bruce Momjian <bruce@momjian.us> wrote:
> >
> > Here is an updated patch. Are people happy with the Makefile, its
> > location in the source tree, and the install directory name? I used the
> > directory name 'auth_commands' because I thought 'auth' was too easily
> > misinterpreted. I put the scripts in /src/backend/utils/auth_commands.
> >
>
> What's implemented in these patches is an internal keystore, wrapped
> with a key derived from a passphrase. I'd think that the scripts
> directory should reflect what they interact with, so
> 'keystore_commands' or 'local_keystore_command' sounds more specific
> and therefore better than 'auth_commands'.
The point is that some commands are used for keystore and some for SSL
certificate passphrase entry, hence "auth".
--
Bruce Momjian <bruce@momjian.us> https://momjian.us
EnterpriseDB https://enterprisedb.com
The usefulness of a cup is in its emptiness, Bruce Lee
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: bruce@momjian.us, minion@decodable.me, sfrost@snowman.net, michael@paquier.xyz, masahiko.sawada@2ndquadrant.com
Subject: Re: Proposed patch for key managment
In-Reply-To: <20201222211306.GA9170@momjian.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox