pg.ddx.io  pgsql-hackers@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Bruce Momjian <bruce@momjian.us>
To: Stephen Frost <sfrost@snowman.net>
Cc: Fabien COELHO <coelho@cri.ensmp.fr>
Cc: Alastair Turner <minion@decodable.me>
Cc: Michael Paquier <michael@paquier.xyz>
Cc: PostgreSQL-development <pgsql-hackers@postgresql.org>
Cc: Masahiko Sawada <masahiko.sawada@2ndquadrant.com>
Subject: Re: Proposed patch for key managment
Date: Wed, 30 Dec 2020 20:35:36 -0500
Message-ID: <20201231013536.GD22199@momjian.us> (raw)
In-Reply-To: <20201230234933.GI27507@tamriel.snowman.net>
References: <CAC0Gmyy7QCvh4ey-e_XXYCHDEmaKKoeaagAFuAmhF=tS0DU4-A@mail.gmail.com>
	<20201216213200.GS16415@tamriel.snowman.net>
	<CAC0Gmyz9w7Axezsu66GVme3u+cR4OmqH5f-nCYNo6-cyxyA3pA@mail.gmail.com>
	<20201216224331.GV16415@tamriel.snowman.net>
	<CAC0GmyyVHstcMefpbCqXC25_Xg4V=Dy-q1ps1a06j9xUOL0SzQ@mail.gmail.com>
	<20201218213624.GG16415@tamriel.snowman.net>
	<CAC0GmyzJNXRZ5MQJYq24EiUarP+xN9Q19_cknkHmmYU=CTzHrQ@mail.gmail.com>
	<20201227172526.GB17037@momjian.us>
	<alpine.DEB.2.22.394.2012281736570.2094581@pseudo>
	<20201230234933.GI27507@tamriel.snowman.net>

On Wed, Dec 30, 2020 at 06:49:34PM -0500, Stephen Frost wrote:
> The API to fetch the KEK doesn't care at all about where it's stored or
> how it's derived or anything like that.  There's a relatively small
> change which could be made to have PG request all of the keys that it'll
> need on startup, if we want to go there as has been suggested elsewhere,
> but even if we do that, PG needs to be able to do that itself too,
> otherwise it's not a complete capability and there seems little point in
> doing something that's just a pass-thru to something else and isn't able
> to really be used.

Right now, the script returns a cluster key (KEK), and during initdb the
server generates data encryption keys and wraps them with the KEK. 
During server start, the server validates the KEK and decrypts the data
keys.  pg_alterckey allows changing the KEK.

I think Fabien is saying this all should _only_ be done using external
tools --- that's what I don't agree with.

-- 
  Bruce Momjian  <bruce@momjian.us>        https://momjian.us
  EnterpriseDB                             https://enterprisedb.com

  The usefulness of a cup is in its emptiness, Bruce Lee






view thread (93+ messages)  latest in thread

Message-ID: <20201231013536.GD22199@momjian.us>
Permalink:  ../20201231013536.GD22199@momjian.us/
Also on:    postgresql.org/message-id/20201231013536.GD22199@momjian.us

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-hackers@postgresql.org
  Cc: bruce@momjian.us, sfrost@snowman.net, coelho@cri.ensmp.fr, minion@decodable.me, michael@paquier.xyz, masahiko.sawada@2ndquadrant.com
  Subject: Re: Proposed patch for key managment
  In-Reply-To: <20201231013536.GD22199@momjian.us>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox