Date: Thu, 31 Dec 2020 09:18:05 -0500
From: Stephen Frost <sfrost@snowman.net>
To: Bruce Momjian <bruce@momjian.us>
Cc: Fabien COELHO <coelho@cri.ensmp.fr>,
	Alastair Turner <minion@decodable.me>,
	Michael Paquier <michael@paquier.xyz>,
	PostgreSQL-development <pgsql-hackers@postgresql.org>,
	Masahiko Sawada <masahiko.sawada@2ndquadrant.com>
Subject: Re: Proposed patch for key managment
Message-ID: <20201231141805.GJ27507@tamriel.snowman.net>
References: <20201216213200.GS16415@tamriel.snowman.net>
 <CAC0Gmyz9w7Axezsu66GVme3u+cR4OmqH5f-nCYNo6-cyxyA3pA@mail.gmail.com>
 <20201216224331.GV16415@tamriel.snowman.net>
 <CAC0GmyyVHstcMefpbCqXC25_Xg4V=Dy-q1ps1a06j9xUOL0SzQ@mail.gmail.com>
 <20201218213624.GG16415@tamriel.snowman.net>
 <CAC0GmyzJNXRZ5MQJYq24EiUarP+xN9Q19_cknkHmmYU=CTzHrQ@mail.gmail.com>
 <20201227172526.GB17037@momjian.us>
 <alpine.DEB.2.22.394.2012281736570.2094581@pseudo>
 <20201230234933.GI27507@tamriel.snowman.net>
 <20201231013536.GD22199@momjian.us>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="74hf9PSALuoWtOh/"
Content-Disposition: inline
In-Reply-To: <20201231013536.GD22199@momjian.us>
User-Agent: Mutt/1.5.24 (2015-08-30)
Precedence: bulk


--74hf9PSALuoWtOh/
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Greetings,

* Bruce Momjian (bruce@momjian.us) wrote:
> On Wed, Dec 30, 2020 at 06:49:34PM -0500, Stephen Frost wrote:
> > The API to fetch the KEK doesn't care at all about where it's stored or
> > how it's derived or anything like that.  There's a relatively small
> > change which could be made to have PG request all of the keys that it'll
> > need on startup, if we want to go there as has been suggested elsewhere,
> > but even if we do that, PG needs to be able to do that itself too,
> > otherwise it's not a complete capability and there seems little point in
> > doing something that's just a pass-thru to something else and isn't able
> > to really be used.
>=20
> Right now, the script returns a cluster key (KEK), and during initdb the
> server generates data encryption keys and wraps them with the KEK.=20
> During server start, the server validates the KEK and decrypts the data
> keys.  pg_alterckey allows changing the KEK.

Right- all of those are really necessary things for PG to have a useful
implementation.

> I think Fabien is saying this all should _only_ be done using external
> tools --- that's what I don't agree with.

I also don't agree that everything should be external.  We effectively
have that today and it certainly doesn't get us any closer to having a
solution in PG, a point which we are frequently pointed to as a reason
why certain, entirely reasonable, use-cases can't be satisfied with PG.

Thanks,

Stephen

--74hf9PSALuoWtOh/
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJf7d2cAAoJEO1sijiDR2RVS9kP/iNglyU+FCJqc1l8HjeQtmH4
azqFPEL5jviIorlJkW8JcJ2fx66H8UZYwBmS982evappKRD5H71cM13OkabwUmFr
6TQNnftzy7SlbMmaAANX0HnofkcBJ/WoNWgxNA7KaASzYVCT4rlMvTTlo5END3wn
fEYlx2yyMRcRHzUjcTvjsZVWybcY1Y8AUJduZsvNK4e+0Rpn/DTxJO3OOYYIFWbk
2vDmsdyuFybnDPUAV6dsjxVjVDrtDOg6u5U5wN/i8ZIj2t3vohBgOhPHPmzmFc16
OQMrSk+JgzYmIW6CDAvey57ezdJrrFMEpWEMQDpahD0FRmqRK4qUrx/PI+DahClZ
icXTpWYy7vFqEfbiSmrRKXUA5CMm6IHcBuLa+ay0jIthnSsGzx1ttw3Utibk/oWv
VGiV7DR9irQ+Up1ArrRBTE81dP28Vw9eYf/ZYKIB2c0quz+y/kk4ndfzLENxlkRv
BPrmREigGcrZJ9TGn3TUDRXBHJZwnikZfxpeF7/Dpn2ZHIMQo6YoaKckgVTSK8PT
kCqJPhQUgItk9rQCZt+xmjHXpfVok73yxh2weHB3w6FXV9eawzx21zPjJDFxJNj0
i/j/3XIHm9hMYNt5Re7SCKhYzDe0XR/nMZL7OvTE1UVMrU9tlPnms7ZBV5Zm18Gi
/38LJmfTjor0/ur8R8o8
=fCk+
-----END PGP SIGNATURE-----

--74hf9PSALuoWtOh/--