From: Stephen Frost <sfrost@snowman.net>
To: Bruce Momjian <bruce@momjian.us>
Cc: Masahiko Sawada <sawada.mshk@gmail.com>
Cc: Thomas Munro <thomas.munro@gmail.com>
Cc: PostgreSQL-development <pgsql-hackers@postgresql.org>
Cc: Masahiko Sawada <masahiko.sawada@2ndquadrant.com>
Subject: Re: Key management with tests
Date: Mon, 11 Jan 2021 13:23:27 -0500
Message-ID: <20210111182326.GS27507@tamriel.snowman.net> (raw)
In-Reply-To: <20210111180423.GG4320@momjian.us>
References: <20210101060750.GA7432@momjian.us>
<20210109181736.GB19555@momjian.us>
<20210110010816.GC19555@momjian.us>
<20210110024529.GD19555@momjian.us>
<CA+hUKGL21_sf1gj2oxqGMEMJHxybZ_9v+9auz0_VDaDsUJZ+NQ@mail.gmail.com>
<20210110145116.GE19555@momjian.us>
<CAD21AoDOWmNwg4Tqc4JxuXXD0KYkHPhCeG=pHRO3NGDr3tryNQ@mail.gmail.com>
<20210111172213.GE4320@momjian.us>
<20210111175449.GR27507@tamriel.snowman.net>
<20210111180423.GG4320@momjian.us>
Greetings,
* Bruce Momjian (bruce@momjian.us) wrote:
> On Mon, Jan 11, 2021 at 12:54:49PM -0500, Stephen Frost wrote:
> > Although, another approach and one that I've discussed a bit with Bruce,
> > is to have more keys- such as a key for temporary files, and perhaps
> > even a key for logged relations and a different for unlogged.. Or
>
> Yes, we have to make sure the nonce (computed as LSN/pageno) is never
> reused, so if we have several LSN usage "spaces", they need different
> data keys.
Right, or ensure that the actual IV used is distinct (such as by using
another bit in the IV to distinguish logged-vs-unlogged), but it seems
saner to just use a different key, ultimately.
> > perhaps sets of keys for each which automatically are rotating every X
> > number of GB based on the LSN... Which is a big part of why key
> > management is such an important part of this effort.
>
> Yes, this would avoid the need to failover to a standby for data key
> rotation.
Yes, and it avoids the issue of using a single key for too much, which
is also a concern. The remaining larger issues are to figure out a
place to put the tag for each page, and the relatively simple matter of
programming a mechanism to cache the keys we're commonly using (current
key for encryption, recently used keys for decryption) since we'll
eventually get to a point of having written out more data than we are
going to keep keys in memory for.
Thanks,
Stephen
Attachments:
signature.asc (application/pgp-signature, 818B) download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: sfrost@snowman.net, bruce@momjian.us, sawada.mshk@gmail.com, thomas.munro@gmail.com, masahiko.sawada@2ndquadrant.com
Subject: Re: Key management with tests
In-Reply-To: <20210111182326.GS27507@tamriel.snowman.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox