Date: Mon, 11 Jan 2021 13:23:27 -0500
From: Stephen Frost <sfrost@snowman.net>
To: Bruce Momjian <bruce@momjian.us>
Cc: Masahiko Sawada <sawada.mshk@gmail.com>,
	Thomas Munro <thomas.munro@gmail.com>,
	PostgreSQL-development <pgsql-hackers@postgresql.org>,
	Masahiko Sawada <masahiko.sawada@2ndquadrant.com>
Subject: Re: Key management with tests
Message-ID: <20210111182326.GS27507@tamriel.snowman.net>
References: <20210101060750.GA7432@momjian.us>
 <20210109181736.GB19555@momjian.us>
 <20210110010816.GC19555@momjian.us>
 <20210110024529.GD19555@momjian.us>
 <CA+hUKGL21_sf1gj2oxqGMEMJHxybZ_9v+9auz0_VDaDsUJZ+NQ@mail.gmail.com>
 <20210110145116.GE19555@momjian.us>
 <CAD21AoDOWmNwg4Tqc4JxuXXD0KYkHPhCeG=pHRO3NGDr3tryNQ@mail.gmail.com>
 <20210111172213.GE4320@momjian.us>
 <20210111175449.GR27507@tamriel.snowman.net>
 <20210111180423.GG4320@momjian.us>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="s58dH9ID44isBfhf"
Content-Disposition: inline
In-Reply-To: <20210111180423.GG4320@momjian.us>
User-Agent: Mutt/1.5.24 (2015-08-30)
Precedence: bulk


--s58dH9ID44isBfhf
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Greetings,

* Bruce Momjian (bruce@momjian.us) wrote:
> On Mon, Jan 11, 2021 at 12:54:49PM -0500, Stephen Frost wrote:
> > Although, another approach and one that I've discussed a bit with Bruce,
> > is to have more keys- such as a key for temporary files, and perhaps
> > even a key for logged relations and a different for unlogged..  Or
>=20
> Yes, we have to make sure the nonce (computed as LSN/pageno) is never
> reused, so if we have several LSN usage "spaces", they need different
> data keys.=20

Right, or ensure that the actual IV used is distinct (such as by using
another bit in the IV to distinguish logged-vs-unlogged), but it seems
saner to just use a different key, ultimately.

> > perhaps sets of keys for each which automatically are rotating every X
> > number of GB based on the LSN...  Which is a big part of why key
> > management is such an important part of this effort.
>=20
> Yes, this would avoid the need to failover to a standby for data key
> rotation.

Yes, and it avoids the issue of using a single key for too much, which
is also a concern.  The remaining larger issues are to figure out a
place to put the tag for each page, and the relatively simple matter of
programming a mechanism to cache the keys we're commonly using (current
key for encryption, recently used keys for decryption) since we'll
eventually get to a point of having written out more data than we are
going to keep keys in memory for.

Thanks,

Stephen

--s58dH9ID44isBfhf
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJf/JeeAAoJEO1sijiDR2RV98sQAK0IYe9j+TPTarxaXgwudcc2
yIJaKlINAfbiACJTQXzs7Ld0Jz9Hsv+CtkD9i4V8QoIRdDdKozYYQ00+fbVKCTZH
7W9RkglLHvuNDHzSsHQ3E17tjQqNteRDtgQSCeCh34ymsab/ZV2Fs00FFItlGgn9
4YvgFWdvu1nUhaUMpiLWpKH99w/EifV5+fqEg+rkByKoZHty30YOx4PSQjpCxpU1
/eUdKvBETQ/Gfvp4jBYpn4/ssaZREeYXN6KYrn+tCS3/y/WL/mR2oEKSZY2Ulavv
TsY8bvJwKwpBY86Cuc7WAUQg+/FaW8yXk23+i+VFuMtGMX1MMjZCR6Gpi7cG16Tb
15dWeojTi64aGZV5+Gj9kT1MskLuU5ph2X6VrRqAeRbf4hR55jpzvaac0BBS2faa
xitP14qHiLCiDNqzEyJ02fK3sFcaZ4RnEs0zpYakKihLynHv/pzBHcKhs7hK6Kan
pK4iO3rfRMNKkrlITzuaVlXtYSLJ3YY7SXnxFhiIQHuZ1PsW1Qx5Z09E8nOcHh7B
/3pHHlg0BDwwApYhFyZlcln72aiP7NpnL5Kpxs8xzKIBv4F6uRZB+drB+l/EPAl+
KWssyr+ZCjpodIE6r0ykLzYOkNg60rtpArWwmUha1x/G2bsIkb2H0hGw5JutkCKe
ILdCYV7buNsNBSd1K4UJ
=MYRb
-----END PGP SIGNATURE-----

--s58dH9ID44isBfhf--