Date: Sat, 23 Oct 2021 11:29:05 -0400
From: Bruce Momjian <bruce@momjian.us>
To: Stephen Frost <sfrost@snowman.net>
Cc: Tomas Vondra <tomas.vondra@enterprisedb.com>,
	Robert Haas <robertmhaas@gmail.com>,
	Andres Freund <andres@anarazel.de>, Sasasu <i@sasa.su>,
	PostgreSQL-development <pgsql-hackers@postgresql.org>
Subject: Re: XTS cipher mode for cluster file encryption
Message-ID: <20211023152905.GA5989@momjian.us>
References: <57935ba1-a08e-480f-2e27-d8bbfd9bf261@enterprisedb.com>
 <871a349d-fcf6-d58f-1c77-e8510afaf043@enterprisedb.com>
 <20211019184425.GT20998@tamriel.snowman.net>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20211019184425.GT20998@tamriel.snowman.net>
User-Agent: Mutt/1.10.1 (2018-07-13)
Archived-At: 
 <https://www.postgresql.org/message-id/20211023152905.GA5989%40momjian.us>
Precedence: bulk

On Tue, Oct 19, 2021 at 02:44:26PM -0400, Stephen Frost wrote:
> Another threat model to consider is if the attacker has read-only access
> to the data directory through, say, unix group read privileges or maybe
> the ability to monitor the traffic on the SAN, or the ability to
> read-only mount the LUN on to another system.  This might be obtained by
> attacking a backup process where the system was configured to run
> physical backups using an unprivileged OS user who only has group read
> access to the cluster (and the necessary but non-superuser privleges in
> the database system to start/stop the backup), or various potential
> attacks at the storage layer.  This is similar to the "data at rest"
> case above in that XTS works well to address this, but because the
> attacker would have ongoing access (rather than just one-time, such as
> in the first case), information such as which blocks are being changed
> inside of a given 8k page might be able to be determined and that could
> be useful information, though a point here: they would already be able
> to see clearly which 8k pages are being changed and which aren't, and
> there's not really any way for us to prevent that reasonably.  As such,
> I'd argue that using XTS is reasonable and we can mitigate some of this
> concern by using the LSN in the tweak instead of just the block number
> as the 'plain64' option in dmcrypt does.  That doing so would mean that

That is an excellent point, and something we should mention in our
documentation --- the fact that a change of 8k granularity will be
visible, and in certain specified cases, 16-byte change granularity will
also be visible.

-- 
  Bruce Momjian  <bruce@momjian.us>        https://momjian.us
  EDB                                      https://enterprisedb.com

  If only the physical world exists, free will is an illusion.