From: Antonin Houska <ah@cybertec.at>
To: Alvaro Herrera <alvherre@2ndquadrant.com>
cc: Shawn Wang <shawn.wang@highgo.ca>,
    pgsql-hackers@lists.postgresql.org, Ants Aasma <ants.aasma@eesti.ee>
Subject: Re: WIP: Data at rest encryption
In-reply-to: <20190903165615.GA16727@alvherre.pgsql>
References: <20190903165615.GA16727@alvherre.pgsql>
Comments: In-reply-to Alvaro Herrera <alvherre@2ndquadrant.com>
   message dated "Tue, 03 Sep 2019 12:56:15 -0400."
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <64820.1567572978.1@antos>
Content-Transfer-Encoding: quoted-printable
Date: Wed, 04 Sep 2019 06:56:18 +0200
Message-ID: <64821.1567572978@antos>
Precedence: bulk

Alvaro Herrera <alvherre@2ndquadrant.com> wrote:

> On 2019-Aug-02, Shawn Wang wrote:
> =

> > Hi Antonin,
> > It is very glad to see the new patch. I used the public patches a long=
 time ago.
> > I did some tests like the stream replication, much data running, tempo=
rary files encryption.
> > I found that there is an issue in the src/backend/storage/file/encrypt=
ion.c. You should put block_size =3D EVP_CIPHER_CTX_block_size(ctx); under=
 the #ifdef USE_ASSERT_CHECKING.
> > There is some problem to merge your patches to the latest kernel in th=
e pg_ctl.c.
> =

> Is a new, fixed version going to be posted soon?  It's been a while.
> =

> Also, apologies if this has been asked before, but: how does this patch
> relate to the stuff being discussed in
> https://postgr.es/m/031401d3f41d$5c70ed90$1552c8b0$@lab.ntt.co.jp ?

This thread started later than our effort but important design questions a=
re
being discussed there. So far there seems to be no consensus whether
full-instance encryption should be implemented first, so any effort spent =
on
this patch might get wasted. When/if there will be an agreement on the des=
ign,
we'll see how much of this patch can be used.

-- =

Antonin Houska
Web: https://www.cybertec-postgresql.com