pg.ddx.io pgsql-sql@postgresql.org mailing list archive
help / color / mirror / Atom feedPGCrypto: Realworld scenario and advice needed
3+ messages / 2 participants
[nested] [flat]
* PGCrypto: Realworld scenario and advice needed
@ 2005-04-11 21:18 Moran.Michael <Michael.Moran@IGT.com>
0 siblings, 1 reply; 3+ messages in thread
From: Moran.Michael @ 2005-04-11 21:18 UTC (permalink / raw)
To: pgsql-sql
Hello all,
I'm looking for advice on real-world PGCrypto usage.
I understand how to programmatically encrypt/decrypt data with PGCrypto --
no problem.
My question is:
What is the best way to update massive amounts of *existing* encrypted data
with a new encryption passphrase, assuming you know the old passphrase?
For example:
Let's say that periodically there must be a one-time change of the
encryption passphrase and ALL existing encrypted data has to be encrypted
with the new passphrase.
My initial attack plan was to do the following:
1. Call decrypt() with the old-passphrase to decrypt each table's existing
data.
2. Temporarily store the decrypted data in temp tables.
3. Delete all rows of encrypted data from the original tables -- thereby
clearing the tables of all data encrypted with the old passphrase.
4. Call encrypt() with the new passphrase to encrypt all data in the temp
tables -- thereby repopulating the production tables with data encrypted
with the new passphrase.
5. Blow away the temp tables.
But this seems like a tedious procedure.
Is there any simple way to update ALL existing encrypted data with a new
passphrase, assuming you know the old passphrase and encryption type (i.e.
AES, Blowfish, etc.) without having to go through the 5-step process
mentioned above?
Thank you and best regards,
Michael Moran
^ permalink raw reply [nested|flat] 3+ messages in thread
* Re: PGCrypto: Realworld scenario and advice needed
@ 2005-04-11 22:26 Joe Conway <mail@joeconway.com>
parent: Moran.Michael <Michael.Moran@IGT.com>
0 siblings, 0 replies; 3+ messages in thread
From: Joe Conway @ 2005-04-11 22:26 UTC (permalink / raw)
To: Moran.Michael <Michael.Moran@IGT.com>; +Cc: pgsql-sql
Moran.Michael wrote:
> My initial attack plan was to do the following:
>
> 1. Call decrypt() with the old-passphrase to decrypt each table's existing
> data.
> 2. Temporarily store the decrypted data in temp tables.
> 3. Delete all rows of encrypted data from the original tables -- thereby
> clearing the tables of all data encrypted with the old passphrase.
> 4. Call encrypt() with the new passphrase to encrypt all data in the temp
> tables -- thereby repopulating the production tables with data encrypted
> with the new passphrase.
> 5. Blow away the temp tables.
>
> But this seems like a tedious procedure.
>
> Is there any simple way to update ALL existing encrypted data with a new
> passphrase, assuming you know the old passphrase and encryption type (i.e.
> AES, Blowfish, etc.) without having to go through the 5-step process
> mentioned above?
Why not use a single UPDATE command, e.g. something like:
UPDATE tbl
SET f1 = encrypt(decrypt(f1, 'oldkey', 'aes'), 'newkey', 'aes');
Joe
^ permalink raw reply [nested|flat] 3+ messages in thread
* Re: PGCrypto: Realworld scenario and advice needed
@ 2005-04-14 17:36 Moran.Michael <Michael.Moran@IGT.com>
0 siblings, 0 replies; 3+ messages in thread
From: Moran.Michael @ 2005-04-14 17:36 UTC (permalink / raw)
To: Joe Conway <mail@joeconway.com>; +Cc: pgsql-sql
Thank you, Joe.
Your solution provided below works great. Much better/simpler than my
original approach. You rock!
-Michael
_____
From: Joe Conway [mailto:mail@joeconway.com]
Sent: Mon 4/11/2005 3:26 PM
To: Moran.Michael
Cc: PostgreSQL
Subject: Re: [SQL] PGCrypto: Realworld scenario and advice needed
Moran.Michael wrote:
> My initial attack plan was to do the following:
>
> 1. Call decrypt() with the old-passphrase to decrypt each table's existing
> data.
> 2. Temporarily store the decrypted data in temp tables.
> 3. Delete all rows of encrypted data from the original tables -- thereby
> clearing the tables of all data encrypted with the old passphrase.
> 4. Call encrypt() with the new passphrase to encrypt all data in the temp
> tables -- thereby repopulating the production tables with data encrypted
> with the new passphrase.
> 5. Blow away the temp tables.
>
> But this seems like a tedious procedure.
>
> Is there any simple way to update ALL existing encrypted data with a new
> passphrase, assuming you know the old passphrase and encryption type (i.e.
> AES, Blowfish, etc.) without having to go through the 5-step process
> mentioned above?
Why not use a single UPDATE command, e.g. something like:
UPDATE tbl
SET f1 = encrypt(decrypt(f1, 'oldkey', 'aes'), 'newkey', 'aes');
Joe
^ permalink raw reply [nested|flat] 3+ messages in thread
end of thread, other threads:[~2005-04-14 17:36 UTC | newest]
Thread overview: 3+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2005-04-11 21:18 PGCrypto: Realworld scenario and advice needed Moran.Michael <Michael.Moran@IGT.com>
2005-04-11 22:26 ` Joe Conway <mail@joeconway.com>
2005-04-14 17:36 Re: PGCrypto: Realworld scenario and advice needed Moran.Michael <Michael.Moran@IGT.com>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox