From: | Masahiko Sawada <masahiko(dot)sawada(at)2ndquadrant(dot)com> |
---|---|
To: | Bruce Momjian <bruce(at)momjian(dot)us> |
Cc: | Cary Huang <cary(dot)huang(at)highgo(dot)ca>, Fabien COELHO <coelho(at)cri(dot)ensmp(dot)fr>, Ibrar Ahmed <ibrar(dot)ahmad(at)gmail(dot)com>, Joe Conway <mail(at)joeconway(dot)com>, "Moon, Insung" <tsukiwamoon(dot)pgsql(at)gmail(dot)com>, PostgreSQL Hackers <pgsql-hackers(at)lists(dot)postgresql(dot)org>, Robert Haas <robertmhaas(at)gmail(dot)com>, Sehrope Sarkuni <sehrope(at)jackdb(dot)com>, cary huang <hcary328(at)gmail(dot)com> |
Subject: | Re: Internal key management system |
Date: | 2020-03-20 06:17:47 |
Message-ID: | CA+fd4k4_WskiiHxHbDqMtoTeXzzK-g9b0DjfLx5-pc=3=KoFvQ@mail.gmail.com |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgsql-hackers |
On Fri, 20 Mar 2020 at 01:38, Bruce Momjian <bruce(at)momjian(dot)us> wrote:
>
> On Fri, Mar 20, 2020 at 12:50:27AM +0900, Masahiko Sawada wrote:
> > On Fri, Mar 20, 2020 at 0:35 Bruce Momjian <bruce(at)momjian(dot)us> wrote:
> > Well, the issue is if the user can control the user key, there is might be
> > a way to make the user key do nothing.
> >
> > Well I meant ‘USER_KEY:’ is a fixed length string for the key used for wrap and
> > unwrap SQL interface functions. So user cannot control it. We will have another
> > key derived by, for example, HKDF(MK, ‘TDE_KEY:’ || system_identifier) for
> > block encryption.
>
> OK, yes, something liek that might make sense.
>
Attached the updated version patch. The patch introduces KDF to derive
a new key from the master encryption key. We use the derived key for
pg_wrap and pg_unwrap SQL functions, instead of directly using the
master encryption key. In the future, we will be able to have a
separate derived keys for block encryption. As a result of using KDF,
the minimum version of OpenSSL when enabling key management is 1.1.0.
Regards,
--
Masahiko Sawada http://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services
Attachment | Content-Type | Size |
---|---|---|
kms_v7.patch | application/octet-stream | 78.1 KB |
From | Date | Subject | |
---|---|---|---|
Next Message | Andres Freund | 2020-03-20 06:20:31 | Re: Berserk Autovacuum (let's save next Mandrill) |
Previous Message | Laurenz Albe | 2020-03-20 06:17:40 | Re: Berserk Autovacuum (let's save next Mandrill) |