Horton

Add key management system

Bruce Momjian <bruce@momjian.us>

View on postgr.es
Commit: 978f869b992f9fca343e99d6fdb71073c76e869a
Author: Bruce Momjian <bruce@momjian.us>
Date: 2020-12-25T15:19:44Z
Releases: 14.0 
Add key management system

This adds a key management system that stores (currently) two data
encryption keys of length 128, 192, or 256 bits.  The data keys are
AES256 encrypted using a key encryption key, and validated via GCM
cipher mode.  A command to obtain the key encryption key must be
specified at initdb time, and will be run at every database server
start.  New parameters allow a file descriptor open to the terminal to
be passed.  pg_upgrade support has also been added.

Discussion: https://postgr.es/m/CA+fd4k7q5o6Nc_AaX6BcYM9yqTbC6_pnH-6nSD=54Zp6NBQTCQ@mail.gmail.com
Discussion: https://postgr.es/m/20201202213814.GG20285@momjian.us

Author: Masahiko Sawada, me, Stephen Frost

Files

PathChange+/−
doc/src/sgml/config.sgml modified +62 −0
doc/src/sgml/database-encryption.sgml added +97 −0
doc/src/sgml/filelist.sgml modified +1 −0
doc/src/sgml/installation.sgml modified +3 −2
doc/src/sgml/postgres.sgml modified +1 −0
doc/src/sgml/ref/initdb.sgml modified +46 −0
doc/src/sgml/ref/pg_ctl-ref.sgml modified +13 −0
doc/src/sgml/ref/pgupgrade.sgml modified +17 −1
doc/src/sgml/ref/postgres-ref.sgml modified +13 −0
doc/src/sgml/storage.sgml modified +5 −0
src/backend/access/transam/xlog.c modified +21 −0
src/backend/bootstrap/bootstrap.c modified +20 −1
src/backend/crypto/kmgr.c added +372 −0
src/backend/crypto/Makefile added +18 −0
src/backend/main/main.c modified +3 −0
src/backend/Makefile modified +1 −1
src/backend/postmaster/pgstat.c modified +9 −0
src/backend/postmaster/postmaster.c modified +12 −1
src/backend/replication/basebackup.c modified +5 −0
src/backend/storage/ipc/ipci.c modified +3 −0
src/backend/storage/lmgr/lwlocknames.txt modified +1 −0
src/backend/tcop/postgres.c modified +24 −1
src/backend/utils/misc/guc.c modified +24 −0
src/backend/utils/misc/pg_controldata.c modified +8 −3
src/backend/utils/misc/postgresql.conf.sample modified +5 −0
src/bin/initdb/initdb.c modified +108 −8
src/bin/pg_controldata/pg_controldata.c modified +3 −0
src/bin/pg_ctl/pg_ctl.c modified +49 −10
src/bin/pg_resetwal/pg_resetwal.c modified +2 −0
src/bin/pg_rewind/filemap.c modified +8 −0
src/bin/pg_upgrade/check.c modified +34 −0
src/bin/pg_upgrade/controldata.c modified +41 −1
src/bin/pg_upgrade/file.c modified +2 −0
src/bin/pg_upgrade/option.c modified +6 −1
src/bin/pg_upgrade/pg_upgrade.h modified +3 −0
src/bin/pg_upgrade/server.c modified +3 −2
src/common/cipher.c added +67 −0
src/common/cipher_openssl.c added +268 −0
src/common/kmgr_utils.c added +507 −0
src/common/Makefile modified +3 −0
src/include/catalog/pg_control.h modified +4 −1
src/include/common/cipher.h added +62 −0
src/include/common/kmgr_utils.h added +98 −0
src/include/crypto/kmgr.h added +29 −0
src/include/pgstat.h modified +3 −0
src/include/postmaster/postmaster.h modified +2 −0
src/include/utils/guc_tables.h modified +1 −0
src/test/Makefile modified +1 −1
src/tools/msvc/Mkvcbuild.pm modified +3 −1

Documentation touched