Re: Key management with tests

Bruce Momjian <bruce@momjian.us>

From: Bruce Momjian <bruce@momjian.us>

To: Masahiko Sawada <sawada.mshk@gmail.com>

Cc: Stephen Frost <sfrost@snowman.net>, Thomas Munro <thomas.munro@gmail.com>, PostgreSQL-development <pgsql-hackers@postgresql.org>, Masahiko Sawada <masahiko.sawada@2ndquadrant.com>

Date: 2021-01-12T02:09:47Z

Lists: pgsql-hackers

Commits

Same data as JSON: GET /api/v1/messages/:b64id/commits the thread's linked commits as JSON, with link sources. API reference →

Rethink method for assigning OIDs to the template0 and postgres DBs.
- 2cb1272445d2 15.0 landed
pg_upgrade: Preserve database OIDs.
- aa01051418f1 15.0 landed
pg_upgrade: Preserve relfilenodes and tablespace OIDs.
- 9a974cbcba00 15.0 landed
Fix for new Boolean node
- cf925936ecc0 15.0 cited
Improve error handling of HMAC computations
- 5513dc6a304d 15.0 cited
Add macro RelationIsPermanent() to report relation permanence
- 95d77149c535 14.0 landed
Enhance nbtree index tuple deletion.
- d168b666823b 14.0 cited

On Tue, Jan 12, 2021 at 09:32:54AM +0900, Masahiko Sawada wrote:
> On Tue, Jan 12, 2021 at 3:23 AM Stephen Frost <sfrost@snowman.net> wrote:
> > Right, or ensure that the actual IV used is distinct (such as by using
> > another bit in the IV to distinguish logged-vs-unlogged), but it seems
> > saner to just use a different key, ultimately.
> 
> Agreed.
> 
> I think we also need to consider how to make sure nonce is unique when
> making a page dirty by updating hint bits. Hint bit update changes the
> page contents but doesn't change the page lsn if we already write a
> full page write. In the PoC patch, I logged a dummy WAL record
> (XLOG_NOOP) just to move the page lsn forward, but since this is
> required even when changing the page is not the first time since the
> last checkpoint we might end up logging too many dummy WAL records.

This says:

	https://wiki.postgresql.org/wiki/Transparent_Data_Encryption#Other_requirements

	wal_log_hints will be enabled automatically in encryption mode. 

Does that help?

-- 
  Bruce Momjian  <bruce@momjian.us>        https://momjian.us
  EnterpriseDB                             https://enterprisedb.com

  The usefulness of a cup is in its emptiness, Bruce Lee