Re: [Proposal] Table-level Transparent Data Encryption (TDE) and KeyManagement Service (KMS)
От | Tomas Vondra |
---|---|
Тема | Re: [Proposal] Table-level Transparent Data Encryption (TDE) and KeyManagement Service (KMS) |
Дата | |
Msg-id | 20190617140223.2cfumi5c2gverups@development обсуждение исходный текст |
Ответ на | Re: [Proposal] Table-level Transparent Data Encryption (TDE) and KeyManagement Service (KMS) (Joe Conway <mail@joeconway.com>) |
Ответы |
Re: [Proposal] Table-level Transparent Data Encryption (TDE) and KeyManagement Service (KMS)
|
Список | pgsql-hackers |
On Mon, Jun 17, 2019 at 08:39:27AM -0400, Joe Conway wrote: >On 6/17/19 8:29 AM, Masahiko Sawada wrote: >> From perspective of cryptographic, I think the fine grained TDE would >> be better solution. Therefore if we eventually want the fine grained >> TDE I wonder if it might be better to develop the table/tablespace TDE >> first while keeping it simple as much as possible in v1, and then we >> can provide the functionality to encrypt other data in database >> cluster to satisfy the encrypting-everything requirement. I guess that >> it's easier to incrementally add encryption target objects rather than >> making it fine grained while not changing encryption target objects. >> >> FWIW I'm writing a draft patch of per tablespace TDE and will submit >> it in this month. We can more discuss the complexity of the proposed >> TDE using it. > >+1 > >Looking forward to it. > Yep. In particular, I'm interested in those aspects: (1) What's the proposed minimum viable product, and how do we expect to extend it with the more elaborate features. I don't expect perfect specification, but we should have some idea so that we don't paint ourselves in the corner. (2) How does it affect recovery, backups and replication (both physical and logical)? That is, which other parts need to know the encryption keys to function properly? (3) What does it mean for external tools (pg_waldump, pg_upgrade, pg_rewind etc.)? regards -- Tomas Vondra http://www.2ndQuadrant.com PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services
В списке pgsql-hackers по дате отправления: