On Fri, 20 Mar 2020 at 01:38, Bruce Momjian <br...@momjian.us> wrote: > > On Fri, Mar 20, 2020 at 12:50:27AM +0900, Masahiko Sawada wrote: > > On Fri, Mar 20, 2020 at 0:35 Bruce Momjian <br...@momjian.us> wrote: > > Well, the issue is if the user can control the user key, there is might > > be > > a way to make the user key do nothing. > > > > Well I meant ‘USER_KEY:’ is a fixed length string for the key used for wrap > > and > > unwrap SQL interface functions. So user cannot control it. We will have > > another > > key derived by, for example, HKDF(MK, ‘TDE_KEY:’ || system_identifier) for > > block encryption. > > OK, yes, something liek that might make sense. >
Attached the updated version patch. The patch introduces KDF to derive a new key from the master encryption key. We use the derived key for pg_wrap and pg_unwrap SQL functions, instead of directly using the master encryption key. In the future, we will be able to have a separate derived keys for block encryption. As a result of using KDF, the minimum version of OpenSSL when enabling key management is 1.1.0. Regards, -- Masahiko Sawada http://www.2ndQuadrant.com/ PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services
kms_v7.patch
Description: Binary data
