On Tue, May 25, 2021 at 05:04:50PM -0400, Stephen Frost wrote: > > Now, if we want to consult some security experts and have them tell us > > the hint bit visibility is not a problem, we could get by without using a > > new nonce for hint bit changes, and in that case it doesn't matter if we > > have a separate LSN or custom nonce --- it doesn't get changed for hint > > bit changes. > > I do think it's reasonable to consider having hint bits not included in > the encrypted part of the page and therefore remove the need to produce > a new nonce for each hint bit change. Naturally, there's always an > increased risk when any data in the system isn't encrypted but given > the other parts of the system which aren't being encrypted as part of > this effort it hardly seems like a significant increase of overall risk. > I don't believe that any of the auditors and security teams I've > discussed TDE with would have issue with hint bits not being encrypted- > the principle concern has always been the primary data.
OK, this is good to know. I know the never-reuse rule, so it is good to know it can be relaxed for certain data without causing problems in other places. Should I modify my patch to do this? FYI, technically, the hint bit is still encrypted, but could _flip_ in the encrypted file if changed, so that's why we say it is visible. If we used a block cipher instead of a streaming one (CTR), this might not work because the earlier blocks can be based in the output of later blocks. > Naturally, the more we are able to encrypt and the more we can do to > provide data integrity validation, may open up the possibility for PG to > be used in even more places, which argues for having some way of making > these choices be options which a user could decide at initdb time, or at > least contemplating a road map to where we could offer users the option > to have other parts of the system be encrypted and ideally have data > integrity checks, but I don't think we necessarily have to solve > everything right now in that regard- just having TDE in some form will > open up quite a few new possibilities for v15, even if it doesn't > include data integrity validation beyond our existing checksums and > doesn't encrypt hint bits. I am thinking full-file system encryption should still be used by people needing that. I am concerned that if we add too many restrictions/additions on this feature, it will not be very useful. -- Bruce Momjian <br...@momjian.us> https://momjian.us EDB https://enterprisedb.com If only the physical world exists, free will is an illusion.
