From: | Bruce Momjian <bruce(at)momjian(dot)us> |
---|---|
To: | Stephen Frost <sfrost(at)snowman(dot)net> |
Cc: | Alastair Turner <minion(at)decodable(dot)me>, Michael Paquier <michael(at)paquier(dot)xyz>, PostgreSQL-development <pgsql-hackers(at)postgresql(dot)org>, Masahiko Sawada <masahiko(dot)sawada(at)2ndquadrant(dot)com> |
Subject: | Re: Proposed patch for key managment |
Date: | 2020-12-21 21:35:14 |
Message-ID: | 20201221213514.GK28841@momjian.us |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgsql-hackers |
On Sun, Dec 20, 2020 at 05:59:09PM -0500, Stephen Frost wrote:
> However, after chatting with Bruce about it for a bit this weekend, I'm
> not sure that we need to tackle the second case today. I don't think
> there's any doubt that there will be users who will want PG to manage
> the keyring and to be able to work with just a passphrase, as Bruce has
> worked to make happen here and which we have a patch for. I'm hoping
> Bruce will post a new patch soon based on the work that he and I
> discussed today (mostly just clarifications around keys vs. passphrases
> and having the PG side accept a key which the command that's run will
> produce). With that, I'm feeling pretty comfortable that we can move
> forward and at least get this initial work committed.
OK, here it the updated patch. The major change, as Stephen pointed
out, is that the cluser_key_command (was cluster_passphrase_command) now
returns a hex-string representing the 32-byte KEK, rather than having
the server hash whatever the command used to return. This avoids
double-hashing in cases where you are _not_ using a passphrase, but are
computing a random 32-byte value in the script. This does mean the
script has to run sha256 for passphrases, but it seems like a win.
Updated script are attached too.
The URLs are still accurate:
https://github.com/postgres/postgres/compare/master...bmomjian:key.diff
https://github.com/bmomjian/postgres/compare/key...bmomjian:key-alter.diff
--
Bruce Momjian <bruce(at)momjian(dot)us> https://momjian.us
EnterpriseDB https://enterprisedb.com
The usefulness of a cup is in its emptiness, Bruce Lee
Attachment | Content-Type | Size |
---|---|---|
key.diff.gz | application/gzip | 30.3 KB |
key-alter.diff.gz | application/gzip | 7.1 KB |
ckey_aws.sh | application/x-sh | 1.4 KB |
ckey_direct.sh | application/x-sh | 917 bytes |
ckey_passphrase.sh | application/x-sh | 656 bytes |
ckey_piv_nopin.sh | application/x-sh | 2.1 KB |
ckey_piv_pin.sh | application/x-sh | 2.1 KB |
From | Date | Subject | |
---|---|---|---|
Next Message | Tom Lane | 2020-12-21 21:43:33 | Better client reporting for "immediate stop" shutdowns |
Previous Message | Thomas Munro | 2020-12-21 21:31:04 | Re: pg_preadv() and pg_pwritev() |