Re: XTS cipher mode for cluster file encryption

From: Bruce Momjian <bruce(at)momjian(dot)us>
To: Stephen Frost <sfrost(at)snowman(dot)net>
Cc: Tomas Vondra <tomas(dot)vondra(at)enterprisedb(dot)com>, Robert Haas <robertmhaas(at)gmail(dot)com>, Andres Freund <andres(at)anarazel(dot)de>, Sasasu <i(at)sasa(dot)su>, PostgreSQL-development <pgsql-hackers(at)postgresql(dot)org>
Subject: Re: XTS cipher mode for cluster file encryption
Date: 2021-10-23 15:29:05
Views: Raw Message | Whole Thread | Download mbox | Resend email
Lists: pgsql-hackers

On Tue, Oct 19, 2021 at 02:44:26PM -0400, Stephen Frost wrote:
> Another threat model to consider is if the attacker has read-only access
> to the data directory through, say, unix group read privileges or maybe
> the ability to monitor the traffic on the SAN, or the ability to
> read-only mount the LUN on to another system. This might be obtained by
> attacking a backup process where the system was configured to run
> physical backups using an unprivileged OS user who only has group read
> access to the cluster (and the necessary but non-superuser privleges in
> the database system to start/stop the backup), or various potential
> attacks at the storage layer. This is similar to the "data at rest"
> case above in that XTS works well to address this, but because the
> attacker would have ongoing access (rather than just one-time, such as
> in the first case), information such as which blocks are being changed
> inside of a given 8k page might be able to be determined and that could
> be useful information, though a point here: they would already be able
> to see clearly which 8k pages are being changed and which aren't, and
> there's not really any way for us to prevent that reasonably. As such,
> I'd argue that using XTS is reasonable and we can mitigate some of this
> concern by using the LSN in the tweak instead of just the block number
> as the 'plain64' option in dmcrypt does. That doing so would mean that

That is an excellent point, and something we should mention in our
documentation --- the fact that a change of 8k granularity will be
visible, and in certain specified cases, 16-byte change granularity will
also be visible.

Bruce Momjian <bruce(at)momjian(dot)us>

If only the physical world exists, free will is an illusion.

In response to

Browse pgsql-hackers by date

  From Date Subject
Next Message Mikhail 2021-10-23 15:40:44 Re: [PATCH] Make ENOSPC not fatal in semaphore creation
Previous Message Michael Paquier 2021-10-23 07:44:00 Re: pg_receivewal starting position