Hi, On 2023-11-02 22:09:40 +0100, Matthias van de Meent wrote: > I'm quite surprised at the significant number of changes being made > outside the core storage manager files. I thought that changing out > mdsmgr with an encrypted smgr (that could wrap mdsmgr if so desired) > would be the most obvious change to implement cluster-wide encryption > with the least code touched, as relations don't need to know whether > the files they're writing are encrypted, right? Is there a reason to > not implement this at the smgr level that I overlooked in the > documentation of these patches?
You can't really implement encryption transparently inside an smgr without significant downsides. You need a way to store an initialization vector associated with the page (or you can store that elsewhere, but then you've doubled the worst cse amount of random reads/writes). The patch uses the LSN as the IV (which I doubt is a good idea). For authenticated encryption further additional storage space is required. To be able to to use the LSN as the IV, the patch needs to ensure that the LSN increases in additional situations (a more aggressive version of wal_log_hint_bits) - which can't be done below smgr, where we don't know about what WAL logging was done. Nor can you easily just add space on the page below md.c, for the purpose of storing an LSN independent IV and the authentication data. You could decide that the security that XTS provides is sufficient (XTS could be used without a real IV, with some downsides), but we'd pretty much prevent ourselves from ever implementing authenticated encryption. Greetings, Andres Freund