On 06/18/2018 10:26 AM, Robert Haas wrote: > On Mon, Jun 18, 2018 at 10:12 AM, Joe Conway <m...@joeconway.com> wrote: >> Not necessarily. Our pages probably have enough predictable bytes to aid >> cryptanalysis, compared to user data in a column which might not be very >> predicable. > > Really? I would guess that the amount of entropy in a page is WAY > higher than in an individual column value.
It isn't about the entropy of the page overall, it is about the predictability of specific bytes at specific locations on the pages. At least as far as I understand it. >> But in any case most encryption schemes use a random nonce (salt) to >> ensure two identical strings do not encrypt to the same result. And >> often the encrypted length is padded, so while you might be able to >> infer short versus long, you would not usually be able to infer the >> exact plaintext length. > > Sure, that could be done, although it means that equality comparisons > must be done unencrypted. Sure. Typically equality comparisons are done on other unencrypted attributes. Or if you need to do equality on encrypted columns, you can store non-reversible cryptographic hashes in a separate column. >> Again completely dependent on the extension you use to do the encryption >> for the input policy. The keys don't need to be stored with the data, >> and the decryption can be transparent only for certain users or if >> certain session variables exist which the DBA does not have access to. > > Not arguing with that. And to be clear, I'm not trying to attack your > proposal. I'm just trying to have a discussion about advantages and > disadvantages of different approaches. Understood. Ultimately we might want both page-level encryption and column level POLICY, as they are each useful for different use-cases. Personally I believe the former is more generally useful than the latter, but YMMV. Joe -- Crunchy Data - http://crunchydata.com PostgreSQL Support for Secure Enterprises Consulting, Training, & Open Source Development
