On Thu, Aug 8, 2019 at 10:34:26PM -0400, Sehrope Sarkuni wrote: > On Thu, Aug 8, 2019 at 6:31 PM Stephen Frost <sfr...@snowman.net> wrote: > > Strictly speaking, that isn't actually crash recovery, it's physical > replication / HA, and while those are certainly nice to have it's no > guarantee that they're required or that you'd want to have the same keys > for them- conceptually, at least, you could have WAL with one key that > both sides know and then different keys for the actual data files, if we > go with the approach where the WAL is encrypted with one key and then > otherwise is plaintext. > > > I like the idea of separating the WAL key from the rest of the data files. > It'd all be unlocked by the MDEK and you'd still need derived keys per > WAL-file, but disconnecting all that from the data files solves a lot of the > problems with promoted replicas. > > This would complicate cloning a replica as using a different MDEK would > involve > decrypting / encrypting everything rather than just copying the files. Even if > that's not baked in a first version, the separation allows for eventually > supporting that.
OK, I can get behind that idea. One cool idea would be for the WAL on primary and standbys to use the same WAL key, but to use different heap/index keys. When the standby is promoted, there would be a way for the WAL to start using a new encryption key, and the heap/index would already be using its own encryption key. Setting up such a system seems complicated. The big problem is that the base backup would use the primary key, unless we allowed pg_basebackup to decrypt/encrypt with a new heap/index key. -- Bruce Momjian <br...@momjian.us> http://momjian.us EnterpriseDB http://enterprisedb.com + As you are, so once was I. As I am, so you will be. + + Ancient Roman grave inscription +