On the Road to TDE
summary
Proposal adds runtime block-size, a reserved page area and page-feature flags so pages can store an authentication tag and a per-page IV; goal is encrypting all user data (heap, indexes, temp files, WAL) without app changes. WAL patch implements GCM per‑WAL‑record with the LSN as IV (works with replication but LSN‑IV edge cases remain). Key management uses a user KEK that currently comes from a shell command, per‑run DEKs for temp data to avoid IV reuse, and KEK rotation that only rewraps DEKs. Patches are POC and largely functional.
AI-written summary · about
chapters (13)
- 0:00Introduction to TDE
- 1:06Why transparent data encryption
- 5:44Goals of TDE effort
- 6:26Roadmap to TDE implementation
- 18:51Temporary files and non-heap access
- 21:40Key management system
- 24:50Heap and index encryption
- 27:41WAL encryption progress
- 33:24Encryption algorithms and trade-offs
- 36:10Upgrade and performance considerations
- 40:50Authentication tag size
- 42:20Future key management enhancements
- 43:44Q&A and closing remarks
related talks
27mEncrypting Data in Ceph: An Overview and Opportunities
38mHardware-based KMS Plug-in to Protect Secrets in Kubernetes
45mTDE as an Extension: A Different Path for PostgreSQL Encryption
50mBuilding Production-Grade End to End Encrypted App...
30mKernel Hardening With Protection Keys
34mAuthenticated and Encrypted Storage on Embedded Linux
31mSecure IO
25mStorage and encryption in DuckDB