On 28/12/2025 5:25 PM, Henson Choi wrote:
> Subject: Re: RFC: PostgreSQL Storage I/O Transformation Hooks
>
> Hi Zsolt,
>
> Thank you for your detailed questions. I'll address each point:
>
> 1. Bundling WAL and Buffer Manager
>
> WAL and heap pages are simply different representations of the same
> underlying data. Protecting only one side would be cryptographically
> incomplete; an attacker could bypass encryption by reading the
> unprotected side. Therefore, they must be treated as a single atomic
> unit of protection.
I am not expert in cryptography, better say I even dummy in this area.
But I have one concern about proposed WAL encryption (record level
encryption).
Content of some WAL records can be almost completely predicated (it
contains no user data,
just some Postgres internal data which can be easily reconstructed).
I wonder if this fact can significantly simplify task of cracking cypher?
May be it is safer to use page level encryption for WAL also?
