Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Separate key creation and usage #428

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Jun 13, 2025
Merged

Separate key creation and usage #428

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
c1e9b01
Clean up errors from set key functions
AndersAstrand Jun 12, 2025
073f365
Remove key provider files in regress tests
AndersAstrand Jun 12, 2025
1eff35c
Separate principal key creation from usage
AndersAstrand Jun 12, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions ci_scripts/setup-keyring-servers.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@ wget https://raw.githubusercontent.com/OpenKMIP/PyKMIP/refs/heads/master/example
cd ..

echo $SCRIPT_DIR
rm -f /tmp/pykmip.db
pykmip-server -f "$SCRIPT_DIR/../contrib/pg_tde/pykmip-server.conf" -l /tmp/kmip-server.log &

CLUSTER_INFO=$(mktemp)
Expand Down
2 changes: 2 additions & 0 deletions ci_scripts/tde_setup.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,6 @@
CREATE SCHEMA IF NOT EXISTS tde;
CREATE EXTENSION IF NOT EXISTS pg_tde SCHEMA tde;
\! rm -f '/tmp/pg_tde_test_keyring.per'
SELECT tde.pg_tde_add_database_key_provider_file('reg_file-vault', '/tmp/pg_tde_test_keyring.per');
SELECT tde.pg_tde_create_key_using_database_key_provider('test-db-key', 'reg_file-vault');
SELECT tde.pg_tde_set_key_using_database_key_provider('test-db-key', 'reg_file-vault');
2 changes: 2 additions & 0 deletions ci_scripts/tde_setup_global.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,9 @@
CREATE SCHEMA tde;
CREATE EXTENSION IF NOT EXISTS pg_tde SCHEMA tde;

\! rm -f '/tmp/pg_tde_test_keyring.per'
SELECT tde.pg_tde_add_global_key_provider_file('reg_file-global', '/tmp/pg_tde_test_keyring.per');
SELECT tde.pg_tde_create_key_using_global_key_provider('server-key', 'reg_file-global');
SELECT tde.pg_tde_set_server_key_using_global_key_provider('server-key', 'reg_file-global');
ALTER SYSTEM SET pg_tde.wal_encrypt = on;
ALTER SYSTEM SET default_table_access_method = 'tde_heap';
Expand Down
12 changes: 9 additions & 3 deletions contrib/pg_tde/expected/access_control.out
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,4 @@
\! rm -f '/tmp/pg_tde_test_keyring.per'
CREATE EXTENSION IF NOT EXISTS pg_tde;
SELECT pg_tde_add_database_key_provider_file('local-file-provider', '/tmp/pg_tde_test_keyring.per');
pg_tde_add_database_key_provider_file
Expand All @@ -8,6 +9,8 @@ SELECT pg_tde_add_database_key_provider_file('local-file-provider', '/tmp/pg_tde
CREATE USER regress_pg_tde_access_control;
SET ROLE regress_pg_tde_access_control;
-- should throw access denied
SELECT pg_tde_create_key_using_database_key_provider('test-db-key', 'local-file-provider');
ERROR: permission denied for function pg_tde_create_key_using_database_key_provider
SELECT pg_tde_set_key_using_database_key_provider('test-db-key', 'local-file-provider');
ERROR: permission denied for function pg_tde_set_key_using_database_key_provider
SELECT pg_tde_delete_key();
Expand All @@ -34,11 +37,12 @@ GRANT EXECUTE ON FUNCTION pg_tde_add_database_key_provider(TEXT, TEXT, JSON) TO
GRANT EXECUTE ON FUNCTION pg_tde_add_global_key_provider(TEXT, TEXT, JSON) TO regress_pg_tde_access_control;
GRANT EXECUTE ON FUNCTION pg_tde_change_database_key_provider(TEXT, TEXT, JSON) TO regress_pg_tde_access_control;
GRANT EXECUTE ON FUNCTION pg_tde_change_global_key_provider(TEXT, TEXT, JSON) TO regress_pg_tde_access_control;
GRANT EXECUTE ON FUNCTION pg_tde_create_key_using_global_key_provider(TEXT, TEXT) TO regress_pg_tde_access_control;
GRANT EXECUTE ON FUNCTION pg_tde_delete_database_key_provider(TEXT) TO regress_pg_tde_access_control;
GRANT EXECUTE ON FUNCTION pg_tde_delete_global_key_provider(TEXT) TO regress_pg_tde_access_control;
GRANT EXECUTE ON FUNCTION pg_tde_set_default_key_using_global_key_provider(TEXT, TEXT, BOOLEAN) TO regress_pg_tde_access_control;
GRANT EXECUTE ON FUNCTION pg_tde_set_key_using_global_key_provider(TEXT, TEXT, BOOLEAN) TO regress_pg_tde_access_control;
GRANT EXECUTE ON FUNCTION pg_tde_set_server_key_using_global_key_provider(TEXT, TEXT, BOOLEAN) TO regress_pg_tde_access_control;
GRANT EXECUTE ON FUNCTION pg_tde_set_default_key_using_global_key_provider(TEXT, TEXT) TO regress_pg_tde_access_control;
GRANT EXECUTE ON FUNCTION pg_tde_set_key_using_global_key_provider(TEXT, TEXT) TO regress_pg_tde_access_control;
GRANT EXECUTE ON FUNCTION pg_tde_set_server_key_using_global_key_provider(TEXT, TEXT) TO regress_pg_tde_access_control;
GRANT EXECUTE ON FUNCTION pg_tde_delete_default_key() TO regress_pg_tde_access_control;
SET ROLE regress_pg_tde_access_control;
SELECT pg_tde_add_database_key_provider_file('local-file-provider', '/tmp/pg_tde_test_keyring.per');
Expand All @@ -53,6 +57,8 @@ SELECT pg_tde_change_global_key_provider_file('global-file-provider', '/tmp/pg_t
ERROR: must be superuser to modify key providers
SELECT pg_tde_delete_global_key_provider('global-file-provider');
ERROR: must be superuser to modify key providers
SELECT pg_tde_create_key_using_global_key_provider('key1', 'global-file-provider');
ERROR: must be superuser to access global key providers
SELECT pg_tde_set_key_using_global_key_provider('key1', 'global-file-provider');
ERROR: must be superuser to access global key providers
SELECT pg_tde_set_default_key_using_global_key_provider('key1', 'global-file-provider');
Expand Down
7 changes: 7 additions & 0 deletions contrib/pg_tde/expected/alter_index.out
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,17 @@
\! rm -f '/tmp/pg_tde_test_keyring.per'
CREATE EXTENSION IF NOT EXISTS pg_tde;
SELECT pg_tde_add_database_key_provider_file('file-vault','/tmp/pg_tde_test_keyring.per');
pg_tde_add_database_key_provider_file
---------------------------------------

(1 row)

SELECT pg_tde_create_key_using_database_key_provider('test-db-key','file-vault');
pg_tde_create_key_using_database_key_provider
-----------------------------------------------

(1 row)

SELECT pg_tde_set_key_using_database_key_provider('test-db-key','file-vault');
pg_tde_set_key_using_database_key_provider
--------------------------------------------
Expand Down
7 changes: 7 additions & 0 deletions contrib/pg_tde/expected/cache_alloc.out
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,4 @@
\! rm -f '/tmp/pg_tde_test_keyring.per'
-- Just checking there are no mem debug WARNINGs during the cache population
CREATE EXTENSION IF NOT EXISTS pg_tde;
SELECT pg_tde_add_database_key_provider_file('file-vault','/tmp/pg_tde_test_keyring.per');
Expand All @@ -6,6 +7,12 @@ SELECT pg_tde_add_database_key_provider_file('file-vault','/tmp/pg_tde_test_keyr

(1 row)

SELECT pg_tde_create_key_using_database_key_provider('test-db-key','file-vault');
pg_tde_create_key_using_database_key_provider
-----------------------------------------------

(1 row)

SELECT pg_tde_set_key_using_database_key_provider('test-db-key','file-vault');
pg_tde_set_key_using_database_key_provider
--------------------------------------------
Expand Down
7 changes: 7 additions & 0 deletions contrib/pg_tde/expected/change_access_method.out
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,17 @@
\! rm -f '/tmp/pg_tde_test_keyring.per'
CREATE EXTENSION IF NOT EXISTS pg_tde;
SELECT pg_tde_add_database_key_provider_file('file-vault', '/tmp/pg_tde_test_keyring.per');
pg_tde_add_database_key_provider_file
---------------------------------------

(1 row)

SELECT pg_tde_create_key_using_database_key_provider('test-db-key', 'file-vault');
pg_tde_create_key_using_database_key_provider
-----------------------------------------------

(1 row)

SELECT pg_tde_set_key_using_database_key_provider('test-db-key', 'file-vault');
pg_tde_set_key_using_database_key_provider
--------------------------------------------
Expand Down
14 changes: 14 additions & 0 deletions contrib/pg_tde/expected/create_database.out
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,5 @@
\! rm -f '/tmp/template_provider_global.per'
\! rm -f '/tmp/template_provider.per'
CREATE EXTENSION IF NOT EXISTS pg_tde;
CREATE DATABASE template_db;
SELECT current_database() AS regress_database
Expand All @@ -10,6 +12,12 @@ SELECT pg_tde_add_database_key_provider_file('file-vault', '/tmp/template_provid

(1 row)

SELECT pg_tde_create_key_using_database_key_provider('test-db-key', 'file-vault');
pg_tde_create_key_using_database_key_provider
-----------------------------------------------

(1 row)

SELECT pg_tde_set_key_using_database_key_provider('test-db-key', 'file-vault');
pg_tde_set_key_using_database_key_provider
--------------------------------------------
Expand All @@ -29,6 +37,12 @@ SELECT pg_tde_add_global_key_provider_file('global-file-vault','/tmp/template_pr

(1 row)

SELECT pg_tde_create_key_using_global_key_provider('default-key', 'global-file-vault');
pg_tde_create_key_using_global_key_provider
---------------------------------------------

(1 row)

SELECT pg_tde_set_default_key_using_global_key_provider('default-key', 'global-file-vault');
pg_tde_set_default_key_using_global_key_provider
--------------------------------------------------
Expand Down
17 changes: 15 additions & 2 deletions contrib/pg_tde/expected/default_principal_key.out
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,4 @@
\! rm -f '/tmp/pg_tde_regression_default_key.per'
CREATE EXTENSION IF NOT EXISTS pg_tde;
CREATE EXTENSION IF NOT EXISTS pg_buffercache;
SELECT pg_tde_add_global_key_provider_file('file-provider','/tmp/pg_tde_regression_default_key.per');
Expand All @@ -17,7 +18,13 @@ SELECT provider_id, provider_name, key_name
| |
(1 row)

SELECT pg_tde_set_default_key_using_global_key_provider('default-key', 'file-provider', false);
SELECT pg_tde_create_key_using_global_key_provider('default-key', 'file-provider');
pg_tde_create_key_using_global_key_provider
---------------------------------------------

(1 row)

SELECT pg_tde_set_default_key_using_global_key_provider('default-key', 'file-provider');
pg_tde_set_default_key_using_global_key_provider
--------------------------------------------------

Expand Down Expand Up @@ -99,7 +106,13 @@ SELECT provider_id, provider_name, key_name

\c :regress_database
CHECKPOINT;
SELECT pg_tde_set_default_key_using_global_key_provider('new-default-key', 'file-provider', false);
SELECT pg_tde_create_key_using_global_key_provider('new-default-key', 'file-provider');
pg_tde_create_key_using_global_key_provider
---------------------------------------------

(1 row)

SELECT pg_tde_set_default_key_using_global_key_provider('new-default-key', 'file-provider');
pg_tde_set_default_key_using_global_key_provider
--------------------------------------------------

Expand Down
13 changes: 13 additions & 0 deletions contrib/pg_tde/expected/delete_principal_key.out
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,23 @@
\! rm -f '/tmp/pg_tde_test_keyring.per'
CREATE EXTENSION IF NOT EXISTS pg_tde;
SELECT pg_tde_add_global_key_provider_file('file-provider','/tmp/pg_tde_test_keyring.per');
pg_tde_add_global_key_provider_file
-------------------------------------

(1 row)

SELECT pg_tde_create_key_using_global_key_provider('defalut-key','file-provider');
pg_tde_create_key_using_global_key_provider
---------------------------------------------

(1 row)

SELECT pg_tde_create_key_using_global_key_provider('test-db-key','file-provider');
pg_tde_create_key_using_global_key_provider
---------------------------------------------

(1 row)

-- Set the local key and delete it without any encrypted tables
-- Should succeed: nothing used the key
SELECT pg_tde_set_key_using_global_key_provider('test-db-key','file-provider');
Expand Down
7 changes: 7 additions & 0 deletions contrib/pg_tde/expected/insert_update_delete.out
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,17 @@
\! rm -f '/tmp/pg_tde_test_keyring.per'
CREATE EXTENSION IF NOT EXISTS pg_tde;
SELECT pg_tde_add_database_key_provider_file('file-vault','/tmp/pg_tde_test_keyring.per');
pg_tde_add_database_key_provider_file
---------------------------------------

(1 row)

SELECT pg_tde_create_key_using_database_key_provider('test-db-key','file-vault');
pg_tde_create_key_using_database_key_provider
-----------------------------------------------

(1 row)

SELECT pg_tde_set_key_using_database_key_provider('test-db-key','file-vault');
pg_tde_set_key_using_database_key_provider
--------------------------------------------
Expand Down
78 changes: 61 additions & 17 deletions contrib/pg_tde/expected/key_provider.out
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,7 @@
\! rm -f '/tmp/db-provider-file'
\! rm -f '/tmp/global-provider-file-1'
\! rm -f '/tmp/pg_tde_test_keyring.per'
\! rm -f '/tmp/pg_tde_test_keyring2.per'
CREATE EXTENSION IF NOT EXISTS pg_tde;
SELECT * FROM pg_tde_key_info();
key_name | provider_name | provider_id | key_creation_time
Expand Down Expand Up @@ -28,6 +32,12 @@ SELECT * FROM pg_tde_list_all_database_key_providers();
2 | file-provider2 | file | {"path" : "/tmp/pg_tde_test_keyring2.per"}
(2 rows)

SELECT pg_tde_create_key_using_database_key_provider('test-db-key','file-provider');
pg_tde_create_key_using_database_key_provider
-----------------------------------------------

(1 row)

SELECT pg_tde_verify_key();
ERROR: principal key not configured for current database
SELECT pg_tde_set_key_using_database_key_provider('test-db-key','file-provider');
Expand Down Expand Up @@ -109,7 +119,7 @@ SELECT id, name FROM pg_tde_list_all_global_key_providers();
-5 | file-keyring2
(2 rows)

SELECT pg_tde_set_key_using_global_key_provider('test-db-key', 'file-keyring', false);
SELECT pg_tde_set_key_using_global_key_provider('test-db-key', 'file-keyring');
pg_tde_set_key_using_global_key_provider
------------------------------------------

Expand Down Expand Up @@ -228,6 +238,12 @@ SELECT pg_tde_add_global_key_provider_file('global-provider', '/tmp/global-provi

(1 row)

SELECT pg_tde_create_key_using_global_key_provider('server-key', 'global-provider');
pg_tde_create_key_using_global_key_provider
---------------------------------------------

(1 row)

SELECT pg_tde_set_server_key_using_global_key_provider('server-key', 'global-provider');
WARNING: The WAL encryption feature is currently in beta and may be unstable. Do not use it in production environments!
pg_tde_set_server_key_using_global_key_provider
Expand All @@ -249,6 +265,12 @@ SELECT current_database() AS regress_database
CREATE DATABASE db_using_global_provider;
\c db_using_global_provider;
CREATE EXTENSION pg_tde;
SELECT pg_tde_create_key_using_global_key_provider('database-key', 'global-provider2');
pg_tde_create_key_using_global_key_provider
---------------------------------------------

(1 row)

SELECT pg_tde_set_key_using_global_key_provider('database-key', 'global-provider2');
pg_tde_set_key_using_global_key_provider
------------------------------------------
Expand All @@ -268,6 +290,12 @@ SELECT pg_tde_add_database_key_provider_file('db-provider', '/tmp/db-provider-fi

(1 row)

SELECT pg_tde_create_key_using_database_key_provider('database-key', 'db-provider');
pg_tde_create_key_using_database_key_provider
-----------------------------------------------

(1 row)

SELECT pg_tde_set_key_using_database_key_provider('database-key', 'db-provider');
pg_tde_set_key_using_database_key_provider
--------------------------------------------
Expand Down Expand Up @@ -304,23 +332,39 @@ SELECT pg_tde_set_server_key_using_global_key_provider(NULL, 'file-keyring');
WARNING: The WAL encryption feature is currently in beta and may be unstable. Do not use it in production environments!
ERROR: key name cannot be null
-- Empty string is not allowed for a principal key name
SELECT pg_tde_set_default_key_using_global_key_provider('', 'file-keyring');
SELECT pg_tde_create_key_using_database_key_provider('', 'file-provider');
ERROR: key name "" is too short
SELECT pg_tde_set_key_using_database_key_provider('', 'file-keyring');
SELECT pg_tde_create_key_using_global_key_provider('', 'file-keyring');
ERROR: key name "" is too short
SELECT pg_tde_set_key_using_global_key_provider('', 'file-keyring');
ERROR: key name "" is too short
SELECT pg_tde_set_server_key_using_global_key_provider('', 'file-keyring');
WARNING: The WAL encryption feature is currently in beta and may be unstable. Do not use it in production environments!
ERROR: key name "" is too short
-- Setting principal key fails if the key name is too long
SELECT pg_tde_set_default_key_using_global_key_provider(repeat('K', 256), 'file-keyring');
ERROR: too long principal key name, maximum length is 255 bytes
SELECT pg_tde_set_key_using_database_key_provider(repeat('K', 256), 'file-provider');
ERROR: too long principal key name, maximum length is 255 bytes
SELECT pg_tde_set_key_using_global_key_provider(repeat('K', 256), 'file-keyring');
ERROR: too long principal key name, maximum length is 255 bytes
SELECT pg_tde_set_server_key_using_global_key_provider(repeat('K', 256), 'file-keyring');
-- Creating principal key fails if the key name is too long
SELECT pg_tde_create_key_using_database_key_provider(repeat('K', 256), 'file-provider');
ERROR: key name "KKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKK" is too long
HINT: Maximum length is 255 bytes.
SELECT pg_tde_create_key_using_global_key_provider(repeat('K', 256), 'file-keyring');
ERROR: key name "KKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKK" is too long
HINT: Maximum length is 255 bytes.
-- Creating principal key fails if key already exists
SELECT pg_tde_create_key_using_database_key_provider('existing-key','file-provider');
pg_tde_create_key_using_database_key_provider
-----------------------------------------------

(1 row)

SELECT pg_tde_create_key_using_database_key_provider('existing-key','file-provider');
ERROR: cannot to create key "existing-key" because it already exists
SELECT pg_tde_create_key_using_global_key_provider('existing-key','file-keyring');
ERROR: cannot to create key "existing-key" because it already exists
-- Setting principal key fails if key does not exist
SELECT pg_tde_set_default_key_using_global_key_provider('not-existing', 'file-keyring');
ERROR: key "not-existing" does not exist
HINT: Use pg_tde_create_key_using_global_key_provider() to create it.
SELECT pg_tde_set_key_using_database_key_provider('not-existing', 'file-keyring');
ERROR: key provider "file-keyring" does not exists
SELECT pg_tde_set_key_using_global_key_provider('not-existing', 'file-keyring');
ERROR: key "not-existing" does not exist
HINT: Use pg_tde_create_key_using_global_key_provider() to create it.
SELECT pg_tde_set_server_key_using_global_key_provider('not-existing', 'file-keyring');
WARNING: The WAL encryption feature is currently in beta and may be unstable. Do not use it in production environments!
ERROR: too long principal key name, maximum length is 255 bytes
ERROR: key "not-existing" does not exist
HINT: Use pg_tde_create_key_using_global_key_provider() to create it.
DROP EXTENSION pg_tde;
6 changes: 6 additions & 0 deletions contrib/pg_tde/expected/kmip_test.out
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,12 @@ SELECT pg_tde_add_database_key_provider_kmip('kmip-prov', '127.0.0.1', 5696, '/t

(1 row)

SELECT pg_tde_create_key_using_database_key_provider('kmip-key','kmip-prov');
pg_tde_create_key_using_database_key_provider
-----------------------------------------------

(1 row)

SELECT pg_tde_set_key_using_database_key_provider('kmip-key','kmip-prov');
pg_tde_set_key_using_database_key_provider
--------------------------------------------
Expand Down
7 changes: 7 additions & 0 deletions contrib/pg_tde/expected/partition_table.out
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,17 @@
\! rm -f '/tmp/pg_tde_keyring.per'
CREATE EXTENSION pg_tde;
SELECT pg_tde_add_database_key_provider_file('database_keyring_provider','/tmp/pg_tde_keyring.per');
pg_tde_add_database_key_provider_file
---------------------------------------

(1 row)

SELECT pg_tde_create_key_using_database_key_provider('table_key','database_keyring_provider');
pg_tde_create_key_using_database_key_provider
-----------------------------------------------

(1 row)

SELECT pg_tde_set_key_using_database_key_provider('table_key','database_keyring_provider');
pg_tde_set_key_using_database_key_provider
--------------------------------------------
Expand Down
Loading