Proof-of-concept: Protect decrypted relation keys take 2 #467
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
added 2 commits
July 4, 2025 12:33
Using openssl's secure allocators for these ensures they are never swapped to disk or present in a core dump. This commit is mostly a poc for only keeping encrypted keys in the smgr cache, as that memory is not protected.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Here is an alternative version of the POC in #446
This version doesn't use ResourceOwners, but instead frees the decrypted keys on smgr close. Unfortunately we don't get to know when smgr destroy is done, which would probably be the most correctest place to do this.
This version also caches the encrypted keys separately, however I'm not sure whether that's valuable or not. Need to do some testing.