Re: storing an explicit nonce

On Wed, May 26, 2021 at 01:56:38PM -0400, Robert Haas wrote:
> In the interest of not being viewed as too much of a naysayer, let me
> first reiterate that I am generally in favor of TDE going forward and
> am not looking to throw up unnecessary obstacles in the way of making
> that happen.

Rather than surprise anyone, I might as well just come out and say some
things.  First, I have always admitted this feature has limited
usefulness.  

I think a non-LSN nonce adds a lot of code complexity, which adds a code
and maintenance burden.  It also prevents the creation of an encrypted
replica from a non-encrypted primary using binary replication, which
makes deployment harder.

Take a feature of limited usefulness, add code complexity and deployment
difficulty, and the feature becomes even less useful.

For these reasons, if we decide to go in the direction of using a
non-LSN nonce, I no longer plan to continue working on this feature. I
would rather work on things that have a more positive impact.  Maybe a
non-LSN nonce is a better long-term plan, but there are too many
unknowns and complexity for me to feel comfortable with it.

-- 
  Bruce Momjian  <bruce@momjian.us>        https://momjian.us
  EDB                                      https://enterprisedb.com

  If only the physical world exists, free will is an illusion.