KingbaseES 支持列加密

KINGBASE 列加密支持 sm4 和 rc4 加密算法，具體算法在 initdb 時指定，默認是 sm4。要使用列加密，必須 shared_preload_libraries = 'sysencrypt'

一、列加密

分別創建兩張表：加密與非加密

test=# create table t1_encrypt(name text encrypted);
CREATE TABLE
test=# create table t1_noencrypt(name text);
CREATE TABLE
test=# insert into t1_encrypt values('kingbase');
INSERT 0 1
test=# insert into t1_noencrypt values('kingbase');
INSERT 0 1

用hexdump 查看加密情況

加密表：

[kingbase@dbhost03 61904]$ hexdump -c 71512
0000000  \0  \0  \0  \0   P 344   E 224  \0  \0  \0  \0      \0 240 037
0000010  \0     004      \0  \0  \0  \0 320 237   R  \0 240 237   R  \0
0000020  \0  \0  \0  \0  \0  \0  \0  \0  \0  \0  \0  \0  \0  \0  \0  \0
*
0001fa0 001 334 003  \0  \0  \0  \0  \0  \0  \0  \0  \0  \0  \0  \0  \0
0001fe0 001  \0 001 020 002  \b 030  \0   # 314   N 223 345   f 272   N
0001ff0 211 246 225 375 026 372   f 206 365  \0  \0  \0  \0  \0  \0  \0
0002000

非加密表：可以看到kingbase是明文的

[kingbase@dbhost03 61904]$ hexdump -c 71518
0000000  \0  \0  \0  \0 270 344   E 224  \0  \0  \0  \0 034  \0 330 037
0000010  \0     004      \0  \0  \0  \0 330 237   B  \0  \0  \0  \0  \0
0000020  \0  \0  \0  \0  \0  \0  \0  \0  \0  \0  \0  \0  \0  \0  \0  \0
*
0001fd0  \0  \0  \0  \0  \0  \0  \0  \0 002 334 003  \0  \0  \0  \0  \0
0001fe0  \0  \0  \0  \0  \0  \0  \0  \0 001  \0 001  \0 002  \b 030  \0
0001ff0 023   k   i   n   g   b   a   s   e  \0  \0  \0  \0  \0  \0  \0
0002000

二、列加密使用限制

1、表空間加密與列加密不能同時使用

如果表空間已啟用加密，不能再在該表空間上創建含有加密列的表。具體報錯如下：

test=# CREATE TABLE t1(id INT, name VARCHAR(100) encrypted) TABLESPACE tsp1;
ERROR:  Column encryption and tablepspace encryption cannot be userd at the same time.

2、關閉wallet后，不能創建、刪除加密表

test=# closeup wallet with password "Kingbase";
WARNING:  wallet alread closed
CLOSE WALLET
test=# drop table t1_encrypt;
ERROR:  wallet status is closed, open wallet and try again
test=# create table t2_encrypt(name text encrypted);
ERROR:  wallet status is closed, open wallet and try again

3、無法修改列為加密或非加密

test=# alter table t1_encrypt alter column name type text;
ERROR:  cannot modify encrypted column type.
test=# alter table t1_noencrypt alter column name set encrypted;
ERROR:  syntax error at or near "encrypted"
LINE 1: alter table t1_noencrypt alter column name set encrypted;

4、加密列不支持blob , clob

test=# create table t1_encrypt(name clob encrypted);
ERROR:  BLOB, CLOB or composite type columns can't be encrypted