Subject: Re: Encryption in pg_dump
To: pgsql-admin@lists.postgresql.org
References: 
 <CAD7GeHRZ3tu8y9VG_0juVK3RQq6r+t6HciguEz_C8Eh85Hmq3A@mail.gmail.com>
 <2BCA8D4B-E94D-4F2F-99A5-D783912A1CDF@gmail.com>
 <20200722185541.GE3899@momjian.us>
 <6D40812C-3F42-41A2-A548-4EC7754DF473@gmail.com> <87zh7qbxqk.fsf@gmail.com>
 <CAJ7S9TW2j7Dk3k62_b_oZg9X=7jKMyLuebcBgtj0aWjSjzGJTw@mail.gmail.com>
 <a91e4430-6e74-2980-b914-7a045d3636ad@gmail.com>
 <4DCA85A3-B307-48E8-9B30-0D8E2E4911D2@gmail.com>
 <CAMreHJLzv9xM2z6vcxq6KxV37C0RGuDSatsa0Fho1u==9i2+Zg@mail.gmail.com>
 <0EF8B591-3363-4D66-AEB8-CC1F34A53DD7@gmail.com>
From: Ron <ronljohnsonjr@gmail.com>
Message-ID: <16c2a4f1-5167-a4f8-ab61-b0e083c94ee5@gmail.com>
Date: Thu, 23 Jul 2020 04:12:30 -0500
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101
 Thunderbird/68.8.0
MIME-Version: 1.0
In-Reply-To: <0EF8B591-3363-4D66-AEB8-CC1F34A53DD7@gmail.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit
Content-Language: en-US
Precedence: bulk

On 7/23/20 4:05 AM, Paul Förster wrote:
> Hi Tal,
>
>> On 23. Jul, 2020, at 10:27, Tal Glo <glozmantal@gmail.com> wrote:
>> There is a way to implement full homomorphic encryption (FHE) with Postgres.
> ok.
>
>> I've used a relatively old version (2.3.1) of Microsoft's SEAL library in my University project for that.
> I don't know about Windows but I assume, Linux would be similar?
>
>> 2. Handling queries related to FHE encrypted attributes on the server side requires an implementation of own C language functions.
> we don't do that. Also, we have third party applications. In case they need to be modified, this is impossible.

That was my first thought, too.  We mostly run 3rd party applications, with 
very little home-grown.  TDE (transparent data encryption) is the only 
reasonable work-around.

>> It's not always a good Idea to say that something cannot be done or that some one needs to be replaced. Sometimes it's worth to develop some new process, based on a mixture of available technologies out there.
> right, but only if it makes sense. To put a wallet in the file system and its key right next to it does not make sense but only serves to make IT heads and security "gurus" go quiet. In these cases, only replacing them by competent ones helps.

Which is as unlikely as getting all 3rd party vendors to implement 
application-level encryption.

-- 
Angular momentum makes the world go 'round.