Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1jycja-0001DP-WF for pgsql-admin@arkaria.postgresql.org; Thu, 23 Jul 2020 15:02:11 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.92) (envelope-from ) id 1jycjZ-0001iX-Kz for pgsql-admin@arkaria.postgresql.org; Thu, 23 Jul 2020 15:02:09 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1jycjZ-0001iQ-DN for pgsql-admin@lists.postgresql.org; Thu, 23 Jul 2020 15:02:09 +0000 Received: from tamriel.snowman.net ([96.255.250.162]) by magus.postgresql.org with esmtp (Exim 4.92) (envelope-from ) id 1jycjT-00026b-A4 for pgsql-admin@lists.postgresql.org; Thu, 23 Jul 2020 15:02:08 +0000 Received: by tamriel.snowman.net (Postfix, from userid 1000) id 1F00C5F79F; Thu, 23 Jul 2020 11:02:02 -0400 (EDT) Date: Thu, 23 Jul 2020 11:02:01 -0400 From: Stephen Frost To: Ron Cc: pgsql-admin@lists.postgresql.org Subject: Re: Encryption in pg_dump Message-ID: <20200723150201.GT12375@tamriel.snowman.net> References: <2BCA8D4B-E94D-4F2F-99A5-D783912A1CDF@gmail.com> <20200722185541.GE3899@momjian.us> <6D40812C-3F42-41A2-A548-4EC7754DF473@gmail.com> <450954f7-c8aa-09cf-ad9c-0a63c9437cc4@gmail.com> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="jb0wbLfbWvebn3+7" Content-Disposition: inline In-Reply-To: <450954f7-c8aa-09cf-ad9c-0a63c9437cc4@gmail.com> User-Agent: Mutt/1.5.24 (2015-08-30) List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Precedence: bulk --jb0wbLfbWvebn3+7 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Greetings, * Ron (ronljohnsonjr@gmail.com) wrote: > TDE, though, protects against hackers who break in and try to slurp out as > much data as possible.=A0 Still pretty unlikely, but within the realm of > reason. That's an unfortunate misconception- TDE won't help with that as the key will be in the server's memory and therefore accessible to the attacker. Certainly, if the server is doing the decryption and is compromised in an online fashion, then the attacker is going to have access to that data. Thanks, Stephen --jb0wbLfbWvebn3+7 Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCgAGBQJfGaZpAAoJEO1sijiDR2RVjuAP/A4ijZhGfDikeogY72W+8Cbf N2orvy9idiv1fETSFZc7PmfTi843VsdM5dSkgvHO241Z9rX5usIb+izi8ZUgotn4 yAiU7EN5UXrpjDmIA/CljvvlUDWKvwBZZpzZ9bdFwYUZTyVSpOHXps29Ywb7SKCn vz77Knwbu/pgmEq5Q3AfFhkQHoaH6GO/ROKUx0g+XXUX1czRQueojVcTCNhLTen+ eUoxZG0PialV1ZMbP4PC0AzyD8Xgmrv1F90pPs/LCaMCO9xbJf0zm97yKhkWXit4 AFWbLN04edV71aW2+dCdVCUOzlhXrdW1kg6QFDnxS1oHRLXsQGE2HFJo3IkRIPEW Qy3LRHLn+7C32iF4vjTf6whLjr/yigTQVo0fDWszf8fjoF8YfR+ZM1QqshqZiKGs kveUpsjkIuaZsyyOsG9Sd5zyjnwXyD5T1ZHTnPgD6z0RK12XT6LK+AdauCWFwkxZ VXPWpH48rwZGbb10EJT5ITeS+44qet/XBgVgjN6oiXPlsZKlGonPmLoFkeH1pHSY l/9b39yoEotiZokWpZYcvI5eaoFvnRqeUP0K/21vLGrKGQ5Fvpc2/ck7UjQ4oQ6s ZRkUA4eLloBymywFg22KL2OBxKx68KN7UjL7QK1oVB9y/NWT+OUlvNnU2pASYwpz 01EH/Sch6bfZfB9+EP3E =66UE -----END PGP SIGNATURE----- --jb0wbLfbWvebn3+7--