From: Laurenz Albe <laurenz.albe@cybertec.at>
To: Yambu <hyambu@gmail.com>
To: Pgsql-admin <pgsql-admin@lists.postgresql.org>
Subject: Re: Encryption key storage
Date: Wed, 17 Mar 2021 13:37:18 +0100
Message-ID: <34d924f51d31ebe4577a90459b8eb7515b61a512.camel@cybertec.at> (raw)
In-Reply-To: <CALhHtcC13=ZD9nZCKHyx29tg3h1ZPiMe61wdSNpOAcAv6UME5Q@mail.gmail.com>
References: <CALhHtcC13=ZD9nZCKHyx29tg3h1ZPiMe61wdSNpOAcAv6UME5Q@mail.gmail.com>
On Wed, 2021-03-17 at 14:05 +0200, Yambu wrote:
> Where should we store the encryption key after encrypting column data?
>
> We are planning to store it in a table which we will restrict access to, but i wonder if this is the best place.
>
> We are using pgcryto and pg v10.
For good security, you don't store the key in the database, but somewhere else.
Otherwise the database superuser can get at your data.
For better security, don't use pgcrypto, so that you don't have to send the
secret to the database server (even if it is not persisted there).
Yours,
Laurenz Albe
--
Cybertec | https://www.cybertec-postgresql.com
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: laurenz.albe@cybertec.at, hyambu@gmail.com, pgsql-admin@lists.postgresql.org
Subject: Re: Encryption key storage
In-Reply-To: <34d924f51d31ebe4577a90459b8eb7515b61a512.camel@cybertec.at>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox