Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1lMVQV-0003c3-1d for pgsql-admin@arkaria.postgresql.org; Wed, 17 Mar 2021 12:37:27 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.92) (envelope-from ) id 1lMVQS-0007z3-OM for pgsql-admin@arkaria.postgresql.org; Wed, 17 Mar 2021 12:37:24 +0000 Received: from makus.postgresql.org ([2001:4800:3e1:1::229]) by malur.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1lMVQS-0007yv-C6 for pgsql-admin@lists.postgresql.org; Wed, 17 Mar 2021 12:37:24 +0000 Received: from mail-ej1-x62a.google.com ([2a00:1450:4864:20::62a]) by makus.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.92) (envelope-from ) id 1lMVQP-0004Fp-FS for pgsql-admin@lists.postgresql.org; Wed, 17 Mar 2021 12:37:23 +0000 Received: by mail-ej1-x62a.google.com with SMTP id p8so2305360ejb.10 for ; Wed, 17 Mar 2021 05:37:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cybertec-at.20150623.gappssmtp.com; s=20150623; h=message-id:subject:from:to:date:in-reply-to:references:user-agent :mime-version:content-transfer-encoding; bh=anFaEmJN6pJp0ELbORqDgdOE7+Vl2w/iIRD3ZQiawhM=; b=W8ph3RbiiBD2TWUvz7mwYv2qA/ndzn9dPWJZLWteApu+NEjmvQ+BSMh99scOiE/Bqe lPC/Y11+gOApGXOOEvZmnYtH6jFiKALZEsv3jUotM+OU0Yh0Y67ERNOC+AbgUo+yNglw orUlJv4DY0Vvs8VOsBe9dmYlAN9mpcTq5KKUgVLsonmB8t98Atvr5ET5IadDyfdZyq98 VSM7OIY4ewpCTR06aUBI6s2dh00UTPvhI2gHZlrCxI5CZgCeojazuS4fPmmixZGm8Mv6 8mYb23VLzF6FtNbwUqaOCc5Kne9htvIbASYqxK3xfEF2Wstz3jtiPGdBH+g4tF7fM0QL P5HQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:message-id:subject:from:to:date:in-reply-to :references:user-agent:mime-version:content-transfer-encoding; bh=anFaEmJN6pJp0ELbORqDgdOE7+Vl2w/iIRD3ZQiawhM=; b=eIGEoDNEBVvPlUlofwkf7hxcq8bVtVtrFRP+5rFiQVQ8JPXQWnLVFTQxub52RiAzKT exolNtgBQYA137raqATlpINRCAAaAIhD7aHusNZ/2pwG9Fg2sH+r55lfBKGl/PH57Z/K XQDfuo6Hxw2Li+m69UrDy7lJY1a1/fU8i6+GvRYleK2TyhRZCFni4LrMM+i31W+IXR9R Ctm6gGAGpXDptd8kr7blgflpcPGFB9dq9xc5wjYV3me2z0VFUUxRbYwthg5Saz6Ry/+g uVZwGfn676NqZsh0CHN17kQ6FhZsSQhA8B4LP0q9Lh44STbTXAH4vPlOROPs5ekPu5so Cm/A== X-Gm-Message-State: AOAM531KVN2YJfWMMMaqkoGVVluAQ6z1hNbTSmb/nm2Wk4G61OJutxCf o+fd/YjR1gzWKi0RJJA9ihpCcw== X-Google-Smtp-Source: ABdhPJza/J4Mqo5/C8ZXhUZQ++0rlZrqt4K0GqaQU0T9x4wpkbOaTKg1uMMHD7VHq4gt6abqaJkZfQ== X-Received: by 2002:a17:906:489b:: with SMTP id v27mr35086569ejq.1.1615984638981; Wed, 17 Mar 2021 05:37:18 -0700 (PDT) Received: from localhost.localdomain (217-149-173-101.nat.highway.telekom.at. [217.149.173.101]) by smtp.gmail.com with ESMTPSA id c19sm12621668edu.20.2021.03.17.05.37.18 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 17 Mar 2021 05:37:18 -0700 (PDT) Message-ID: <34d924f51d31ebe4577a90459b8eb7515b61a512.camel@cybertec.at> Subject: Re: Encryption key storage From: Laurenz Albe To: Yambu , Pgsql-admin Date: Wed, 17 Mar 2021 13:37:18 +0100 In-Reply-To: References: Content-Type: text/plain; charset="UTF-8" User-Agent: Evolution 3.36.5 (3.36.5-2.fc32) MIME-Version: 1.0 Content-Transfer-Encoding: 7bit List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk On Wed, 2021-03-17 at 14:05 +0200, Yambu wrote: > Where should we store the encryption key after encrypting column data? > > We are planning to store it in a table which we will restrict access to, but i wonder if this is the best place. > > We are using pgcryto and pg v10. For good security, you don't store the key in the database, but somewhere else. Otherwise the database superuser can get at your data. For better security, don't use pgcrypto, so that you don't have to send the secret to the database server (even if it is not persisted there). Yours, Laurenz Albe -- Cybertec | https://www.cybertec-postgresql.com