From: Joe Conway <mail@joeconway.com>
To: Kevin Grittner <Kevin.Grittner@wicourts.gov>
Cc: Timothy Madden <terminatorul@gmail.com>
Cc: Scott Marlowe <scott.marlowe@gmail.com>
Cc: pgsql-admin@postgresql.org
Subject: Re: Database level encryption
Date: Mon, 05 Apr 2010 15:50:12 -0700
Message-ID: <4BBA6924.5050305@joeconway.com> (raw)
In-Reply-To: <4BBA05E80200002500030493@gw.wicourts.gov>
References: <q2y5078d8af1004030635g624bf8f7r580cb3ebe7135b74@mail.gmail.com>
<4BB774D4.3070306@joeconway.com>
<m2r5078d8af1004051330n1874e532u3c88fd1bc31c8697@mail.gmail.com>
<v2ldcc563d11004051334ledfcd2b2gf8db60ca48b43118@mail.gmail.com>
<4BBA05E80200002500030493@gw.wicourts.gov>
On 04/05/2010 01:46 PM, Kevin Grittner wrote:
> Scott Marlowe <scott.marlowe@gmail.com> wrote:
>> Timothy Madden <terminatorul@gmail.com> wrote:
>
>>> My scenario is how to protect the database if the machine is
>>> stolen (it is a mini-laptop), and I would like to encrypt the
>>> entire database, that is all columns of all tables, and if
>>> possible everything else found in the database.
>>>
>>> I would like all searching and sorting functions, just like with
>>> a normal database (that is, transparent encryption for the
>>> application level). The password will be entered by a human in
>>> order to start the application.
>
>> Everything you've said so far points to using a mounted encrypted
>> drive to store the db.
>
> Agreed. I know you explicitly said you didn't want to use that in
> your original post, but you didn't say why. I don't think you're
> going to convince anyone here to put effort into something you can
> configure to "just work" with so little trouble on existing systems,
> without a really good argument.
Agreed here also. I don't see any reason for Postgres to provide this
sort of functionality when it can be done at the OS level. There is
going to be a significant performance hit -- that is why I would suggest
careful analysis and selective encryption instead. But if that isn't
important, an encrypted drive is probably the only option.
Joe
Attachments:
signature.asc (application/pgp-signature, 898B) download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: mail@joeconway.com, Kevin.Grittner@wicourts.gov, terminatorul@gmail.com, scott.marlowe@gmail.com
Subject: Re: Database level encryption
In-Reply-To: <4BBA6924.5050305@joeconway.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox