From: Chris Browne <cbbrowne@acm.org>
To: pgsql-admin@postgresql.org
Subject: Re: Database level encryption
Date: Wed, 07 Apr 2010 14:58:35 -0400
Message-ID: <87iq833x9g.fsf@ca.afilias.info> (raw)
References: <q2y5078d8af1004030635g624bf8f7r580cb3ebe7135b74@mail.gmail.com>
<4BB774D4.3070306@joeconway.com>
<m2r5078d8af1004051330n1874e532u3c88fd1bc31c8697@mail.gmail.com>
<v2ldcc563d11004051334ledfcd2b2gf8db60ca48b43118@mail.gmail.com>
<4BBA05E80200002500030493@gw.wicourts.gov>
<4BBA6924.5050305@joeconway.com>
<t2k5078d8af1004070324m1f3d4f26lbc7f559e73d555ed@mail.gmail.com>
terminatorul@gmail.com (Timothy Madden) writes:
> Andreas 'ads' Scherbaum <adsmail@wars-nicht.de> wrote:
>
>> If someone captures the machine the bad guy can install a network
>> sniffer and steal the database passwords upon connect.
>
> I think protecting against a keylogger is a different issue than
> database encryption. Is this why database encryption is "not needed"
> for PostgreSQL, as people here say ?
No, the nuance is a bit different.
It's not that "database encryption is not needed" - it's rather that
"database encryption doesn't usefully protect against a terribly
interesting set of attacks."
When we think through the scenarios, while encrypting the whole database
might seemingly protect against *some* attacks, that's not enough of the
story:
- There are various classes of attacks that it doesn't help one bit
with.
- In order to have the database accessible to the postmaster process,
there needs to be a copy of the decryption key on that machine,
and it is surprisingly difficult to protect that key from someone
who has physical access to the machine.
This has the result that people are inclined to suggest that encrypting
the whole database mayn't actually be a terribly useful technique in
practice.
--
Know how to blow any problem up into insolubility. Know how to use the
phrase "The new ~A system" to insult its argument, e.g., "I guess this
destructuring LET thing is fixed in the new Lisp system", or better yet,
PROLOG. -- from the Symbolics Guidelines for Sending Mail
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: cbbrowne@acm.org
Subject: Re: Database level encryption
In-Reply-To: <87iq833x9g.fsf@ca.afilias.info>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox