pg.ddx.io  pgsql-admin@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Evan Bauer <evanbauer@mac.com>
To: Stéphane KANSCHINE <stephane@hexack.fr>
Cc: Anjul Tyagi <anjul@ibosstech-us.com>
Cc: pgsql-admin@postgresql.org
Subject: Re: Encryption / Decryption via PGCrypto
Date: Wed, 24 Oct 2018 23:47:11 -0400
Message-ID: <95B4AD74-4749-4018-A2F9-93C550E52E69@mac.com> (raw)
In-Reply-To: <20181024090024.jyw2f4l2uygydh3y@office.hexack.fr>
References: <emd6be52d7-a1bc-4178-87c6-6da99c9ca005@iboss01081>
	<20181024090024.jyw2f4l2uygydh3y@office.hexack.fr>

All depends on how secure you want to be in the event of a hostile network penetration.

If the answer is “very”, consider using a key management solution — either software (I like Hashicorp Vault) or dedicated HSM hardware from someone like Gemalto or Thales.

Having the key on a separate server doesn’t help if the application server is compromised.

Cheers,

Evan

Sent from my iPhone

> On Oct 24, 2018, at 05:00, Stéphane KANSCHINE <stephane@hexack.fr> wrote:
> 
> 
> Hi,
> 
> Le mer. 24 oct., vers 08:27, Anjul Tyagi exprimait :
>> 
>> We are implementing the pgcrypto in our database to encrypt and decrypt the
>> Column data. for testing purpose we have generate the PGP public / private
>> key and use those when we read and write data.
>> 
>> How can we secure the key, if we keep the key outside how can we use that
>> into query.
> 
> We keep the private key on the app server. It communicates with postgres
> through SSL and postgres logs aren't too verbose in order to avoid key
> exposition.
> 
> If there's a better way, i'm curious of it.
> 
> Regards,
> -- 
> Stéphane KANSCHINE - https://www.hexack.fr./ - https://www.nuajik.io./
> ＠ stephane@hexack.fr
>   +33 6 64 31 72 52
> 





view thread (3+ messages)

Message-ID: <95B4AD74-4749-4018-A2F9-93C550E52E69@mac.com>
Permalink:  ../95B4AD74-4749-4018-A2F9-93C550E52E69@mac.com/
Also on:    postgresql.org/message-id/95B4AD74-4749-4018-A2F9-93C550E52E69@mac.com

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-admin@postgresql.org
  Cc: evanbauer@mac.com, stephane@hexack.fr, anjul@ibosstech-us.com
  Subject: Re: Encryption / Decryption via PGCrypto
  In-Reply-To: <95B4AD74-4749-4018-A2F9-93C550E52E69@mac.com>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox