Content-Type: text/plain;
	charset=utf-8
Mime-Version: 1.0 (1.0)
Subject: Re: Encryption / Decryption via PGCrypto
From: Evan Bauer <evanbauer@mac.com>
In-Reply-To: <20181024090024.jyw2f4l2uygydh3y@office.hexack.fr>
Date: Wed, 24 Oct 2018 23:47:11 -0400
Cc: Anjul Tyagi <anjul@ibosstech-us.com>, pgsql-admin@postgresql.org
Content-Transfer-Encoding: quoted-printable
Message-Id: <95B4AD74-4749-4018-A2F9-93C550E52E69@mac.com>
References: <emd6be52d7-a1bc-4178-87c6-6da99c9ca005@iboss01081>
 <20181024090024.jyw2f4l2uygydh3y@office.hexack.fr>
To: =?utf-8?Q?St=C3=A9phane_KANSCHINE?= <stephane@hexack.fr>
Precedence: bulk

All depends on how secure you want to be in the event of a hostile network p=
enetration.

If the answer is =E2=80=9Cvery=E2=80=9D, consider using a key management sol=
ution =E2=80=94 either software (I like Hashicorp Vault) or dedicated HSM ha=
rdware from someone like Gemalto or Thales.

Having the key on a separate server doesn=E2=80=99t help if the application s=
erver is compromised.

Cheers,

Evan

Sent from my iPhone

> On Oct 24, 2018, at 05:00, St=C3=A9phane KANSCHINE <stephane@hexack.fr> wr=
ote:
>=20
>=20
> Hi,
>=20
> Le mer. 24 oct., vers 08:27, Anjul Tyagi exprimait :
>>=20
>> We are implementing the pgcrypto in our database to encrypt and decrypt t=
he
>> Column data. for testing purpose we have generate the PGP public / privat=
e
>> key and use those when we read and write data.
>>=20
>> How can we secure the key, if we keep the key outside how can we use that=

>> into query.
>=20
> We keep the private key on the app server. It communicates with postgres
> through SSL and postgres logs aren't too verbose in order to avoid key
> exposition.
>=20
> If there's a better way, i'm curious of it.
>=20
> Regards,
> --=20
> St=C3=A9phane KANSCHINE - https://www.hexack.fr./ - https://www.nuajik.io.=
/
> =EF=BC=A0 stephane@hexack.fr
> =EE=88=81  +33 6 64 31 72 52
>=20