Content-Type: text/plain;
	charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3776.700.51.11.4\))
Subject: Re: Enquiry about TDE with PgSQL
From: Christophe Pettus <xof@thebuild.com>
In-Reply-To: <CO1PR19MB4984B665A5F9F38A5E0FB5969BF9A@CO1PR19MB4984.namprd19.prod.outlook.com>
Date: Fri, 31 Oct 2025 18:35:52 -0700
Cc: Bruce Momjian <bruce@momjian.us>,
 pgsql-general <pgsql-general@postgresql.org>,
 Kai Wagner <kai.wagner@percona.com>,
 Laurenz Albe <laurenz.albe@cybertec.at>,
 Ron Johnson <ronljohnsonjr@gmail.com>
Content-Transfer-Encoding: quoted-printable
Message-Id: <3DC589BC-A5F6-49BC-BFFC-F1FCB0FF7E95@thebuild.com>
References: <CACgMzfwSDRF+kQr59h0-xGUobCeFZxwVzE_tUxF18DkVb+vuDQ@mail.gmail.com>
 <CAKAnmmKDCOdUT5JtJZz5papMO0zW1cnG4934d6aQVCQ_KdbUeg@mail.gmail.com>
 <CANzqJaA41CzNjkiQex+A0u9z11i6R3WQZJ+fkXfJO7VJwOMWzg@mail.gmail.com>
 <a1dae4a583d560a90c67872b766ead02ddb13e51.camel@cybertec.at>
 <aQPDvqUzZVKkaxsS@momjian.us>
 <CAG0qCNhL=SEB4vc4v48PxN1F-t8htC463TpX7KDNWQ-s3s8dtA@mail.gmail.com>
 <aQTNmM-3VeTRZdx0@momjian.us>
 <FC8C7F2D-CD38-42C7-80D3-516239B70A2D@thebuild.com>
 <aQVScCjItvCtgVPn@momjian.us>
 <CO1PR19MB4984B665A5F9F38A5E0FB5969BF9A@CO1PR19MB4984.namprd19.prod.outlook.com>
To: "Clay Jackson (cjackson)" <Clay.Jackson@quest.com>
Archived-At: <https://www.postgresql.org/message-id/3DC589BC-A5F6-49BC-BFFC-F1FCB0FF7E95%40thebuild.com>
Precedence: bulk

On Oct 31, 2025, at 17:24, Clay Jackson (cjackson) =
<Clay.Jackson@quest.com> wrote:
>=20
> I can't disagree - but the question them becomes, as Markus and other =
have pointed out; would that allow a customer/user to check the =
"Encryption" box for PCI or any other "compliance review"

The answer is: it depends (doesn't it always?).  Doing secure =
column-level encryption meets the PCI standard, and a competent PCI =
auditor will know that.  However, TDE has this cache as being "the way =
one does it," and if the organization is that way, it's hard to move =
them off of it.

As a sign of how the PCI world views TDE, at least one of the major =
credit card associations does not use it, and they have literally =
everyone's credit card number, with expiration date and CVV, sitting on =
their disks.=