MIME-Version: 1.0
References: <CACgMzfwSDRF+kQr59h0-xGUobCeFZxwVzE_tUxF18DkVb+vuDQ@mail.gmail.com>
In-Reply-To: <CACgMzfwSDRF+kQr59h0-xGUobCeFZxwVzE_tUxF18DkVb+vuDQ@mail.gmail.com>
From: Greg Sabino Mullane <htamfids@gmail.com>
Date: Thu, 16 Oct 2025 18:04:49 -0400
Message-ID: <CAKAnmmKDCOdUT5JtJZz5papMO0zW1cnG4934d6aQVCQ_KdbUeg@mail.gmail.com>
Subject: Re: Enquiry about TDE with PgSQL
To: Ashish Mukherjee <ashish.mukherjee@gmail.com>
Cc: pgsql-general@postgresql.org
Content-Type: multipart/alternative; boundary="00000000000058706406414dd03d"
Archived-At: <https://www.postgresql.org/message-id/CAKAnmmKDCOdUT5JtJZz5papMO0zW1cnG4934d6aQVCQ_KdbUeg%40mail.gmail.com>
Precedence: bulk

--00000000000058706406414dd03d
Content-Type: text/plain; charset="UTF-8"

>
> I would like to enquire that based on the anecdotal experience of group
> members, which TDE solution works best for PgSQL 17 databases.


Generally speaking, there is no "best". People use whatever vendor they
happen to already use. Your best solution is to avoid TDE altogether. If
you really need encryption at rest, have the OS do it. That works well
(transparently, even), is very battle-tested, and has minimal performance
impact. TDE, on the other hand, is a very complex and difficult thing to
add into Postgres. Currently it means you are using a forked version of
Postgres and are incurring overhead every time you read or write to disk.

 The scenario I have is of a large number of tables (15-20K) and some
> tables with 100M tuples each. The total database size is 4TB.


The size and number of tables does not really matter. How often you write
WAL, and how often things move in and out of shared buffers is what matters.

Cheers,
Greg

--00000000000058706406414dd03d
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px =
0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">I would =
like to enquire that based on the anecdotal experience of group members, wh=
ich TDE solution works best for PgSQL 17 databases.</blockquote><div><br></=
div>Generally speaking, there is no &quot;best&quot;. People use whatever v=
endor they happen to already use. Your best solution is to avoid TDE altoge=
ther. If you really need encryption at rest, have the OS do it. That works =
well (transparently, even), is very battle-tested, and has minimal performa=
nce impact. TDE, on the other hand, is a very complex and difficult thing t=
o add into=C2=A0Postgres. Currently it means=C2=A0you are using a forked ve=
rsion of Postgres and are incurring overhead every time you read or write t=
o disk.<div><br></div><div><blockquote class=3D"gmail_quote" style=3D"margi=
n:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex=
">=C2=A0The=C2=A0scenario I=C2=A0have is of a large number of tables (15-20=
K) and some tables with 100M tuples each. The total database size is 4TB.</=
blockquote><div><br></div></div><div>The size and number of tables does not=
 really matter. How often you write WAL, and how often things move in and o=
ut of shared buffers is what matters.</div><div><br></div><div>Cheers,</div=
><div>Greg</div><div><br></div></div>

--00000000000058706406414dd03d--