MIME-Version: 1.0
References: <CACgMzfwSDRF+kQr59h0-xGUobCeFZxwVzE_tUxF18DkVb+vuDQ@mail.gmail.com>
 <CAKAnmmKDCOdUT5JtJZz5papMO0zW1cnG4934d6aQVCQ_KdbUeg@mail.gmail.com>
 <CANzqJaA41CzNjkiQex+A0u9z11i6R3WQZJ+fkXfJO7VJwOMWzg@mail.gmail.com>
 <a1dae4a583d560a90c67872b766ead02ddb13e51.camel@cybertec.at>
 <aQPDvqUzZVKkaxsS@momjian.us> <CAG0qCNhL=SEB4vc4v48PxN1F-t8htC463TpX7KDNWQ-s3s8dtA@mail.gmail.com>
 <aQTNmM-3VeTRZdx0@momjian.us>
In-Reply-To: <aQTNmM-3VeTRZdx0@momjian.us>
From: Greg Sabino Mullane <htamfids@gmail.com>
Date: Fri, 31 Oct 2025 11:25:04 -0400
Message-ID: <CAKAnmmKYP0DZpBhFXFBAbpkEkGt8g+MKOsSR=M+nKbvLZ8v89w@mail.gmail.com>
Subject: Re: Enquiry about TDE with PgSQL
To: Bruce Momjian <bruce@momjian.us>
Cc: Kai Wagner <kai.wagner@percona.com>, Laurenz Albe <laurenz.albe@cybertec.at>, 
	Ron Johnson <ronljohnsonjr@gmail.com>, pgsql-general <pgsql-general@postgresql.org>
Content-Type: multipart/alternative; boundary="0000000000007dac62064275fa86"
Archived-At: <https://www.postgresql.org/message-id/CAKAnmmKYP0DZpBhFXFBAbpkEkGt8g%2BMKOsSR%3DM%2BnKbvLZ8v89w%40mail.gmail.com>
Precedence: bulk

--0000000000007dac62064275fa86
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Fri, Oct 31, 2025 at 10:54=E2=80=AFAM Bruce Momjian <bruce@momjian.us> w=
rote:

>         Disk-level and partition-level encryption typically encrypts
>         the entire disk or partition using the same key, with all data
>         automatically decrypted when the system runs or when an authorize=
d
> -->     user requests it. For this reason, disk-level encryption is not
> -->     appropriate to protect stored PAN on computers, laptops, servers,
>         storage arrays, or any other system that provides transparent
>         decryption upon user authentication.
>

Hmm, I read this a few times but still not sure what the technical
objection is. Yes, the entire disk is encrypted with the same key, but why
is that insufficient to protect things? Anyone care to guess what they are
thinking here?

The biggest possible downside of this standoff is that enterprises that
> need to meet PCI compliance specifications are forced to use specialized
> versions of Postgres or Postgres extensions that support TDE.
>

Not always a downside for the companies selling those specialized versions
though.

Cheers,
Greg

--
Crunchy Data - https://www.crunchydata.com
Enterprise Postgres Software Products & Tech Support

--0000000000007dac62064275fa86
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr">On Fri, Oct 31, 2025 at 10:54=E2=80=AFAM =
Bruce Momjian &lt;<a href=3D"mailto:bruce@momjian.us">bruce@momjian.us</a>&=
gt; wrote:</div><div class=3D"gmail_quote gmail_quote_container"><blockquot=
e class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px s=
olid rgb(204,204,204);padding-left:1ex">=C2=A0 =C2=A0 =C2=A0 =C2=A0 Disk-le=
vel and partition-level encryption typically encrypts<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 the entire disk or partition using the same key=
, with all data<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 automatically decrypted when the system runs or=
 when an authorized<br>
--&gt;=C2=A0 =C2=A0 =C2=A0user requests it. For this reason, disk-level enc=
ryption is not<br>
--&gt;=C2=A0 =C2=A0 =C2=A0appropriate to protect stored PAN on computers, l=
aptops, servers,<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 storage arrays, or any other system that provid=
es transparent<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 decryption upon user authentication.<br></block=
quote><div><br></div><div>Hmm, I read this a few times but still not sure w=
hat the technical objection is. Yes, the entire disk is encrypted with the =
same key, but why is that insufficient to protect things? Anyone care to gu=
ess what they are thinking here?</div><div><br></div><blockquote class=3D"g=
mail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204=
,204,204);padding-left:1ex">
The biggest possible downside of this standoff is that enterprises that nee=
d to meet PCI compliance specifications are forced to use specialized versi=
ons of Postgres or Postgres extensions that support TDE.<br></blockquote><d=
iv><br></div><div>Not always a downside for the companies selling those spe=
cialized versions though.</div><div><br></div></div><div dir=3D"ltr" class=
=3D"gmail_signature"><div dir=3D"ltr"><div>Cheers,</div><div>Greg</div><div=
><br></div><div>--</div><div>Crunchy Data - <a href=3D"https://www.crunchyd=
ata.com" target=3D"_blank">https://www.crunchydata.com</a></div><div>Enterp=
rise Postgres Software Products &amp; Tech Support</div><div><br></div></di=
v></div></div>

--0000000000007dac62064275fa86--