MIME-Version: 1.0
References: <CACgMzfwSDRF+kQr59h0-xGUobCeFZxwVzE_tUxF18DkVb+vuDQ@mail.gmail.com>
 <CAKAnmmKDCOdUT5JtJZz5papMO0zW1cnG4934d6aQVCQ_KdbUeg@mail.gmail.com>
 <CANzqJaA41CzNjkiQex+A0u9z11i6R3WQZJ+fkXfJO7VJwOMWzg@mail.gmail.com>
 <a1dae4a583d560a90c67872b766ead02ddb13e51.camel@cybertec.at>
 <aQPDvqUzZVKkaxsS@momjian.us> <CAG0qCNhL=SEB4vc4v48PxN1F-t8htC463TpX7KDNWQ-s3s8dtA@mail.gmail.com>
 <aQTNmM-3VeTRZdx0@momjian.us> <FC8C7F2D-CD38-42C7-80D3-516239B70A2D@thebuild.com>
 <aQVScCjItvCtgVPn@momjian.us> <CO1PR19MB4984B665A5F9F38A5E0FB5969BF9A@CO1PR19MB4984.namprd19.prod.outlook.com>
 <3DC589BC-A5F6-49BC-BFFC-F1FCB0FF7E95@thebuild.com>
In-Reply-To: <3DC589BC-A5F6-49BC-BFFC-F1FCB0FF7E95@thebuild.com>
From: Chris Travers <chris.travers@gmail.com>
Date: Sat, 1 Nov 2025 11:18:43 +0700
Message-ID: <CAKt_ZfuwPgG_nJHp6S=8k_+NdA6Op7hE0z7+s4-HuBqr1cnwsg@mail.gmail.com>
Subject: Re: Enquiry about TDE with PgSQL
To: Christophe Pettus <xof@thebuild.com>
Cc: "Clay Jackson (cjackson)" <Clay.Jackson@quest.com>, Bruce Momjian <bruce@momjian.us>, 
	pgsql-general <pgsql-general@postgresql.org>, Kai Wagner <kai.wagner@percona.com>, 
	Laurenz Albe <laurenz.albe@cybertec.at>, Ron Johnson <ronljohnsonjr@gmail.com>
Content-Type: multipart/alternative; boundary="000000000000c51772064280c79a"
Archived-At: <https://www.postgresql.org/message-id/CAKt_ZfuwPgG_nJHp6S%3D8k_%2BNdA6Op7hE0z7%2Bs4-HuBqr1cnwsg%40mail.gmail.com>
Precedence: bulk

--000000000000c51772064280c79a
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

I maintain that the way forward is to get TDE in core.  Perhaps someone
could pick up the previous patches and try to push them again


Best Wishes,
Chris Travers


On Sat, Nov 1, 2025, 8:36=E2=80=AFAM Christophe Pettus <xof@thebuild.com> w=
rote:

> On Oct 31, 2025, at 17:24, Clay Jackson (cjackson) <Clay.Jackson@quest.co=
m>
> wrote:
> >
> > I can't disagree - but the question them becomes, as Markus and other
> have pointed out; would that allow a customer/user to check the
> "Encryption" box for PCI or any other "compliance review"
>
> The answer is: it depends (doesn't it always?).  Doing secure column-leve=
l
> encryption meets the PCI standard, and a competent PCI auditor will know
> that.  However, TDE has this cache as being "the way one does it," and if
> the organization is that way, it's hard to move them off of it.
>
> As a sign of how the PCI world views TDE, at least one of the major credi=
t
> card associations does not use it, and they have literally everyone's
> credit card number, with expiration date and CVV, sitting on their disks.
>
>

--000000000000c51772064280c79a
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"auto"><div>I maintain that the way forward is to get TDE in cor=
e.=C2=A0 Perhaps someone could pick up the previous patches and try to push=
 them again</div><div dir=3D"auto"><br></div><div><br></div><div data-smart=
mail=3D"gmail_signature"><div dir=3D"ltr">Best Wishes,<div>Chris Travers</d=
iv><div><br></div></div></div></div><br><div class=3D"gmail_quote gmail_quo=
te_container"><div dir=3D"ltr" class=3D"gmail_attr">On Sat, Nov 1, 2025, 8:=
36=E2=80=AFAM Christophe Pettus &lt;<a href=3D"mailto:xof@thebuild.com">xof=
@thebuild.com</a>&gt; wrote:<br></div><blockquote class=3D"gmail_quote" sty=
le=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">On Oct=
 31, 2025, at 17:24, Clay Jackson (cjackson) &lt;<a href=3D"mailto:Clay.Jac=
kson@quest.com" target=3D"_blank" rel=3D"noreferrer">Clay.Jackson@quest.com=
</a>&gt; wrote:<br>
&gt; <br>
&gt; I can&#39;t disagree - but the question them becomes, as Markus and ot=
her have pointed out; would that allow a customer/user to check the &quot;E=
ncryption&quot; box for PCI or any other &quot;compliance review&quot;<br>
<br>
The answer is: it depends (doesn&#39;t it always?).=C2=A0 Doing secure colu=
mn-level encryption meets the PCI standard, and a competent PCI auditor wil=
l know that.=C2=A0 However, TDE has this cache as being &quot;the way one d=
oes it,&quot; and if the organization is that way, it&#39;s hard to move th=
em off of it.<br>
<br>
As a sign of how the PCI world views TDE, at least one of the major credit =
card associations does not use it, and they have literally everyone&#39;s c=
redit card number, with expiration date and CVV, sitting on their disks.<br=
>
<br>
</blockquote></div>

--000000000000c51772064280c79a--