MIME-Version: 1.0
References: <CACgMzfwSDRF+kQr59h0-xGUobCeFZxwVzE_tUxF18DkVb+vuDQ@mail.gmail.com>
 <CAKAnmmKDCOdUT5JtJZz5papMO0zW1cnG4934d6aQVCQ_KdbUeg@mail.gmail.com>
In-Reply-To: <CAKAnmmKDCOdUT5JtJZz5papMO0zW1cnG4934d6aQVCQ_KdbUeg@mail.gmail.com>
From: Ron Johnson <ronljohnsonjr@gmail.com>
Date: Fri, 17 Oct 2025 00:49:06 -0400
Message-ID: <CANzqJaA41CzNjkiQex+A0u9z11i6R3WQZJ+fkXfJO7VJwOMWzg@mail.gmail.com>
Subject: Re: Enquiry about TDE with PgSQL
To: pgsql-general <pgsql-general@postgresql.org>
Content-Type: multipart/alternative; boundary="000000000000c4b950064153742b"
Archived-At: <https://www.postgresql.org/message-id/CANzqJaA41CzNjkiQex%2BA0u9z11i6R3WQZJ%2BfkXfJO7VJwOMWzg%40mail.gmail.com>
Precedence: bulk

--000000000000c4b950064153742b
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Thu, Oct 16, 2025 at 6:05=E2=80=AFPM Greg Sabino Mullane <htamfids@gmail=
.com>
wrote:

> I would like to enquire that based on the anecdotal experience of group
>> members, which TDE solution works best for PgSQL 17 databases.
>
>
> Generally speaking, there is no "best". People use whatever vendor they
> happen to already use. Your best solution is to avoid TDE altogether. If
> you really need encryption at rest, have the OS do it. That works well
> (transparently, even), is very battle-tested, and has minimal performance
> impact.
>

But filesystem encryption still means that validly logged-in users see the
unencrypted data.  That's great for a laptop that might get stolen, or for
drives that are discarded without being wiped, but are no protection
against hackers who want to exfiltrate your data.

(Neither protect against ransomware, but that's a different problem.)


> TDE, on the other hand, is a very complex and difficult thing to add
> into Postgres.
>

TDE was added to SQL Server, with (to us, at least) minimally-noticed
overhead.  Oracle has it, too, but I don't know the details.

The bottom line is that requirements for TDE are escalating, whether you
like it or not, as Yet Another Layer Of Defense against hackers
exfiltrating data, and then threatening to leak it to the public.

--=20
Death to <Redacted>, and butter sauce.
Don't boil me, I'm still alive.
<Redacted> lobster!

--000000000000c4b950064153742b
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr">On Thu, Oct 16, 2025 at 6:05=E2=80=AFPM G=
reg Sabino Mullane &lt;<a href=3D"mailto:htamfids@gmail.com">htamfids@gmail=
.com</a>&gt; wrote:</div><div class=3D"gmail_quote gmail_quote_container"><=
blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-l=
eft:1px solid rgb(204,204,204);padding-left:1ex"><div dir=3D"ltr"><blockquo=
te class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px =
solid rgb(204,204,204);padding-left:1ex">I would like to enquire that based=
 on the anecdotal experience of group members, which TDE solution works bes=
t for PgSQL 17 databases.</blockquote><div><br></div>Generally speaking, th=
ere is no &quot;best&quot;. People use whatever vendor they happen to alrea=
dy use. Your best solution is to avoid TDE altogether. If you really need e=
ncryption at rest, have the OS do it. That works well (transparently, even)=
, is very battle-tested, and has minimal performance impact.</div></blockqu=
ote><div><br></div><div>But filesystem encryption still means that validly =
logged-in users see the unencrypted data.=C2=A0 That&#39;s great for a lapt=
op that might get stolen, or for drives that are discarded without being wi=
ped, but are no protection against hackers who want to exfiltrate your data=
.</div><div><br></div><div>(Neither protect against ransomware, but that=
9;s a different problem.)</div><div>=C2=A0</div><blockquote class=3D"gmail_=
quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,=
204);padding-left:1ex"><div dir=3D"ltr"> TDE, on the other hand, is a very =
complex and difficult thing to add into=C2=A0Postgres.</div></blockquote><d=
iv><br></div><div>TDE was added to SQL Server, with (to us, at least) minim=
ally-noticed overhead.=C2=A0 Oracle has it, too, but I don&#39;t know the d=
etails.</div><div></div></div><div><br></div><div>The bottom line is that r=
equirements for TDE are escalating, whether you like it or not, as Yet Anot=
her Layer Of Defense against hackers exfiltrating data, and then threatenin=
g to leak it to the public.</div><div><br></div><span class=3D"gmail_signat=
ure_prefix">-- </span><br><div dir=3D"ltr" class=3D"gmail_signature"><div d=
ir=3D"ltr">Death to &lt;Redacted&gt;, and butter sauce.<div>Don&#39;t boil =
me, I&#39;m still alive.<br><div><div>&lt;Redacted&gt; lobster!</div></div>=
</div></div></div></div>

--000000000000c4b950064153742b--