MIME-Version: 1.0
References: <CACgMzfwSDRF+kQr59h0-xGUobCeFZxwVzE_tUxF18DkVb+vuDQ@mail.gmail.com>
 <CAKAnmmKDCOdUT5JtJZz5papMO0zW1cnG4934d6aQVCQ_KdbUeg@mail.gmail.com>
 <CANzqJaA41CzNjkiQex+A0u9z11i6R3WQZJ+fkXfJO7VJwOMWzg@mail.gmail.com>
 <a1dae4a583d560a90c67872b766ead02ddb13e51.camel@cybertec.at>
 <aQPDvqUzZVKkaxsS@momjian.us> <CAG0qCNhL=SEB4vc4v48PxN1F-t8htC463TpX7KDNWQ-s3s8dtA@mail.gmail.com>
 <aQTNmM-3VeTRZdx0@momjian.us> <CAKAnmmKYP0DZpBhFXFBAbpkEkGt8g+MKOsSR=M+nKbvLZ8v89w@mail.gmail.com>
In-Reply-To: <CAKAnmmKYP0DZpBhFXFBAbpkEkGt8g+MKOsSR=M+nKbvLZ8v89w@mail.gmail.com>
From: Ron Johnson <ronljohnsonjr@gmail.com>
Date: Fri, 31 Oct 2025 11:34:45 -0400
Message-ID: <CANzqJaC378Dt92YCPuuj_eWTY=wE0RQJoMM84gtsX_4mtm156g@mail.gmail.com>
Subject: Re: Enquiry about TDE with PgSQL
To: pgsql-general <pgsql-general@postgresql.org>
Content-Type: multipart/alternative; boundary="0000000000009d22bc0642761bdd"
Archived-At: <https://www.postgresql.org/message-id/CANzqJaC378Dt92YCPuuj_eWTY%3DwE0RQJoMM84gtsX_4mtm156g%40mail.gmail.com>
Precedence: bulk

--0000000000009d22bc0642761bdd
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Fri, Oct 31, 2025 at 11:25=E2=80=AFAM Greg Sabino Mullane <htamfids@gmai=
l.com>
wrote:

> On Fri, Oct 31, 2025 at 10:54=E2=80=AFAM Bruce Momjian <bruce@momjian.us>=
 wrote:
>
>>         Disk-level and partition-level encryption typically encrypts
>>         the entire disk or partition using the same key, with all data
>>         automatically decrypted when the system runs or when an authoriz=
ed
>> -->     user requests it. For this reason, disk-level encryption is not
>> -->     appropriate to protect stored PAN on computers, laptops, servers=
,
>>         storage arrays, or any other system that provides transparent
>>         decryption upon user authentication.
>>
>
> Hmm, I read this a few times but still not sure what the technical
> objection is. Yes, the entire disk is encrypted with the same key, but wh=
y
> is that insufficient to protect things? Anyone care to guess what they ar=
e
> thinking here?
>

Networking.

Who breaks into a DC and steals a rack of disks or SSDs?  Very, very few
evil-doers.
Who hacks into networks and exfiltrates data over the wire?  Many hackers.

--=20
Death to <Redacted>, and butter sauce.
Don't boil me, I'm still alive.
<Redacted> lobster!

--0000000000009d22bc0642761bdd
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr">On Fri, Oct 31, 2025 at 11:25=E2=80=AFAM =
Greg Sabino Mullane &lt;<a href=3D"mailto:htamfids@gmail.com">htamfids@gmai=
l.com</a>&gt; wrote:</div><div class=3D"gmail_quote gmail_quote_container">=
<blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-=
left:1px solid rgb(204,204,204);padding-left:1ex"><div dir=3D"ltr"><div dir=
=3D"ltr">On Fri, Oct 31, 2025 at 10:54=E2=80=AFAM Bruce Momjian &lt;<a href=
=3D"mailto:bruce@momjian.us" target=3D"_blank">bruce@momjian.us</a>&gt; wro=
te:</div><div class=3D"gmail_quote"><blockquote class=3D"gmail_quote" style=
=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding=
-left:1ex">=C2=A0 =C2=A0 =C2=A0 =C2=A0 Disk-level and partition-level encry=
ption typically encrypts<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 the entire disk or partition using the same key=
, with all data<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 automatically decrypted when the system runs or=
 when an authorized<br>
--&gt;=C2=A0 =C2=A0 =C2=A0user requests it. For this reason, disk-level enc=
ryption is not<br>
--&gt;=C2=A0 =C2=A0 =C2=A0appropriate to protect stored PAN on computers, l=
aptops, servers,<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 storage arrays, or any other system that provid=
es transparent<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 decryption upon user authentication.<br></block=
quote><div><br></div><div>Hmm, I read this a few times but still not sure w=
hat the technical objection is. Yes, the entire disk is encrypted with the =
same key, but why is that insufficient to protect things? Anyone care to gu=
ess what they are thinking here?</div></div></div></blockquote><div><br></d=
iv><div>Networking.</div><div><br></div><div>Who breaks into a DC and steal=
s a rack of disks or SSDs?=C2=A0 Very, very few evil-doers.</div><div>Who h=
acks into networks and exfiltrates=C2=A0data over the wire?=C2=A0 Many hack=
ers.</div><div><br></div></div><span class=3D"gmail_signature_prefix">-- </=
span><br><div dir=3D"ltr" class=3D"gmail_signature"><div dir=3D"ltr">Death =
to &lt;Redacted&gt;, and butter sauce.<div>Don&#39;t boil me, I&#39;m still=
 alive.<br><div><div>&lt;Redacted&gt; lobster!</div></div></div></div></div=
></div>

--0000000000009d22bc0642761bdd--