MIME-Version: 1.0
References: <CACgMzfwSDRF+kQr59h0-xGUobCeFZxwVzE_tUxF18DkVb+vuDQ@mail.gmail.com>
 <CAKAnmmKDCOdUT5JtJZz5papMO0zW1cnG4934d6aQVCQ_KdbUeg@mail.gmail.com>
 <CANzqJaA41CzNjkiQex+A0u9z11i6R3WQZJ+fkXfJO7VJwOMWzg@mail.gmail.com> <a1dae4a583d560a90c67872b766ead02ddb13e51.camel@cybertec.at>
In-Reply-To: <a1dae4a583d560a90c67872b766ead02ddb13e51.camel@cybertec.at>
From: Ron Johnson <ronljohnsonjr@gmail.com>
Date: Fri, 17 Oct 2025 08:47:40 -0400
Message-ID: <CANzqJaD=O-tsy7DWGTkT-mzyk_rQ6VrDGYTFYFY1oK65_n-hCA@mail.gmail.com>
Subject: Re: Enquiry about TDE with PgSQL
To: pgsql-general <pgsql-general@postgresql.org>
Content-Type: multipart/alternative; boundary="0000000000004e074906415a2442"
Archived-At: <https://www.postgresql.org/message-id/CANzqJaD%3DO-tsy7DWGTkT-mzyk_rQ6VrDGYTFYFY1oK65_n-hCA%40mail.gmail.com>
Precedence: bulk

--0000000000004e074906415a2442
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Fri, Oct 17, 2025 at 3:01=E2=80=AFAM Laurenz Albe <laurenz.albe@cybertec=
.at>
wrote:

> On Fri, 2025-10-17 at 00:49 -0400, Ron Johnson wrote:
> > On Thu, Oct 16, 2025 at 6:05=E2=80=AFPM Greg Sabino Mullane <htamfids@g=
mail.com>
> wrote:
> > >
> > > TDE, on the other hand, is a very complex and difficult thing to add
> into Postgres.
> >
> > TDE was added to SQL Server, with (to us, at least) minimally-noticed
> overhead.
> > Oracle has it, too, but I don't know the details.
> >
> > The bottom line is that requirements for TDE are escalating, whether yo=
u
> like it or
> > not, as Yet Another Layer Of Defense against hackers exfiltrating data,
> and then
> > threatening to leak it to the public.
>
> Bruce Momjian has interesting things to say about that in
> https://compiledconversations.com/6/ (unfortunately I don't remember wher=
e
> exactly in this 84 minute piece).
>
> It is a feature that users want (or need to comply with whatever they fee=
l
> they have to comply with).  On the other hand, it has very limited
> technical
> or security value, which hampers its acceptance into core.
>

I gave you a reason: "Yet Another Layer Of Defense against hackers
exfiltrating data".  It's the same reason PgBackRest encrypts backups.

--=20
Death to <Redacted>, and butter sauce.
Don't boil me, I'm still alive.
<Redacted> lobster!

--0000000000004e074906415a2442
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr">On Fri, Oct 17, 2025 at 3:01=E2=80=AFAM L=
aurenz Albe &lt;<a href=3D"mailto:laurenz.albe@cybertec.at">laurenz.albe@cy=
bertec.at</a>&gt; wrote:</div><div class=3D"gmail_quote gmail_quote_contain=
er"><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;bor=
der-left:1px solid rgb(204,204,204);padding-left:1ex">On Fri, 2025-10-17 at=
 00:49 -0400, Ron Johnson wrote:<br>
&gt; On Thu, Oct 16, 2025 at 6:05=E2=80=AFPM Greg Sabino Mullane &lt;<a hre=
f=3D"mailto:htamfids@gmail.com" target=3D"_blank">htamfids@gmail.com</a>&gt=
; wrote:<br>
&gt; &gt; <br>
&gt; &gt; TDE, on the other hand, is a very complex and difficult thing to =
add into=C2=A0Postgres.<br>
&gt; <br>
&gt; TDE was added to SQL Server, with (to us, at least) minimally-noticed =
overhead.<br>
&gt; Oracle has it, too, but I don&#39;t know the details.<br>
&gt; <br>
&gt; The bottom line is that requirements for TDE are escalating, whether y=
ou like it or<br>
&gt; not, as Yet Another Layer Of Defense against hackers exfiltrating data=
, and then<br>
&gt; threatening to leak it to the public.<br>
<br>
Bruce Momjian has interesting things to say about that in<br>
<a href=3D"https://compiledconversations.com/6/" rel=3D"noreferrer" target=
=3D"_blank">https://compiledconversations.com/6/</a> (unfortunately I don&#=
39;t remember where<br>
exactly in this 84 minute piece).<br>
<br>
It is a feature that users want (or need to comply with whatever they feel<=
br>
they have to comply with).=C2=A0 On the other hand, it has very limited tec=
hnical<br>
or security value, which hampers its acceptance into core.<br></blockquote>=
<div><br></div><div>I gave you a reason: &quot;Yet Another Layer Of Defense=
 against hackers exfiltrating data&quot;.=C2=A0 It&#39;s the same reason Pg=
BackRest encrypts backups.</div><div><br></div></div><span class=3D"gmail_s=
ignature_prefix">-- </span><br><div dir=3D"ltr" class=3D"gmail_signature"><=
div dir=3D"ltr">Death to &lt;Redacted&gt;, and butter sauce.<div>Don&#39;t =
boil me, I&#39;m still alive.<br><div><div>&lt;Redacted&gt; lobster!</div><=
/div></div></div></div></div>

--0000000000004e074906415a2442--