From: "Clay Jackson (cjackson)" <Clay.Jackson@quest.com>
To: Bruce Momjian <bruce@momjian.us>, Laurenz Albe <laurenz.albe@cybertec.at>
CC: Kai Wagner <kai.wagner@percona.com>, Chris Travers
	<chris.travers@gmail.com>, Christophe Pettus <xof@thebuild.com>,
	pgsql-general <pgsql-general@postgresql.org>, Ron Johnson
	<ronljohnsonjr@gmail.com>
Subject: RE: Enquiry about TDE with PgSQL
Thread-Topic: Enquiry about TDE with PgSQL
Thread-Index:
 AQHcPFne1JzuDE18N0KxA2R/9Mt46rTFWROAgABw9QCAACUYAIAVR7UAgAEuQwCAAA6oAIAAnP6AgAABXwCAAABTwIAAFJMAgAAtgICAADbUgIAAayIAgAFT6ACAAgJ/gIAAHYcAgAB7/wCAANnrYA==
Date: Tue, 4 Nov 2025 15:15:31 +0000
Message-ID:
 <CO1PR19MB49847F734F21EBC869A2D0929BC4A@CO1PR19MB4984.namprd19.prod.outlook.com>
References: <FC8C7F2D-CD38-42C7-80D3-516239B70A2D@thebuild.com>
 <aQVScCjItvCtgVPn@momjian.us>
 <CO1PR19MB4984B665A5F9F38A5E0FB5969BF9A@CO1PR19MB4984.namprd19.prod.outlook.com>
 <3DC589BC-A5F6-49BC-BFFC-F1FCB0FF7E95@thebuild.com>
 <CAKt_ZfuwPgG_nJHp6S=8k_+NdA6Op7hE0z7+s4-HuBqr1cnwsg@mail.gmail.com>
 <CAG0qCNjd2m9Ej1ZEwuCCkgsqJz0vnso3ZFwjKCxzwUfnfu=SNw@mail.gmail.com>
 <aQYSAGEfd116_58N@momjian.us>
 <CAG0qCNgV+Ra72vTvCoTZqn7KUUsXvp3N=ZUgACgMTDDPt8WTkA@mail.gmail.com>
 <aQjeuRsBLS6cXNLC@momjian.us>
 <bb3db67c53fc1c58ba1fae740b52cb7450fbcab3.camel@cybertec.at>
 <aQlfgmZO9seHsmMx@momjian.us>
In-Reply-To: <aQlfgmZO9seHsmMx@momjian.us>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0:
 =?us-ascii?Q?33OYtmPE/w16fhNuJdMIg6nXh8sR54hpfGB/iVRIp5aRENIIk1dl8wvBVvSx?=
 =?us-ascii?Q?a5ehXi2y/+MM8ODvx+GkPkW57lCAe5oNN6sJVFW5mIs2RIDAU2gnb8NpQ2bG?=
 =?us-ascii?Q?LL99d3Ff+5PJH5K4+dOA89UiKIakNLm8CTZ6SS6uk1iVxHl2TYdnPjD6OW04?=
 =?us-ascii?Q?VXyZkyvG7A9rhzsk+PylMqBa2150c+I2hgiBXX3M6MzgmGYEAdTQKRy1cocN?=
 =?us-ascii?Q?S4RMDkGUPwKUEQaFIsQkjkF9nyTG3rFozVFfOoAxAbUM31j2qws2+h5xhQr1?=
 =?us-ascii?Q?gMN5hqLpQ7gmINFXVbXeRADQdEzJZLbLIE4968wkZ/rA+gwjcjJBm6EufUqz?=
 =?us-ascii?Q?FhAvTYcuCPcd272Qk1zUrU1heXuZYkTUK3QUBgSeAqEuKbz56ztX4c3Gq5Pf?=
 =?us-ascii?Q?OsflWhm8lbc1c7RzsMHsT5+8j67KUYhSfwM3YGlGK2WE4UVLws0Yk8EhtaPg?=
 =?us-ascii?Q?Lmy/Ox1je4/bvzK0zqcW2OPhhfVRnKwSAYPw+jeKN23oRPbztq/Gp81vq5P1?=
 =?us-ascii?Q?Sa+22snzOaoQi1NTE4fa1WO8EbXaI0eFFgMds3bQBOzkrm7NQ9zwWpQERemA?=
 =?us-ascii?Q?IJjhMxtx1nTi65twVrbvA6UzzGGRj3gOAJkbo+RPiTFczyQfCanyVfVmAxcu?=
 =?us-ascii?Q?FsCa3G4Qjl37FRwPFgJ3cAC4B+jXw2kdZaGWSzJk768PvrbD3FQc9d2zzTpE?=
 =?us-ascii?Q?cP93fXJt/GzxwYL32clP4u1J395e1OHIInpY1AWr2caMhVsTZc1W77xusNFN?=
 =?us-ascii?Q?CmZUqy4q+EY11NyaQ73M9SPndNTYjJAlbJqwmxav63Y4650jDpHuE7ZQZn//?=
 =?us-ascii?Q?Sdg6kIhcHWTvE/B3fF7fmgOQf44Ju246zQ8qfma+xyiGr944mKYLLWUplQte?=
 =?us-ascii?Q?CW0RlOolvm4ftDh09VtHxr8d91Tt39YRZAP+G32ot1fPer4yK/IEVnBIHY+8?=
 =?us-ascii?Q?S87hvkF/agArtYX7GQ2thEyInCYaF7isdRcDIlDU62WTHMxHi3CVj2t4zHo7?=
 =?us-ascii?Q?BhsvWvkA208gZ8MEdc4wRp6PN/GlTNpkW9eFe/dao9cLq3e+uPfKO7ezvvuZ?=
 =?us-ascii?Q?5ThwPJXqpwgekrKOAYpCA9aGw+V0skBkXuDY7Ya8I9ScrFeKY7U20m2iCunz?=
 =?us-ascii?Q?6qNCA5MDEC28cSaI2TnPV1DVXn8Nk7110oeImEb1rN/CNFvjU57XTuaYktne?=
 =?us-ascii?Q?UtCjDkYxQf19unFqcwMMfs0REOuMZ+AgyTdeGT4rZXO1hQAedFCbIm1IU20J?=
 =?us-ascii?Q?8R4kTvpYK60KryLFRSbC4OyOa4MLT0/PVtTGvqyo84dKquI6mOCVvtv5ELvs?=
 =?us-ascii?Q?27pxNQXWPDF63ctb789iwvqi4YCuTMofMDgSdybRL15ex+5UY4so1t9BNly7?=
 =?us-ascii?Q?1D/AGiCKRWcfUK9zroLos8v/Hr9BUuT8fYrmjwsBsTE3jo+xSuhz5fBOjgJC?=
 =?us-ascii?Q?bNl5S2/96gqSh7wKr5WUzLSAibosVgluaIfhECmoE/hR9tQyHFM20KIw4fFU?=
 =?us-ascii?Q?Hxc78IEEYSQ7xXjzKKWjlfudSNekn8UaV5oCunw+UmX5vDkPtHrcK0WefKMX?=
 =?us-ascii?Q?oBLAeC8eH7ESpvYiGv2vHmX1uHdTgNvnzr2uR+qw?=
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: quest.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: CO1PR19MB4984.namprd19.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 562791df-095e-45f3-8600-08de1bb4fe9a
X-MS-Exchange-CrossTenant-originalarrivaltime: 04 Nov 2025 15:15:31.2173
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 91c369b5-1c9e-439c-989c-1867ec606603
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: hCegX40Gx5txlYKou7+yPuX1ykicuWwbvFgCWOT0QK/h/C9lzYWi8HL/bFOzeGgUxLMj1Cy5NntEzb+NO5TDpw==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL1PPF48DA19079
List-Id: <pgsql-general.lists.postgresql.org>
List-Help: <https://lists.postgresql.org/manage/>
List-Subscribe: <https://lists.postgresql.org/manage/>
List-Post: <mailto:pgsql-general@lists.postgresql.org>
List-Owner: <mailto:pgsql-general-owner@lists.postgresql.org>
List-Archive: <https://www.postgresql.org/list/pgsql-general>
Archived-At: <https://www.postgresql.org/message-id/CO1PR19MB49847F734F21EBC869A2D0929BC4A%40CO1PR19MB4984.namprd19.prod.outlook.com>
Precedence: bulk

Again, speaking for myself only and not officially for Quest.

" Uh, people will say that if the solution is not 100% secure in its covera=
ge, it is much less useful and therefore not worth it."

I would assert that NO system is "100% secure" given enough money and resou=
rces.   I think the more important point of this discussion is how users of=
 PostgreSQL can "check the box" for compliance with whatever security and e=
ncryption "standards" are "required" in their environment, and/or mitigate =
the risks of not being "compliant".

Clay Jackson

-----Original Message-----
From: Bruce Momjian <bruce@momjian.us>
Sent: Monday, November 3, 2025 6:06 PM
To: Laurenz Albe <laurenz.albe@cybertec.at>
Cc: Kai Wagner <kai.wagner@percona.com>; Chris Travers <chris.travers@gmail=
.com>; Christophe Pettus <xof@thebuild.com>; Clay Jackson (cjackson) <Clay.=
Jackson@quest.com>; pgsql-general <pgsql-general@postgresql.org>; Ron Johns=
on <ronljohnsonjr@gmail.com>
Subject: Re: Enquiry about TDE with PgSQL

CAUTION: This email originated from outside of the organization. Do not fol=
low guidance, click links, or open attachments unless you recognize the sen=
der and know the content is safe.


On Mon, Nov  3, 2025 at 07:42:06PM +0100, Laurenz Albe wrote:
> On Mon, 2025-11-03 at 11:56 -0500, Bruce Momjian wrote:
> > The problem with the Percona extension is it seems like it was
> > developed mostly/all by Percona employees, meaning development was
> > driven/steered by Percona, and there was insufficient feedback from
> > the community for it to be polished enough to be a general community so=
lution.
>
> Reading a Percona blog, it looks like you need a modified server to
> get to encrypt WAL, and they probably have no support for encrypting
> temporary files.  So I'd say that TDE can probably not be a pure extensio=
n.
> Perhaps somebody from Percona can confirm.

Yes, the server has to be modified because the hooks they need don't exist =
in the community source code.  They also have encryption control on the tab=
le level, which I frankly think will never work long-term because the stora=
ge API doesn't have enough table-level detail, so I think they are consider=
ing tablespace-level or cluster-level encryption.

> But I don't think it's a shortage of implementations for TDE that is
> the problem.
>
> Since you say that encrypting the temp files is the biggest hurdle for
> community acceptance, what about a first version that does not encrypt
> temp files?  For one, that will be good for encrypted backups (which
> is one of the good use cases for TDE), and then you could argue that
> temp files are not data *at rest*, so data-at-rest-encryption does not
> apply to them.  Rome wasn't built in a day, and neither were parallel
> query or declarative partitioning.

Uh, people will say that if the solution is not 100% secure in its coverage=
, it is much less useful and therefore not worth it.

--
  Bruce Momjian  <bruce@momjian.us>        https://momjian.us/
  EDB                                      https://enterprisedb.com/

  Do not let urgent matters crowd out time for investment in the future.