From: "Clay Jackson (cjackson)" <Clay.Jackson@quest.com>
To: Bruce Momjian <bruce@momjian.us>, Christophe Pettus <xof@thebuild.com>
CC: pgsql-general <pgsql-general@postgresql.org>, Kai Wagner
	<kai.wagner@percona.com>, Laurenz Albe <laurenz.albe@cybertec.at>, Ron
 Johnson <ronljohnsonjr@gmail.com>
Subject: RE: Enquiry about TDE with PgSQL
Thread-Topic: Enquiry about TDE with PgSQL
Thread-Index:
 AQHcPFne1JzuDE18N0KxA2R/9Mt46rTFWROAgABw9QCAACUYAIAVR7UAgAEuQwCAAA6oAIAAnP6AgAABXwCAAABTwA==
Date: Sat, 1 Nov 2025 00:24:25 +0000
Message-ID:
 <CO1PR19MB4984B665A5F9F38A5E0FB5969BF9A@CO1PR19MB4984.namprd19.prod.outlook.com>
References:
 <CACgMzfwSDRF+kQr59h0-xGUobCeFZxwVzE_tUxF18DkVb+vuDQ@mail.gmail.com>
 <CAKAnmmKDCOdUT5JtJZz5papMO0zW1cnG4934d6aQVCQ_KdbUeg@mail.gmail.com>
 <CANzqJaA41CzNjkiQex+A0u9z11i6R3WQZJ+fkXfJO7VJwOMWzg@mail.gmail.com>
 <a1dae4a583d560a90c67872b766ead02ddb13e51.camel@cybertec.at>
 <aQPDvqUzZVKkaxsS@momjian.us>
 <CAG0qCNhL=SEB4vc4v48PxN1F-t8htC463TpX7KDNWQ-s3s8dtA@mail.gmail.com>
 <aQTNmM-3VeTRZdx0@momjian.us>
 <FC8C7F2D-CD38-42C7-80D3-516239B70A2D@thebuild.com>
 <aQVScCjItvCtgVPn@momjian.us>
In-Reply-To: <aQVScCjItvCtgVPn@momjian.us>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0:
 =?iso-8859-1?Q?Uz4u/565DiKsmLo+WYFVPJpyVJuToIzj6tRYJGN9fSXVEqYlidjKEwI09y?=
 =?iso-8859-1?Q?QSjWA4q3zfYxkLg9luckD0wGciNnWugHjP7luHdhlEyQQaE/oc4zKGNWjC?=
 =?iso-8859-1?Q?/AzRoWA81nes70MS2FwCBWKFeJsMyc1Rew0etQx3A5fNxDgQj+DVJaHmdL?=
 =?iso-8859-1?Q?kn3kTAIOi3VPd88y8cqX5IlQosi89ieIrrJRA9OQ0LbdD3yVtxHtceUJz8?=
 =?iso-8859-1?Q?UBEZ2fkOPJQk6qp92amUVLDWnVOG1kjb0K+YbKu3IILe4SdbefFlhVFUjS?=
 =?iso-8859-1?Q?ewqrJzB3DLbdIDa4cVdVoyRjt5UAOwq95OHzIMFXhjsRWN9avPsJD/WfB3?=
 =?iso-8859-1?Q?gbi9wFisesWFuOGkz5xX4yMxYjObThV1I3oILB/WYaZRX2chC8M8NzDTEf?=
 =?iso-8859-1?Q?UyMJbDjk0OIpwqlJMZQqE9ZrWtcWUt3w4haBejJgNCgTBhITfjWdZE19Dy?=
 =?iso-8859-1?Q?V5GuDgKOH7qvqL2QcSadlfwW7sbhJbshDQ9yzmhnhgDTzNowW1rtzfxKQw?=
 =?iso-8859-1?Q?vEKKOp6HKB63FB2TyK+l2TTPnBht+fDxQa9zoFW7nowF4hh2MFt/jQc4vj?=
 =?iso-8859-1?Q?QYb4TatgTCqMxainoqEuOBjtAMXtTQubxRT3t5NeSs83NMan68cN5YV+Sr?=
 =?iso-8859-1?Q?rZpGPMRvhaEvO/6fvu6nCJJYgzj7Opi+IgzaZ2BLraJaR1cumTTO2NKy74?=
 =?iso-8859-1?Q?ckUUNguQnyYaROH/w6ODicsdFPdHuRmTn942985RuPOqg3cHrePw5D8CJF?=
 =?iso-8859-1?Q?HxSKHQwgD6ht7BN2tfKAGUB0EKqc/hXgzwWt/RXrwTQlLTu8nQL0GCwXza?=
 =?iso-8859-1?Q?pu8IG1iAJCFhtWajphxIT6fWKePjViTTXQDokJKo/Jo/3ubkwdF4VU89iS?=
 =?iso-8859-1?Q?duu1w60b1y9PfxDAm/CHvxkajZCgpRCFwsS8ftKfdctkoHVku5hboMiSC+?=
 =?iso-8859-1?Q?hXcbLgSvGjL+EwdQIz5f7B7ApUQ7xAc+aZkjNvSzW0+xkrDRIbUs+t6vLP?=
 =?iso-8859-1?Q?qKHQxOk5A67EJTVfQ0xjZvZ0ohEekqaWTGq8oCnUw0uPV0wPbOePR4MHOl?=
 =?iso-8859-1?Q?grcafnuCGzprwuIoKVUovEQCg9W8vhhWB7x3cXt8CFxoPmS7Fj/HYcr9xe?=
 =?iso-8859-1?Q?i16YF3XSpRFlr4pYwU27CJjkHqTuuObiMk6t9u5sCbwn/lfYpQ/59uZX5z?=
 =?iso-8859-1?Q?J4wq/ZmywfSlMkICu7QnrrAc2yBdP0RHj06Xroq1uEhS+TE6yMX4l+OpuE?=
 =?iso-8859-1?Q?bHe0r2LXTMbJkHgGk/Cb2Y5I/mYG7m2C4ZJYY6/rQ+fhU7YPyRivnV4jhc?=
 =?iso-8859-1?Q?ag3pkMfaL5YvqAUBVZ8tSY7nXRSDwaf438yD7b/P3nXzNLvu4YgQFwfLiT?=
 =?iso-8859-1?Q?HnTSiB0/57HEzY8qaLwml7GqQ+qQE87qBfQUP1pgNW+hY5DpywFM/No0cV?=
 =?iso-8859-1?Q?9cexiML5M7YK7YW1hlTJ46LRAZGuWuxMPZYNpinaJJ3lqps1lYC8IhFwyX?=
 =?iso-8859-1?Q?3ju2M9vgtuqc1nKL1MmORDVDeIfUZAdEx+OzYMeIJuMwJgiBgyT3WnsAzU?=
 =?iso-8859-1?Q?VGzBjhxn5933FMLvNarA5a69rRS6BHcfHvhAdF7JfYGZIyHHXqORsXNf/s?=
 =?iso-8859-1?Q?RW0+uEukCOszQKkM+86xKKqJyLxlxD/mOi?=
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: quest.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: CO1PR19MB4984.namprd19.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 4a8a9dbd-a3ac-431a-34cb-08de18dd0369
X-MS-Exchange-CrossTenant-originalarrivaltime: 01 Nov 2025 00:24:25.6980
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 91c369b5-1c9e-439c-989c-1867ec606603
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: j+jhqfJAseAG3ruF3EvCGjYGDxaVKHj6AKCBHEKAoTCwsPoesNKeUQc/Yht5RFwrkPL5LdZlP9U/wbtU7yrcsg==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM4PR19MB6175
List-Id: <pgsql-general.lists.postgresql.org>
List-Help: <https://lists.postgresql.org/manage/>
List-Subscribe: <https://lists.postgresql.org/manage/>
List-Post: <mailto:pgsql-general@lists.postgresql.org>
List-Owner: <mailto:pgsql-general-owner@lists.postgresql.org>
List-Archive: <https://www.postgresql.org/list/pgsql-general>
Archived-At: <https://www.postgresql.org/message-id/CO1PR19MB4984B665A5F9F38A5E0FB5969BF9A%40CO1PR19MB4984.namprd19.prod.outlook.com>
Precedence: bulk

I can't disagree - but the question them becomes, as Markus and other have =
pointed out; would that allow a customer/user to check the "Encryption" box=
 for PCI or any other "compliance review"

Clay Jackson
Database Solutions Sales Engineer

clay.jackson@quest.com
office  949-754-1203  mobile 425-802-9603

-----Original Message-----
From: Bruce Momjian <bruce@momjian.us>
Sent: Friday, October 31, 2025 5:21 PM
To: Christophe Pettus <xof@thebuild.com>
Cc: pgsql-general <pgsql-general@postgresql.org>; Kai Wagner <kai.wagner@pe=
rcona.com>; Laurenz Albe <laurenz.albe@cybertec.at>; Ron Johnson <ronljohns=
onjr@gmail.com>
Subject: Re: Enquiry about TDE with PgSQL

CAUTION: This email originated from outside of the organization. Do not fol=
low guidance, click links, or open attachments unless you recognize the sen=
der and know the content is safe.


On Fri, Oct 31, 2025 at 05:16:09PM -0700, Christophe Pettus wrote:
> On Oct 31, 2025, at 07:54, Bruce Momjian <bruce@momjian.us> wrote:
> > So it seems we have somewhat of a stand-off, with the Postgres
> > project questioning the value of TDE and the PCI writers
> > doubling-down on specifying disk-level encryption as insufficient.
>
> PCI definitely exhibits a preference away from disk-level encryption,
> although it doesn't prohibit it: you have to make sure that simply
> mounting the disk doesn't decrypt it.  Their concern is that if user
> credentials are compromised, and an attacker then has to do something
> else in order to see the plaintext.  This kind of implies TDE,
> although they don't use that term.
>
> Now, the road forks here:
>
> 1. If a customer wants TDE and isn't interested in hearing about other
> solutions, then TDE is only thing that will meet that goal.
>
> 2. The PCI spec doesn't specifically offer up TDE as an alternative to
> disk-level encryption, though.  It exhibits a strong preference for
> column-level encryption of sensitive data, which doesn't require TDE.
>
> In some ways, there's no real point of discussion.  You can comply
> with PCI without TDE (I would argue that, in fact, you are in a better
> position with column-level encryption), but if the organization wants
> TDE, then the technical arguments rarely matter.

I think column-level encryption, on the client side, actually does improve =
security and is preferable to file system level TDE, and I think many here =
feel the same way.

--
  Bruce Momjian  <bruce@momjian.us>        https://momjian.us/
  EDB                                      https://enterprisedb.com/

  Do not let urgent matters crowd out time for investment in the future.