Received: from malur.postgresql.org ([217.196.149.56])
	by arkaria.postgresql.org with esmtps  (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
	(Exim 4.94.2)
	(envelope-from <pgsql-general-owner+archive@lists.postgresql.org>)
	id 1vEsYq-002M3s-TK
	for pgsql-general@arkaria.postgresql.org; Fri, 31 Oct 2025 17:05:12 +0000
Received: from localhost ([127.0.0.1] helo=malur.postgresql.org)
	by malur.postgresql.org with esmtp (Exim 4.94.2)
	(envelope-from <pgsql-general-owner+archive@lists.postgresql.org>)
	id 1vEsYp-00GX7H-RH
	for pgsql-general@arkaria.postgresql.org; Fri, 31 Oct 2025 17:05:10 +0000
Received: from makus.postgresql.org ([2001:4800:3e1:1::229])
	by malur.postgresql.org with esmtps  (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
	(Exim 4.94.2)
	(envelope-from <xof@thebuild.com>)
	id 1vEsYp-00GX79-GV
	for pgsql-general@lists.postgresql.org; Fri, 31 Oct 2025 17:05:10 +0000
Received: from smtp78.iad3a.emailsrvr.com ([173.203.187.78])
	by makus.postgresql.org with smtp (Exim 4.96)
	(envelope-from <xof@thebuild.com>)
	id 1vEsYm-004lgU-1c
	for pgsql-general@postgresql.org;
	Fri, 31 Oct 2025 17:05:09 +0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=g001.emailsrvr.com;
	s=feedback; t=1761930307;
	bh=QRVTdZr1PnwHRGkTjnUWS6IUbOfh8nYAa6HVDOn48Nk=;
	h=Subject:From:Date:To:From;
	b=mBgSLCH6UvMUvU+ReHPyAzE1wmvrdJaNFi8Sd8kFRRNabkIjA+nJlaU735x4LCiia
	 HZygFp5pAWlkn1xaOcTgImkJ9m0SSNbKnk1ZOzrlKgk9eTfRWfjMHKfkLh/adZh2vW
	 j2klIb0TKB0qFigXSNvUbDjywvPk75YWk+15laV8=
X-Auth-ID: xof@thebuild.com
Received: by smtp10.relay.iad3a.emailsrvr.com (Authenticated sender: xof-AT-thebuild.com) with ESMTPSA id D3EDD6369;
	Fri, 31 Oct 2025 13:05:06 -0400 (EDT)
Content-Type: text/plain;
	charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3776.700.51.11.4\))
Subject: Re: Enquiry about TDE with PgSQL
From: Christophe Pettus <xof@thebuild.com>
In-Reply-To: <df60c2f9-21df-4c04-a33c-5ae8ec74d431@aklaver.com>
Date: Fri, 31 Oct 2025 10:04:35 -0700
Cc: Bruce Momjian <bruce@momjian.us>,
 Kai Wagner <kai.wagner@percona.com>,
 Laurenz Albe <laurenz.albe@cybertec.at>,
 Ron Johnson <ronljohnsonjr@gmail.com>,
 pgsql-general <pgsql-general@postgresql.org>
Content-Transfer-Encoding: quoted-printable
Message-Id: <E94D3E44-8BF5-45F8-9497-3918A8488706@thebuild.com>
References: <CACgMzfwSDRF+kQr59h0-xGUobCeFZxwVzE_tUxF18DkVb+vuDQ@mail.gmail.com>
 <CAKAnmmKDCOdUT5JtJZz5papMO0zW1cnG4934d6aQVCQ_KdbUeg@mail.gmail.com>
 <CANzqJaA41CzNjkiQex+A0u9z11i6R3WQZJ+fkXfJO7VJwOMWzg@mail.gmail.com>
 <a1dae4a583d560a90c67872b766ead02ddb13e51.camel@cybertec.at>
 <aQPDvqUzZVKkaxsS@momjian.us>
 <CAG0qCNhL=SEB4vc4v48PxN1F-t8htC463TpX7KDNWQ-s3s8dtA@mail.gmail.com>
 <aQTNmM-3VeTRZdx0@momjian.us>
 <df60c2f9-21df-4c04-a33c-5ae8ec74d431@aklaver.com>
To: Adrian Klaver <adrian.klaver@aklaver.com>
X-Mailer: Apple Mail (2.3776.700.51.11.4)
X-Classification-ID: 1a20c029-756b-4d8d-ba06-95975c0cf8c5-1-1
List-Id: <pgsql-general.lists.postgresql.org>
List-Help: <https://lists.postgresql.org/manage/>
List-Subscribe: <https://lists.postgresql.org/manage/>
List-Post: <mailto:pgsql-general@lists.postgresql.org>
List-Owner: <mailto:pgsql-general-owner@lists.postgresql.org>
List-Archive: <https://www.postgresql.org/list/pgsql-general>
Archived-At: <https://www.postgresql.org/message-id/E94D3E44-8BF5-45F8-9497-3918A8488706%40thebuild.com>
Precedence: bulk



> On Oct 31, 2025, at 08:21, Adrian Klaver <adrian.klaver@aklaver.com> =
wrote:
> Yeah, what I would like to know is how many of the data breaches =
actually grab directly from the storage versus getting it through the =
database or other software above the storage?

Essentially zero.

PCI, like a lot of data security standards, are a magpie's assemblage of =
things that the authors have heard about all of which sound "secure" to =
them.  However, since these particular magpies have machine guns =
(metaphorically) and can do serious damage to businesses, we must play =
along with the masquerade.=