Date: Fri, 31 Oct 2025 11:34:30 -0400
From: Bruce Momjian <bruce@momjian.us>
To: Greg Sabino Mullane <htamfids@gmail.com>
Cc: Kai Wagner <kai.wagner@percona.com>,
	Laurenz Albe <laurenz.albe@cybertec.at>,
	Ron Johnson <ronljohnsonjr@gmail.com>,
	pgsql-general <pgsql-general@postgresql.org>
Subject: Re: Enquiry about TDE with PgSQL
Message-ID: <aQTXBuiJ-a9v8s3S@momjian.us>
References: <CACgMzfwSDRF+kQr59h0-xGUobCeFZxwVzE_tUxF18DkVb+vuDQ@mail.gmail.com>
 <CAKAnmmKDCOdUT5JtJZz5papMO0zW1cnG4934d6aQVCQ_KdbUeg@mail.gmail.com>
 <CANzqJaA41CzNjkiQex+A0u9z11i6R3WQZJ+fkXfJO7VJwOMWzg@mail.gmail.com>
 <a1dae4a583d560a90c67872b766ead02ddb13e51.camel@cybertec.at>
 <aQPDvqUzZVKkaxsS@momjian.us>
 <CAG0qCNhL=SEB4vc4v48PxN1F-t8htC463TpX7KDNWQ-s3s8dtA@mail.gmail.com>
 <aQTNmM-3VeTRZdx0@momjian.us>
 <CAKAnmmKYP0DZpBhFXFBAbpkEkGt8g+MKOsSR=M+nKbvLZ8v89w@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <CAKAnmmKYP0DZpBhFXFBAbpkEkGt8g+MKOsSR=M+nKbvLZ8v89w@mail.gmail.com>
Archived-At: <https://www.postgresql.org/message-id/aQTXBuiJ-a9v8s3S%40momjian.us>
Precedence: bulk

On Fri, Oct 31, 2025 at 11:25:04AM -0400, Greg Sabino Mullane wrote:
> On Fri, Oct 31, 2025 at 10:54 AM Bruce Momjian <bruce@momjian.us> wrote:
> 
>             Disk-level and partition-level encryption typically encrypts
>             the entire disk or partition using the same key, with all data
>             automatically decrypted when the system runs or when an authorized
>     -->     user requests it. For this reason, disk-level encryption is not
>     -->     appropriate to protect stored PAN on computers, laptops, servers,
>             storage arrays, or any other system that provides transparent
>             decryption upon user authentication.
> 
> 
> Hmm, I read this a few times but still not sure what the technical objection
> is. Yes, the entire disk is encrypted with the same key, but why is that
> insufficient to protect things? Anyone care to guess what they are thinking
> here?

This is more an argument for security using layers.  With storage
encryption, the file system as visible is unencrypted, and backups of
that file system can be unencrypted.

Community Postgres relies on file system permissions to secure the data
directory.  You can argue that once file system permissions are
bypassed, security is impossible, and agree with that, but some feel the
extra step needed to pull the Postgres encryption key from memory is a
security feature.  And for backups, the Postgres encryption key might
not be in memory.  Of course, forcing encrypted backups is a solution,
but an extra step.

>     The biggest possible downside of this standoff is that enterprises that
>     need to meet PCI compliance specifications are forced to use specialized
>     versions of Postgres or Postgres extensions that support TDE.
> 
> Not always a downside for the companies selling those specialized versions
> though.

Yes, no question they are happy.

-- 
  Bruce Momjian  <bruce@momjian.us>        https://momjian.us
  EDB                                      https://enterprisedb.com

  Do not let urgent matters crowd out time for investment in the future.