Message-ID: <b5efc1949fdba81576bcf53e3b44e626a2c582de.camel@cybertec.at>
Subject: Re: Enquiry about TDE with PgSQL
From: Laurenz Albe <laurenz.albe@cybertec.at>
To: Bruce Momjian <bruce@momjian.us>
Cc: Kai Wagner <kai.wagner@percona.com>, Chris Travers
 <chris.travers@gmail.com>,  Christophe Pettus	 <xof@thebuild.com>, "Clay
 Jackson (cjackson)" <Clay.Jackson@quest.com>,  pgsql-general
 <pgsql-general@postgresql.org>, Ron Johnson <ronljohnsonjr@gmail.com>
Date: Tue, 04 Nov 2025 06:40:26 +0100
In-Reply-To: <aQlfgmZO9seHsmMx@momjian.us>
References: <FC8C7F2D-CD38-42C7-80D3-516239B70A2D@thebuild.com>
	 <aQVScCjItvCtgVPn@momjian.us>
	 <CO1PR19MB4984B665A5F9F38A5E0FB5969BF9A@CO1PR19MB4984.namprd19.prod.outlook.com>
	 <3DC589BC-A5F6-49BC-BFFC-F1FCB0FF7E95@thebuild.com>
	 <CAKt_ZfuwPgG_nJHp6S=8k_+NdA6Op7hE0z7+s4-HuBqr1cnwsg@mail.gmail.com>
	 <CAG0qCNjd2m9Ej1ZEwuCCkgsqJz0vnso3ZFwjKCxzwUfnfu=SNw@mail.gmail.com>
	 <aQYSAGEfd116_58N@momjian.us>
	 <CAG0qCNgV+Ra72vTvCoTZqn7KUUsXvp3N=ZUgACgMTDDPt8WTkA@mail.gmail.com>
	 <aQjeuRsBLS6cXNLC@momjian.us>
	 <bb3db67c53fc1c58ba1fae740b52cb7450fbcab3.camel@cybertec.at>
	 <aQlfgmZO9seHsmMx@momjian.us>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
User-Agent: Evolution 3.56.2 (3.56.2-2.fc42) 
MIME-Version: 1.0
Archived-At: <https://www.postgresql.org/message-id/b5efc1949fdba81576bcf53e3b44e626a2c582de.camel%40cybertec.at>
Precedence: bulk

On Mon, 2025-11-03 at 21:05 -0500, Bruce Momjian wrote:
> On Mon, Nov  3, 2025 at 07:42:06PM +0100, Laurenz Albe wrote:
>=20
> > Since you say that encrypting the temp files is the biggest hurdle for
> > community acceptance, what about a first version that does not encrypt
> > temp files?  For one, that will be good for encrypted backups (which is
> > one of the good use cases for TDE), and then you could argue that temp
> > files are not data *at rest*, so data-at-rest-encryption does not apply
> > to them.  Rome wasn't built in a day, and neither were parallel query
> > or declarative partitioning.
>=20
> Uh, people will say that if the solution is not 100% secure in its
> coverage, it is much less useful and therefore not worth it.

Some people will doubtless say that.  Others will consider the checkbox
requirement satisfied and use it.  Yet others will consider a mislaid
backup their biggest problem and will consider TDE a technically useful
solution.

9.6, which introduced parallel query, only supported it for sequential
scans, which was much less useful than what we have today.  I for one
wouldn't consider an implementation of TDE with some features missing
"not worth it".  If anything, I consider the marginal security improvement
that TDE as a whole provides not worth it.  But I am sold on the claim
that having TDE would promote the adoption of PostgreSQL. =C2=A0

I am curious what others think.

Yours,
Laurenz Albe