Message-ID: <b6432dcad6b5f1d86a849e4adcd758157044abe3.camel@cybertec.at>
Subject: Re: Enquiry about TDE with PgSQL
From: Laurenz Albe <laurenz.albe@cybertec.at>
To: rainer@ultra-secure.de, Bruce Momjian <bruce@momjian.us>
Cc: Ken Marshall <ktm@rice.edu>, pgsql-general@postgresql.org
Date: Mon, 03 Nov 2025 19:30:01 +0100
In-Reply-To: <3a9ca8cf6bfa3916619ee8e2c8ff3e30@ultra-secure.de>
References: <aQVScCjItvCtgVPn@momjian.us>
	 <CO1PR19MB4984B665A5F9F38A5E0FB5969BF9A@CO1PR19MB4984.namprd19.prod.outlook.com>
	 <3DC589BC-A5F6-49BC-BFFC-F1FCB0FF7E95@thebuild.com>
	 <CAKt_ZfuwPgG_nJHp6S=8k_+NdA6Op7hE0z7+s4-HuBqr1cnwsg@mail.gmail.com>
	 <CAG0qCNjd2m9Ej1ZEwuCCkgsqJz0vnso3ZFwjKCxzwUfnfu=SNw@mail.gmail.com>
	 <aQYSAGEfd116_58N@momjian.us>
	 <3985797c-639f-4825-9fa9-98a48b37f380@aklaver.com>
	 <CAKAnmmJ4yRTb-TV=ik0aoEZsWzDzuKRgCjXFfF5DCzR5jiCQdA@mail.gmail.com>
	 <aQZXgEH5pvEwKq+O@customer.dllstxx1.isp.starlink.com>
	 <86C8ECFE-942C-4364-A5BF-3404D50CD661@ultra-secure.de>
	 <aQjFXwQxDU70EEdW@momjian.us>
	 <3a9ca8cf6bfa3916619ee8e2c8ff3e30@ultra-secure.de>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
User-Agent: Evolution 3.56.2 (3.56.2-2.fc42) 
MIME-Version: 1.0
Archived-At: <https://www.postgresql.org/message-id/b6432dcad6b5f1d86a849e4adcd758157044abe3.camel%40cybertec.at>
Precedence: bulk

On Mon, 2025-11-03 at 16:39 +0100, rainer@ultra-secure.de wrote:
> The HSM should be backed up, too. Which is only possible by connecting=
=20
> physically to it with a notebook and inserting an USB stick.
>=20
> Which begs the question: where do you source an USB stick with the same=
=20
> trust-level as the 20k-a-pop HSM?

I'd say that you don't need a very secure USB stick.  You just put the
USB stick in a very secure safe that only two very trustworthy people
can open together.

Yours,
Laurenz Albe