Feedback-ID: i76984098:Fastmail
Message-ID: <ebbe5b81-5e14-4273-a626-f2f49dad0b6c@aklaver.com>
Date: Fri, 31 Oct 2025 08:37:44 -0700
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: Enquiry about TDE with PgSQL
To: Greg Sabino Mullane <htamfids@gmail.com>, Bruce Momjian <bruce@momjian.us>
Cc: Kai Wagner <kai.wagner@percona.com>,
 Laurenz Albe <laurenz.albe@cybertec.at>,
 Ron Johnson <ronljohnsonjr@gmail.com>,
 pgsql-general <pgsql-general@postgresql.org>
References: <CACgMzfwSDRF+kQr59h0-xGUobCeFZxwVzE_tUxF18DkVb+vuDQ@mail.gmail.com>
 <CAKAnmmKDCOdUT5JtJZz5papMO0zW1cnG4934d6aQVCQ_KdbUeg@mail.gmail.com>
 <CANzqJaA41CzNjkiQex+A0u9z11i6R3WQZJ+fkXfJO7VJwOMWzg@mail.gmail.com>
 <a1dae4a583d560a90c67872b766ead02ddb13e51.camel@cybertec.at>
 <aQPDvqUzZVKkaxsS@momjian.us>
 <CAG0qCNhL=SEB4vc4v48PxN1F-t8htC463TpX7KDNWQ-s3s8dtA@mail.gmail.com>
 <aQTNmM-3VeTRZdx0@momjian.us>
 <CAKAnmmKYP0DZpBhFXFBAbpkEkGt8g+MKOsSR=M+nKbvLZ8v89w@mail.gmail.com>
Content-Language: en-US
From: Adrian Klaver <adrian.klaver@aklaver.com>
In-Reply-To: <CAKAnmmKYP0DZpBhFXFBAbpkEkGt8g+MKOsSR=M+nKbvLZ8v89w@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
Archived-At: <https://www.postgresql.org/message-id/ebbe5b81-5e14-4273-a626-f2f49dad0b6c%40aklaver.com>
Precedence: bulk

On 10/31/25 08:25, Greg Sabino Mullane wrote:
> On Fri, Oct 31, 2025 at 10:54 AM Bruce Momjian <bruce@momjian.us 
> <mailto:bruce@momjian.us>> wrote:
> 
>              Disk-level and partition-level encryption typically encrypts
>              the entire disk or partition using the same key, with all data
>              automatically decrypted when the system runs or when an
>     authorized
>     -->     user requests it. For this reason, disk-level encryption is not
>     -->     appropriate to protect stored PAN on computers, laptops,
>     servers,
>              storage arrays, or any other system that provides transparent
>              decryption upon user authentication.
> 
> 
> Hmm, I read this a few times but still not sure what the technical 
> objection is. Yes, the entire disk is encrypted with the same key, but 
> why is that insufficient to protect things? Anyone care to guess what 
> they are thinking here?

My best guess, is that the more the storage encryption is fragmented by 
different keys the less likely all the disk could be decrypted by a 
single action. The weak link is '... other system that provides 
transparent decryption upon user authentication.'. At some point the 
data needs to be decrypted for end user use. That means the point of 
attack is moved to the user and storage encryption does not really matter.

> 
>     The biggest possible downside of this standoff is that enterprises
>     that need to meet PCI compliance specifications are forced to use
>     specialized versions of Postgres or Postgres extensions that support
>     TDE.
> 
> 
> Not always a downside for the companies selling those specialized 
> versions though.
> 
> Cheers,
> Greg
> 
> --
> Crunchy Data - https://www.crunchydata.com <https://www.crunchydata.com>
> Enterprise Postgres Software Products & Tech Support
> 


-- 
Adrian Klaver
adrian.klaver@aklaver.com