From: Stephen Frost <sfrost@snowman.net>
To: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Cc: Bruce Momjian <bruce@momjian.us>
Cc: Ants Aasma <ants.aasma@eesti.ee>
Cc: Robert Haas <robertmhaas@gmail.com>
Cc: PostgreSQL-development <pgsql-hackers@postgresql.org>
Subject: Re: WIP: Data at rest encryption
Date: Tue, 13 Jun 2017 18:13:33 -0400
Message-ID: <20170613221333.GU3151@tamriel.snowman.net> (raw)
In-Reply-To: <3550f152-9349-ee2b-edae-a8ec09d8d9fc@2ndquadrant.com>
References: <20170613170132.GH3151@tamriel.snowman.net>
<20170613171356.GG13873@momjian.us>
<20170613172459.GL3151@tamriel.snowman.net>
<20170613174329.GK13873@momjian.us>
<20170613182339.GP3151@tamriel.snowman.net>
<20170613182910.GN13873@momjian.us>
<20170613183858.GR3151@tamriel.snowman.net>
<20170613185622.GO13873@momjian.us>
<20170613192011.GS3151@tamriel.snowman.net>
<3550f152-9349-ee2b-edae-a8ec09d8d9fc@2ndquadrant.com>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-hackers>
Peter,
* Peter Eisentraut (peter.eisentraut@2ndquadrant.com) wrote:
> On 6/13/17 15:20, Stephen Frost wrote:
> > And then you would need openssl on the other system to decrypt it.
>
> Or make the USB file system encrypted as well? If you're in that kind
> of environment, that would surely be feasible, if not required.
Right, but requiring file system encryption to work on a USB stick
across different types of systems strikes me as actually a higher bar
than requiring openssl to exist on both the source and destination
sides.
Naturally, if the environment you're in has already solved that problem
across the enterprise then it's a good approach, although you might want
to use a different encryption key, perhaps, though hopefully that's
something you'd be able to do pretty easily too.
Thanks!
Stephen
Attachments:
signature.asc (application/pgp-signature, 818B) download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: sfrost@snowman.net, peter.eisentraut@2ndquadrant.com, bruce@momjian.us, ants.aasma@eesti.ee, robertmhaas@gmail.com
Subject: Re: WIP: Data at rest encryption
In-Reply-To: <20170613221333.GU3151@tamriel.snowman.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox