Date: Tue, 13 Jun 2017 18:13:33 -0400
From: Stephen Frost <sfrost@snowman.net>
To: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Cc: Bruce Momjian <bruce@momjian.us>, Ants Aasma <ants.aasma@eesti.ee>,
	Robert Haas <robertmhaas@gmail.com>,
	PostgreSQL-development <pgsql-hackers@postgresql.org>
Subject: Re: WIP: Data at rest encryption
Message-ID: <20170613221333.GU3151@tamriel.snowman.net>
References: <20170613170132.GH3151@tamriel.snowman.net>
 <20170613171356.GG13873@momjian.us>
 <20170613172459.GL3151@tamriel.snowman.net>
 <20170613174329.GK13873@momjian.us>
 <20170613182339.GP3151@tamriel.snowman.net>
 <20170613182910.GN13873@momjian.us>
 <20170613183858.GR3151@tamriel.snowman.net>
 <20170613185622.GO13873@momjian.us>
 <20170613192011.GS3151@tamriel.snowman.net>
 <3550f152-9349-ee2b-edae-a8ec09d8d9fc@2ndquadrant.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="JnkQjFBQYNJkGfMe"
Content-Disposition: inline
In-Reply-To: <3550f152-9349-ee2b-edae-a8ec09d8d9fc@2ndquadrant.com>
User-Agent: Mutt/1.5.21 (2010-09-15)
Precedence: bulk
Sender: pgsql-hackers-owner@postgresql.org


--JnkQjFBQYNJkGfMe
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Peter,

* Peter Eisentraut (peter.eisentraut@2ndquadrant.com) wrote:
> On 6/13/17 15:20, Stephen Frost wrote:
> > And then you would need openssl on the other system to decrypt it.
>=20
> Or make the USB file system encrypted as well?  If you're in that kind
> of environment, that would surely be feasible, if not required.

Right, but requiring file system encryption to work on a USB stick
across different types of systems strikes me as actually a higher bar
than requiring openssl to exist on both the source and destination
sides.

Naturally, if the environment you're in has already solved that problem
across the enterprise then it's a good approach, although you might want
to use a different encryption key, perhaps, though hopefully that's
something you'd be able to do pretty easily too.

Thanks!

Stephen

--JnkQjFBQYNJkGfMe
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJZQGONAAoJEO1sijiDR2RV+YQP/39SBJ8hSHlQAB2Fcay9Kbqn
b9eoOPAoKRWn+3C+aInt/GHmr2PbeP89eS7oAKDfGZpN2w3IrgPqKgQM/6Dpz7/6
PwO0BpspJmJCkRDPK752gkw5rz3OvpAldlg8N0qVW+yA5MNPVu75jgqkr/FqM/Se
ODP2vHf4Bbayo+y1MiRbHB7e3tGKQhACHH3C+8WogOLuNERCcm0Tta+6yHyD7Uk4
eHIvqRdvPDCYXRfCiNgXsqJWHXD5HPM7z8AwfoYaIGYpswK9zpNXIXeUdDS3yXTN
OHGPeNJ2di3zuGRmDu2jx60WXZgKgGCFaVxVHfUlWa8RYCclVjW+rnnK6/kvpxKN
nf8eAgy+WgWKToukgiXE4QeNTpdOlYDIqtLf7f/2chUoiGXVaG/WjTWDvjxyU1uA
4lwUpTw2B9xaMp4npOUM+IYAN5Xydktx01EwApAvMC/RrC/z3huXJxTmqvV1TcZ+
pJr/9cyQFnTk+g53cIp4MhmF5cgMP457NiE/RpRJ/AFclBiVoDvBKvQQK35OusAi
KFQUxM9JhP1lnR7XyKMBWAEqPlixJbDQlkz7KNIzvaUNat4Lk5afPLhh7JgTqj84
cV1BFPp/Gcnri6yej0VQWzc0omJlYNaP1HEW6mDaZXt1QhZBlv4w3bahAsQ5QSdG
oTrJZQN6gcDQJycPuofv
=gYdg
-----END PGP SIGNATURE-----

--JnkQjFBQYNJkGfMe--