X-Original-To: pgadmin-support-postgresql.org@localhost.postgresql.org Received: from localhost (unknown [200.46.204.144]) by svr1.postgresql.org (Postfix) with ESMTP id 8BB83D1B37F for ; Tue, 13 Jul 2004 09:31:06 -0300 (ADT) Received: from svr1.postgresql.org ([200.46.204.71]) by localhost (av.hub.org [200.46.204.144]) (amavisd-new, port 10024) with ESMTP id 00978-07 for ; Tue, 13 Jul 2004 12:31:13 +0000 (GMT) Received: from wolff.to (wolff.to [66.93.249.74]) by svr1.postgresql.org (Postfix) with SMTP id 0C884D1B374 for ; Tue, 13 Jul 2004 09:31:03 -0300 (ADT) Received: (qmail 4216 invoked by uid 500); 13 Jul 2004 12:38:17 -0000 Date: Tue, 13 Jul 2004 07:38:17 -0500 From: Bruno Wolff III To: Daniel Struck Cc: Sarah Tanembaum , pgsql-php@postgresql.org, pgsql-admin@postgresql.org, pgsql-hackers-win32@postgresql.org, pgadmin-support@postgresql.org, pgsql-sql@postgresql.org Subject: Re: [PHP] Secure DB Systems - How to Message-ID: <20040713123817.GB3710@wolff.to> Mail-Followup-To: Daniel Struck , Sarah Tanembaum , pgsql-php@postgresql.org, pgsql-admin@postgresql.org, pgsql-hackers-win32@postgresql.org, pgadmin-support@postgresql.org, pgsql-sql@postgresql.org References: <20040709152722.GA20935@wolff.to> <20040713113557.31e9d6dc@localhost> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20040713113557.31e9d6dc@localhost> User-Agent: Mutt/1.5.6i X-Virus-Scanned: by amavisd-new at hub.org X-Spam-Status: No, hits=0.0 tagged_above=0.0 required=5.0 tests= X-Spam-Level: X-Archive-Number: 200407/48 X-Sequence-Number: 3161 On Tue, Jul 13, 2004 at 11:35:57 +0200, Daniel Struck wrote: > > Keeping the system administrator from seeing the data while making it > > searchable is difficult. To do this you need to encrypt the data on > > the client side using a key the client has (and this key has to be > > protected from loss) and the only searches you can do are equality > > searches using a hash or encrypted value. > > You can also perform regex searches. If you decrypt the data on the database, the sysadmin can see it. If you are willing to take that chance (e.g. if you primary concern is some third party getting a snapshot of the DB), then you can do lots of things.