On Sun, Jun 16, 2019 at 12:42:55PM -0400, Joe Conway wrote: > On 6/16/19 9:45 AM, Bruce Momjian wrote: > > On Sun, Jun 16, 2019 at 07:07:20AM -0400, Joe Conway wrote: > >> In any case it doesn't address my first point, which is limiting the > >> volume encrypted with the same key. Another valid reason is you might > >> have data at varying sensitivity levels and prefer different keys be > >> used for each level. > > > > That seems quite complex. > > > How? It is no more complex than encrypting at the tablespace level > already gives you - in that case you get this property for free if you > care to use it.
All keys used to encrypt WAL data must be unlocked at all times or crash recovery, PITR, and replication will not stop when it hits a locked key. Given that, how much value is there in allowing a key per tablespace? I don't see how this is better than telling users they have to create a separate cluster per key. -- Bruce Momjian <br...@momjian.us> http://momjian.us EnterpriseDB http://enterprisedb.com + As you are, so once was I. As I am, so you will be. + + Ancient Roman grave inscription +
