Re: Enquiry about TDE with PgSQL

On Mon, Nov 3, 2025 at 09:23:33PM -0800, Adrian Klaver wrote: > On 11/3/25 18:05, Bruce Momjian wrote: > > On Mon, Nov 3, 2025 at 07:42:06PM +0100, Laurenz Albe wrote: > > > On Mon, 2025-11-03 at 11:56 -0500, Bruce Momjian wrote: > > > > The problem with the Percona extension is it seems like it

Re: Enquiry about TDE with PgSQL

Just wanted to throw in my two cents, or actually, two points, on TDE: 1. Extensions seem like the right place for most of the TDE logic. Encryption usually depends on organization specific or even proprietary security systems. Think of features like KMS integrations that need cust

RE: Enquiry about TDE with PgSQL

Clay Jackson -Original Message- From: Bruce Momjian Sent: Monday, November 3, 2025 6:06 PM To: Laurenz Albe Cc: Kai Wagner ; Chris Travers ; Christophe Pettus ; Clay Jackson (cjackson) ; pgsql-general ; Ron Johnson Subject: Re: Enquiry about TDE with PgSQL CAUTION: This email originat

Re: Enquiry about TDE with PgSQL

On 2025-Nov-04, Laurenz Albe wrote: > 9.6, which introduced parallel query, only supported it for sequential > scans, which was much less useful than what we have today. I for one > wouldn't consider an implementation of TDE with some features missing > "not worth it". We call this incremental d

Re: Enquiry about TDE with PgSQL

On Mon, 2025-11-03 at 21:05 -0500, Bruce Momjian wrote: > On Mon, Nov 3, 2025 at 07:42:06PM +0100, Laurenz Albe wrote: > > > Since you say that encrypting the temp files is the biggest hurdle for > > community acceptance, what about a first version that does not encrypt > > temp files? For one,

Re: Enquiry about TDE with PgSQL

On 11/3/25 18:05, Bruce Momjian wrote: On Mon, Nov 3, 2025 at 07:42:06PM +0100, Laurenz Albe wrote: On Mon, 2025-11-03 at 11:56 -0500, Bruce Momjian wrote: The problem with the Percona extension is it seems like it was developed mostly/all by Percona employees, meaning development was driven/s

Re: Enquiry about TDE with PgSQL

On Mon, Nov 3, 2025 at 07:42:06PM +0100, Laurenz Albe wrote: > On Mon, 2025-11-03 at 11:56 -0500, Bruce Momjian wrote: > > The problem with the Percona extension is it seems like it was developed > > mostly/all by Percona employees, meaning development was driven/steered > > by Percona, and there

Re: Enquiry about TDE with PgSQL

On 11/3/25 10:14, Bruce Momjian wrote: On Mon, Nov 3, 2025 at 10:07:50AM -0800, Adrian Klaver wrote: To be specific it is a customer service issue. So why is this page: https://www.postgresql.org/support/professional_support/ "Commercial support is available from many different companies

Re: Enquiry about TDE with PgSQL

On Mon, 2025-11-03 at 11:56 -0500, Bruce Momjian wrote: > The problem with the Percona extension is it seems like it was developed > mostly/all by Percona employees, meaning development was driven/steered > by Percona, and there was insufficient feedback from the community for > it to be polished e

Re: Enquiry about TDE with PgSQL

On Mon, 2025-11-03 at 16:39 +0100, [email protected] wrote: > The HSM should be backed up, too. Which is only possible by connecting > physically to it with a notebook and inserting an USB stick. > > Which begs the question: where do you source an USB stick with the same > trust-level as th

Re: Enquiry about TDE with PgSQL

On Mon, Nov 3, 2025 at 10:07:50AM -0800, Adrian Klaver wrote: > On 11/3/25 8:59 AM, Bruce Momjian wrote: > > On Mon, Nov 3, 2025 at 08:20:21AM -0800, Adrian Klaver wrote: > > > On 11/3/25 08:01, Bruce Momjian wrote: > > > > On Mon, Nov 3, 2025 at 04:39:45PM +0100, [email protected] wrote: >

Re: Enquiry about TDE with PgSQL

On 11/3/25 8:59 AM, Bruce Momjian wrote: On Mon, Nov 3, 2025 at 08:20:21AM -0800, Adrian Klaver wrote: On 11/3/25 08:01, Bruce Momjian wrote: On Mon, Nov 3, 2025 at 04:39:45PM +0100, [email protected] wrote: Am 2025-11-03 16:08, schrieb Bruce Momjian: Again a distinction without

Re: Enquiry about TDE with PgSQL

On Mon, Nov 3, 2025 at 08:20:21AM -0800, Adrian Klaver wrote: > On 11/3/25 08:01, Bruce Momjian wrote: > > On Mon, Nov 3, 2025 at 04:39:45PM +0100, [email protected] wrote: > > > Am 2025-11-03 16:08, schrieb Bruce Momjian: > > > I will admit that companies are better at integrating with ext

Re: Enquiry about TDE with PgSQL

On Sun, Nov 2, 2025 at 11:14:58AM +0100, Kai Wagner wrote: > I fully agree here, and as I stated above, I don't question this at all, as > this is the strength of the diverse and spread community. Looking at this > thread alone, and the multiple different "users" popping up, that see the need > an

Re: Enquiry about TDE with PgSQL

On 11/3/25 08:01, Bruce Momjian wrote: On Mon, Nov 3, 2025 at 04:39:45PM +0100, [email protected] wrote: Am 2025-11-03 16:08, schrieb Bruce Momjian: I will admit that companies are better at integrating with external vendors, particulary hardware vendors. There is an organization misma

Re: Enquiry about TDE with PgSQL

On Mon, Nov 3, 2025 at 04:39:45PM +0100, [email protected] wrote: > Am 2025-11-03 16:08, schrieb Bruce Momjian: > > > Is it the Oracle API they don't like, that Postgres can improve upon, or > > something fundamental they don't like, or don't see the value in? > > > I am not sure. > > It

Re: Enquiry about TDE with PgSQL

Am 2025-11-03 16:08, schrieb Bruce Momjian: Is it the Oracle API they don't like, that Postgres can improve upon, or something fundamental they don't like, or don't see the value in? I am not sure. It just complicates everything. Documentation isn't thin, it's skeletal. And of course, actu

Re: Enquiry about TDE with PgSQL

On Sat, Nov 1, 2025 at 09:07:01PM +0100, Rainer Duffner wrote: > Do you actually have HSMs with your TDE (assuming you use it > elsewhere? We run, for a customer, an Oracle DataGuard configuration > with TDE with a HSM. There were some interesting ideas in this email I want to reply to. > We hav

Re: Enquiry about TDE with PgSQL

On Sat, Nov 1, 2025 at 2:58 PM Bruce Momjian wrote: > If you want to move forward with TDE without waiting to see if the > temporary file compression patch will reduce the TDE code impact, you > need to dig into how the community does feature calculus and how that > calculus can be changed --- th

Re: Enquiry about TDE with PgSQL

On Sat, Nov 1, 2025 at 02:15:43PM -0700, Adrian Klaver wrote: > 3) Of course there is: > > https://www.postgresql.org/community/ > > "PostgreSQL is well-supported by its active community." > > > To me that means extensions provided by members of the 'community' are > 'community-provided'? Yes

Re: Enquiry about TDE with PgSQL

On 11/1/25 11:34, Greg Sabino Mullane wrote: On Sat, Nov 1, 2025 at 11:32 AM Adrian Klaver > wrote: The community does provide it, just not the version of Postgres released here: I'm not sure of your point here. Companies have forked versions / patche

Re: Enquiry about TDE with PgSQL

> Am 01.11.2025 um 19:54 schrieb Ken Marshall : > > +1 from me for having TDE in-core or available as an extension > > The security auditors that I have worked with have been increasingly > unwilling to actual evaluate the merits of an implementation or perhaps > no longer have the knowledge or

Re: Enquiry about TDE with PgSQL

+1 from me for having TDE in-core or available as an extension The security auditors that I have worked with have been increasingly unwilling to actual evaluate the merits of an implementation or perhaps no longer have the knowledge or skills needed. This is a needed checkbox to allow PostgreSQL t

Re: Enquiry about TDE with PgSQL

On Sat, Nov 1, 2025 at 11:32 AM Adrian Klaver wrote: > The community does provide it, just not the version of Postgres released > here: > I'm not sure of your point here. Companies have forked versions / patches, yes, but not sure how that equates to "community-provided" Cheers, Greg -- Crunch

Re: Enquiry about TDE with PgSQL

On 11/1/25 06:58, Bruce Momjian wrote: On Sat, Nov 1, 2025 at 08:34:57AM +0100, Kai Wagner wrote: If you want to move forward with TDE without waiting to see if the temporary file compression patch will reduce the TDE code impact, you need to dig into how the community does feature calculus a

Re: Enquiry about TDE with PgSQL

On Sat, Nov 1, 2025 at 08:34:57AM +0100, Kai Wagner wrote: > I wholeheartedly agree, as in this thread we are trying to do the same thing > again, that has already happened all they years before. We lose ourselves in > technical reasons, wondering why this makes no sense and how it could be > achi

Re: Enquiry about TDE with PgSQL

On Sat, Nov 1, 2025 at 5:19 AM Chris Travers wrote: > I maintain that the way forward is to get TDE in core. Perhaps someone > could pick up the previous patches and try to push them again > I wholeheartedly agree, as in this thread we are trying to do the same thing again, that has already happ

Re: Enquiry about TDE with PgSQL

I maintain that the way forward is to get TDE in core. Perhaps someone could pick up the previous patches and try to push them again Best Wishes, Chris Travers On Sat, Nov 1, 2025, 8:36 AM Christophe Pettus wrote: > On Oct 31, 2025, at 17:24, Clay Jackson (cjackson) > wrote: > > > > I can't

Re: Enquiry about TDE with PgSQL

On Oct 31, 2025, at 17:24, Clay Jackson (cjackson) wrote: > > I can't disagree - but the question them becomes, as Markus and other have > pointed out; would that allow a customer/user to check the "Encryption" box > for PCI or any other "compliance review" The answer is: it depends (doesn't

Re: Enquiry about TDE with PgSQL

> On Oct 31, 2025, at 17:21, Bruce Momjian wrote: > > I think column-level encryption, on the client side, actually does > improve security and is preferable to file system level TDE, and I think > many here feel the same way. Absolutely. Unfortunately, too many IT security policies are basi

Re: Enquiry about TDE with PgSQL

On Sat, Nov 1, 2025 at 12:24:25AM +, Clay Jackson (cjackson) wrote: > I can't disagree - but the question them becomes, as Markus and > other have pointed out; would that allow a customer/user to check the > "Encryption" box for PCI or any other "compliance review" I think so. It says storag

RE: Enquiry about TDE with PgSQL

949-754-1203 mobile 425-802-9603 -Original Message- From: Bruce Momjian Sent: Friday, October 31, 2025 5:21 PM To: Christophe Pettus Cc: pgsql-general ; Kai Wagner ; Laurenz Albe ; Ron Johnson Subject: Re: Enquiry about TDE with PgSQL CAUTION: This email originated from outside of

Re: Enquiry about TDE with PgSQL

On Fri, Oct 31, 2025 at 05:16:09PM -0700, Christophe Pettus wrote: > On Oct 31, 2025, at 07:54, Bruce Momjian wrote: > > So it seems we have somewhat of a stand-off, with the Postgres > > project questioning the value of TDE and the PCI writers > > doubling-down on specifying disk-level encryption

Re: Enquiry about TDE with PgSQL

On Oct 31, 2025, at 07:54, Bruce Momjian wrote: > So it seems we have somewhat of a stand-off, with the Postgres project > questioning the value of TDE and the PCI writers doubling-down on > specifying disk-level encryption as insufficient. PCI definitely exhibits a preference away from disk-leve

RE: Enquiry about TDE with PgSQL

s Sales Engineer [email protected] office  949-754-1203  mobile 425-802-9603 -Original Message- From: Markus Wanner Sent: Friday, October 31, 2025 4:39 PM To: Bruce Momjian ; Kai Wagner Cc: Laurenz Albe ; Ron Johnson ; pgsql-general Subject: Re: Enquiry about TDE with PgSQL CAU

Re: Enquiry about TDE with PgSQL

It's always entertaining to read PCI DSS... In the "guidance and purpose" column of page 95, the standard reads: Disk-level encryption typically encrypts the entire disk or partition using the same key, with all data automatically decrypted when the system runs or when an authori

Re: Enquiry about TDE with PgSQL

On Fri, Oct 31, 2025 at 05:19:57PM -0400, Ron Johnson wrote: > On Fri, Oct 31, 2025 at 4:53 PM Bruce Momjian wrote: > On Fri, Oct 31, 2025 at 09:04:32PM +0100, Kai Wagner wrote: > We created a group several years ago, got pretty far, but ended up > stopping for reasons I stated in my b

Re: Enquiry about TDE with PgSQL

On Fri, Oct 31, 2025 at 4:53 PM Bruce Momjian wrote: > On Fri, Oct 31, 2025 at 09:04:32PM +0100, Kai Wagner wrote: > > On Fri, Oct 31, 2025 at 7:22 PM Bruce Momjian wrote: > > > > On Fri, Oct 31, 2025 at 06:33:54PM +0100, Álvaro Herrera wrote: > > > On 2025-Oct-31, Bruce Momjian wrote: >

Re: Enquiry about TDE with PgSQL

On Fri, Oct 31, 2025 at 09:04:32PM +0100, Kai Wagner wrote: > On Fri, Oct 31, 2025 at 7:22 PM Bruce Momjian wrote: > > On Fri, Oct 31, 2025 at 06:33:54PM +0100, Álvaro Herrera wrote: > > On 2025-Oct-31, Bruce Momjian wrote: > > > > > Yes, we have been avoiding the masquerade for y

Re: Enquiry about TDE with PgSQL

On Fri, Oct 31, 2025 at 7:22 PM Bruce Momjian wrote: > On Fri, Oct 31, 2025 at 06:33:54PM +0100, Álvaro Herrera wrote: > > On 2025-Oct-31, Bruce Momjian wrote: > > > > > Yes, we have been avoiding the masquerade for years. The question is > > > can we continue. From the lack of discussion since

Re: Enquiry about TDE with PgSQL

On Fri, Oct 31, 2025 at 06:33:54PM +0100, Álvaro Herrera wrote: > On 2025-Oct-31, Bruce Momjian wrote: > > > Yes, we have been avoiding the masquerade for years. The question is > > can we continue. From the lack of discussion since April 1, 2025, it > > seems the answer is yes. > > Maybe, but

Re: Enquiry about TDE with PgSQL

> On Oct 31, 2025, at 10:32, Clay Jackson (cjackson) > wrote: > > Pardo me for jumping in here - but would filesystem level encryption possibly > meet your requirements? If we're talking about PCI DSS, the answer is: Yes, but. Filesystem-level encryption is acceptable IF the encryption ke

Re: Enquiry about TDE with PgSQL

On 2025-Oct-31, Bruce Momjian wrote: > Yes, we have been avoiding the masquerade for years. The question is > can we continue. From the lack of discussion since April 1, 2025, it > seems the answer is yes. Maybe, but I think the only reason for this is that some companies are implementing it lo

RE: Enquiry about TDE with PgSQL

:06 AM To: Christophe Pettus Cc: Adrian Klaver ; Kai Wagner ; Laurenz Albe ; Ron Johnson ; pgsql-general Subject: Re: Enquiry about TDE with PgSQL CAUTION: This email originated from outside of the organization. Do not follow guidance, click links, or open attachments unless you recognize the

Re: Enquiry about TDE with PgSQL

On Fri, Oct 31, 2025 at 10:04:35AM -0700, Christophe Pettus wrote: > > > > On Oct 31, 2025, at 08:21, Adrian Klaver > > wrote: Yeah, what I would like to know is how many of the data > > breaches actually grab directly from the storage versus getting it > > through the database or other software

Re: Enquiry about TDE with PgSQL

> On Oct 31, 2025, at 08:21, Adrian Klaver wrote: > Yeah, what I would like to know is how many of the data breaches actually > grab directly from the storage versus getting it through the database or > other software above the storage? Essentially zero. PCI, like a lot of data security sta

Re: Enquiry about TDE with PgSQL

On 10/31/25 09:40, Laurenz Albe wrote: On Fri, 2025-10-31 at 08:21 -0700, Adrian Klaver wrote: Yeah, what I would like to know is how many of the data breaches actually grab directly from the storage versus getting it through the database or other software above the storage? It seems to me socia

Re: Enquiry about TDE with PgSQL

On Fri, Oct 31, 2025 at 05:40:31PM +0100, Laurenz Albe wrote: > On Fri, 2025-10-31 at 08:21 -0700, Adrian Klaver wrote: > > Yeah, what I would like to know is how many of the data breaches > > actually grab directly from the storage versus getting it through the > > database or other software abo

Re: Enquiry about TDE with PgSQL

On Fri, 2025-10-31 at 08:21 -0700, Adrian Klaver wrote: > Yeah, what I would like to know is how many of the data breaches > actually grab directly from the storage versus getting it through the > database or other software above the storage? It seems to me social > engineering plays a bigger ro

Re: Enquiry about TDE with PgSQL

On 10/31/25 08:25, Greg Sabino Mullane wrote: On Fri, Oct 31, 2025 at 10:54 AM Bruce Momjian > wrote:         Disk-level and partition-level encryption typically encrypts         the entire disk or partition using the same key, with all data         automa

Re: Enquiry about TDE with PgSQL

On Fri, Oct 31, 2025 at 11:25 AM Greg Sabino Mullane wrote: > On Fri, Oct 31, 2025 at 10:54 AM Bruce Momjian wrote: > >> Disk-level and partition-level encryption typically encrypts >> the entire disk or partition using the same key, with all data >> automatically decrypt

Re: Enquiry about TDE with PgSQL

On Fri, Oct 31, 2025 at 11:25:04AM -0400, Greg Sabino Mullane wrote: > On Fri, Oct 31, 2025 at 10:54 AM Bruce Momjian wrote: > >         Disk-level and partition-level encryption typically encrypts >         the entire disk or partition using the same key, with all data >         auto

Re: Enquiry about TDE with PgSQL

On Fri, Oct 31, 2025 at 10:54 AM Bruce Momjian wrote: > Disk-level and partition-level encryption typically encrypts > the entire disk or partition using the same key, with all data > automatically decrypted when the system runs or when an authorized > --> user request

Re: Enquiry about TDE with PgSQL

On 10/31/25 07:54, Bruce Momjian wrote: On Fri, Oct 31, 2025 at 03:01:48PM +0100, Kai Wagner wrote: With the PCI DSS v4.1 standard, one key rule to comply with is, that "If PAN is Uh, I think you mean the 4.0.1 standard, which became active on January 1, 2025. I am surprised this is only be

Re: Enquiry about TDE with PgSQL

On Fri, Oct 31, 2025 at 03:01:48PM +0100, Kai Wagner wrote: > As I personally believe, there is no real way around TDE in the future, either > by extensibility of the core (start with the storage manager and move your way > on from there), to make an extension possible, or by directly adding it to

Re: Enquiry about TDE with PgSQL

Hi Ashish, If you are looking for "native" TDE in PostgreSQL, you won't find it in the PostgreSQL community distribution. If you search for "postgresql tde", you will find a list of vendors that provide TDE functions in their own distributions of PostgreSQL, such as: - https://www.cybertec-

Re: Enquiry about TDE with PgSQL

As I personally believe, there is no real way around TDE in the future, either by extensibility of the core (start with the storage manager and move your way on from there), to make an extension possible, or by directly adding it to the core, there are more reasons coming or are already on their wa

Re: Enquiry about TDE with PgSQL

On Fri, Oct 17, 2025 at 09:01:52AM +0200, Laurenz Albe wrote: > On Fri, 2025-10-17 at 00:49 -0400, Ron Johnson wrote: > > On Thu, Oct 16, 2025 at 6:05 PM Greg Sabino Mullane > > wrote: > > > > > > TDE, on the other hand, is a very complex and difficult thing to add into  > > > Postgres. > > > >

Re: Enquiry about TDE with PgSQL

On Fri, 2025-10-17 at 00:49 -0400, Ron Johnson wrote: > On Thu, Oct 16, 2025 at 6:05 PM Greg Sabino Mullane > wrote: > > > > TDE, on the other hand, is a very complex and difficult thing to add into  > > Postgres. > > TDE was added to SQL Server, with (to us, at least) minimally-noticed > over

Re: Enquiry about TDE with PgSQL

On Fri, Oct 17, 2025 at 12:49 AM Ron Johnson wrote: But filesystem encryption still means that validly logged-in users see the > unencrypted data. That's great for a laptop that might get stolen, or for > drives that are discarded without being wiped, but are no protection > against hackers who

Re: Enquiry about TDE with PgSQL

Am 2025-10-17 15:12, schrieb Greg Sabino Mullane: On Fri, Oct 17, 2025 at 12:49 AM Ron Johnson wrote: But filesystem encryption still means that validly logged-in users see the unencrypted data. That's great for a laptop that might get stolen, or for drives that are discarded without being wi

Re: Enquiry about TDE with PgSQL

On Fri, Oct 17, 2025 at 3:01 AM Laurenz Albe wrote: > On Fri, 2025-10-17 at 00:49 -0400, Ron Johnson wrote: > > On Thu, Oct 16, 2025 at 6:05 PM Greg Sabino Mullane > wrote: > > > > > > TDE, on the other hand, is a very complex and difficult thing to add > into Postgres. > > > > TDE was added to

Re: Enquiry about TDE with PgSQL

On Thu, Oct 16, 2025 at 6:05 PM Greg Sabino Mullane wrote: > I would like to enquire that based on the anecdotal experience of group >> members, which TDE solution works best for PgSQL 17 databases. > > > Generally speaking, there is no "best". People use whatever vendor they > happen to already

Re: Enquiry about TDE with PgSQL

> > I would like to enquire that based on the anecdotal experience of group > members, which TDE solution works best for PgSQL 17 databases. Generally speaking, there is no "best". People use whatever vendor they happen to already use. Your best solution is to avoid TDE altogether. If you really

Enquiry about TDE with PgSQL

Hello, Thank you to the group members for the responses to my previous questions about TDE problems with PgSQL 17. I would like to enquire that based on the anecdotal experience of group members, which TDE solution works best for PgSQL 17 databases. The scenario I have is of a large number of tab