Column encryption solutions and ideas
summary
Claims that client-side column encryption gives stronger protection than TDE, demos use of proxies (commercial, e.g. Baffle), application libraries, ORMs, and server plugins. Notes pgcrypto is almost never the right answer because it uses CBC and lacks key management; highlights pgsodium provides transparent server-side column encryption via triggers/views but remains server-side. Describes a proposed PostgreSQL patch with a two-tier key architecture, explains the practical trade-offs of deterministic vs randomized encryption, padding leaks, key rotation, and protocol/driver hurdles.
AI-written summary · about
chapters (12)
- 0:00Introduction to encryption
- 3:13Why encrypt database data
- 8:54Client-side column encryption goals
- 11:42Pros and cons of proxy solutions
- 14:09Client-side encryption in code
- 18:22PG crypto limitations
- 21:56Encryption details and trade-offs
- 32:32PG sodium as an alternative
- 35:20Postgres patch for column encryption
- 38:56Key management challenges
- 42:28Hardware security enclaves
- 44:56Final caveats and summary
related talks
29mA comparison of PostgreSQL Encryption Options
35mSecuring PostgreSQL From External Attack
34mWhy your encrypted Database isn't secure: practical attacks against encrypted OSS databases
34mSave the Elephants - Secure Your PostgreSQL Databases with TDE
45mTDE as an Extension: A Different Path for PostgreSQL Encryption
38mPostgreSQL and DevSecOps: Ensuring database security
07mAll about Postgres security
51mWhere should I be encrypting my data