Re: Looking for advice on database encryption

From: "Will Rutherdale (rutherw)" <rutherw(at)cisco(dot)com>
To: <pgsql-general(at)postgresql(dot)org>
Subject: Re: Looking for advice on database encryption
Date: 2009-04-16 21:18:31
Message-ID: 50A8E1F8D9122546A7F67134915EDB7A3B8E69@xmb-rtp-21a.amer.cisco.com
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-general

Couldn't you just add a PGP based column (or similar encryption
protocol) for authentication? This would protect you against injection
attacks, would it not?

You could also use PGP or similar for key management if I'm not
mistaken.

-Will

-----Original Message-----
In response to Thomas Kellerer <spam_eater(at)gmx(dot)net>:

That was the first suggestion when we started brainstorming ideas.
Unfortunately, it fails to protect us from the most likely attack
vector: SQL Injection/application layer bugs. In an SQL Injection
(for example) the fact that the filesystem is encrypted does zero
to protect the sensitive data.

In response to

Responses

Browse pgsql-general by date

  From Date Subject
Next Message John R Pierce 2009-04-16 22:00:24 Re: Looking for advice on database encryption
Previous Message Thomas Kellerer 2009-04-16 21:13:37 Re: Looking for advice on database encryption