Greetings, * Joe Conway (m...@joeconway.com) wrote: > On 6/16/19 9:45 AM, Bruce Momjian wrote: > > On Sun, Jun 16, 2019 at 07:07:20AM -0400, Joe Conway wrote: > >> In any case it doesn't address my first point, which is limiting the > >> volume encrypted with the same key. Another valid reason is you might > >> have data at varying sensitivity levels and prefer different keys be > >> used for each level. > > > > That seems quite complex. > > How? It is no more complex than encrypting at the tablespace level > already gives you - in that case you get this property for free if you > care to use it.
Perhaps not surprising, but I'm definitely in agreement with Joe regarding having multiple keys when possible and (reasonably) straight-forward to do so. I also don't buy off on the OpenSSL argument; their more severe issues certainly haven't been due to key management issues such as what we're discussing here, so I don't think the argument applies. Thanks, Stephen
signature.asc
Description: PGP signature
