On Fri, Aug 23, 2019 at 10:04:13PM -0400, Stephen Frost wrote:
> > Well, I think they might do that to reduce encryption overhead. I think
> > tests have shown that is not an issue, but we will need to test further.
>
> I seriously doubt that's why and I don't think there's actually much
> value in trying to figure out the "why" here- the question is, do those
> systems answer the check-box requirement that was brought up on the call
> as the justification for this feature? If so, then clearly not
> everything is required to be encrypted and we shouldn't be stressing
> over trying to do that.
We will stress in trying _not_ to encrypt everything.
> > I am not sure of the downside of encrypting everything, since it leaks
> > the least information and has a minimal user API and code impact. What
> > is the value of encrypting only the user rows? Better key control?
>
> Yes, better key control, and better user API, and avoiding having an
Uh, there is no user API for all-cluster encryption except for the
administrator.
--
Bruce Momjian <bruce@momjian.us> http://momjian.us
EnterpriseDB http://enterprisedb.com
+ As you are, so once was I. As I am, so you will be. +
+ Ancient Roman grave inscription +