Kevin, Thank you for your reply. I understand what you are saying, but I guess I need a bit deeper understanding for my assessment. Let's dive a bit here:
Say, I got network package. The package was decrypted by OpenSSL. Where this data are, physically, at this moment? Opposite situation: we are about to send results of SELECT statement over the OpenSSL tunnel. Where are the data, physically, between the moment DB engine returned results for my query and moment the package was encrypted by OpenSSL? Thanks, Oleg On Wed, Jan 13, 2016 at 2:46 PM, Kevin Grittner <kgri...@gmail.com> wrote: > On Tue, Jan 12, 2016 at 10:00 PM, oleg yusim <olegyu...@gmail.com> wrote: > > > Important: let's assume data at rest is encrypted using EFS and data at > > transit is encrypted using ciphers, provided by OpenSSL. > > > > So, with that in mind, please, help me to understand movement and > location > > of the data between the moment when it is pulled from file system and > > encrypted as network package going through the SSL tunnel. > > > > And reversing it - between the moment network package arrived through the > > SSL tunnel is decrypted and the moment its content is placed into the > file > > system. > > At all times the data is present only in files owned by the OS user > which runs the database server or in RAM allocated to processes run > by that user. Files and RAM are freed without overwrite; we count > on the OS to not gratuitously show the old values to processes > making new allocations. > > -- > Kevin Grittner > EDB: http://www.enterprisedb.com > The Enterprise PostgreSQL Company >
