I have two machines: client and server (a database server). I want to connect from client to server and manipulate data from database (insert, update, delete, select) using dblink
.
I would like to ask what is more secure:
- Encrypting data on client side, send them to the server from client as ciphertext and then store in
PostgreSQL
database - Send data from client to server and do the encryption/decryption on server side with
pgcrytpto
?
Is that secure that server obtains the encryption key temporarily (for the time of one of possible operations only) from client / other server? Im wondering if there's a possibility that no matter if server obtains a key only temporarily, is there still posibility that the key will be available in PostgreSQL
server's logs (or any other database server) somehow?
pgcrypto
isnt a good idea at all - isnt secure).