PostgreSQL, storing encrypted data or encrypt database with pgcrypto - what is more secure? I have two machines: client and server (a database server). I want to connect from client to server and manipulate data from database (insert, update, delete, select) using dblink.

I would like to ask what is more secure:


Encrypting data on client side, send them to the server from client as ciphertext and then store in PostgreSQL database
Send data from client to server and do the encryption/decryption on server side with pgcrytpto?


Is that secure that server obtains the encryption key temporarily (for the time of one of possible operations only) from client / other server? Im wondering if there's a possibility that no matter if server obtains a key only temporarily, is there still posibility that the key will be available in PostgreSQL server's logs (or any other database server) somehow?
Yes - it is certainly possible that a key used in pgcrypto function would end up in server logs or leak somewhere else.

Postgres could be configured to log long running queries (and for example password hash functions are long running by design) or even all of them. There are utilities that show current running queries. Or an error in a query can leak it in an error message.

So, if I had a choice, I'd use cryptographic functions from a frontend language.