> Geoff Worboys wrote:
> > ...
>
> You are probably right. As I said, I haven't yet seen the actual
> requirements, but what has been reported indicate that they aren't
> easily fulfilled. Encrypting the disc or the entire database is
> probably not enough. Don't ask me why (yet).
> Do the requirements make sense, do they make anything more secure
> (than disk encryption)? Probably not. We will just have to comply.
> I'll probably be back later, hoping to be more specific.
> If it isn't obvious, let me just confess: I have next to no
> experience with encryption technology.
>
> --
> Aage J.

The only way thru this for you is to force a dialog over their spec.
Answering yes/no to their requirements is never going to win you anything.
You may be right (conspiracy) that they are being fed a line by a marketing
type. You need to shoot some holes thru the spec to make yourself look
professional.
Alan