`pg_vault_tde` provides Transparent Data Encryption for PostgreSQL 17 and 18. A 
table access method, `encrypted_heap`, encrypts every tuple with AES-256-GCM 
before it reaches the storage manager and decrypts it after it leaves, so 
applications require no changes.

Keys are held outside the database: HashiCorp Vault or OpenBao through the 
Transit engine, a PKCS#11 token or HSM, or a local PKCS#12 wallet. Data 
encryption keys are per table and can be rotated online. Requirements are 
PostgreSQL 17 or 18, OpenSSL 3.x, and the library listed in 
`shared_preload_libraries`.

The current release is 1.7.1. It corrects the AAD derivation for out-of-line 
TOAST values, with the consequence that **TOAST data written by 1.7.0 or 
earlier does not authenticate under 1.7.1**: affected tables must be exported 
before the new binary is installed. The procedure is documented in the 
[README](https://github.com/labmiriade/pg_vault_tde).

`pg_vault_tde` is released under the PostgreSQL licence. Sources, documentation 
and binary `.deb` and `.rpm` packages are on 
[GitHub](https://github.com/labmiriade/pg_vault_tde); the distribution is on 
[PGXN](https://pgxn.org/dist/pg_vault_tde/).

Reply via email to