pgcryptokey
pgcryptokey
pgcryptokey : cryptographic key management
Overview
| ID | Extension | Package | Version | Category | License | Language |
|---|---|---|---|---|---|---|
| 7320 | pgcryptokey | pgcryptokey | 0.85 | SEC | PostgreSQL | C |
| Attribute | Has Binary | Has Library | Need Load | Has DDL | Relocatable | Trusted |
|---|---|---|---|---|---|---|
--s-d-r | No | Yes | No | Yes | yes | no |
| Relationships | |
|---|---|
| Requires | pgcrypto |
| See Also | pgsodium pgsmcrypto pg_tde faker passwordcheck_cracklib supautils supabase_vault |
missing 14 on el pgdg repo
Packages
| Type | Repo | Version | PG Major Compatibility | Package Pattern | Dependencies |
|---|---|---|---|---|---|
| EXT | MIXED | 0.85 | 18 17 16 15 14 | pgcryptokey | pgcrypto |
| RPM | PIGSTY | 0.85 | 18 17 16 15 14 | pgcryptokey_$v | - |
| DEB | PIGSTY | 0.85 | 18 17 16 15 14 | postgresql-$v-pgcryptokey | - |
| Linux / PG | PG18 | PG17 | PG16 | PG15 | PG14 |
|---|---|---|---|---|---|
el8.x86_64 | PIGSTY 0.85 | PGDG 0.85 | PGDG 0.85 | PGDG 0.85 | PGDG 0.85 |
el8.aarch64 | PIGSTY 0.85 | PGDG 0.85 | PGDG 0.85 | PGDG 0.85 | PGDG 0.85 |
el9.x86_64 | PIGSTY 0.85 | PGDG 0.85 | PGDG 0.85 | PGDG 0.85 | PIGSTY 0.85 |
el9.aarch64 | PIGSTY 0.85 | PGDG 0.85 | PGDG 0.85 | PGDG 0.85 | PGDG 0.85 |
el10.x86_64 | PIGSTY 0.85 | PGDG 0.85 | PGDG 0.85 | PGDG 0.85 | PGDG 0.85 |
el10.aarch64 | PIGSTY 0.85 | PGDG 0.85 | PGDG 0.85 | PGDG 0.85 | PGDG 0.85 |
d12.x86_64 | PIGSTY 0.85 | PIGSTY 0.85 | PIGSTY 0.85 | PIGSTY 0.85 | PIGSTY 0.85 |
d12.aarch64 | PIGSTY 0.85 | PIGSTY 0.85 | PIGSTY 0.85 | PIGSTY 0.85 | PIGSTY 0.85 |
d13.x86_64 | PIGSTY 0.85 | PIGSTY 0.85 | PIGSTY 0.85 | PIGSTY 0.85 | PIGSTY 0.85 |
d13.aarch64 | PIGSTY 0.85 | PIGSTY 0.85 | PIGSTY 0.85 | PIGSTY 0.85 | PIGSTY 0.85 |
u22.x86_64 | PIGSTY 0.85 | PIGSTY 0.85 | PIGSTY 0.85 | PIGSTY 0.85 | PIGSTY 0.85 |
u22.aarch64 | PIGSTY 0.85 | PIGSTY 0.85 | PIGSTY 0.85 | PIGSTY 0.85 | PIGSTY 0.85 |
u24.x86_64 | PIGSTY 0.85 | PIGSTY 0.85 | PIGSTY 0.85 | PIGSTY 0.85 | PIGSTY 0.85 |
u24.aarch64 | PIGSTY 0.85 | PIGSTY 0.85 | PIGSTY 0.85 | PIGSTY 0.85 | PIGSTY 0.85 |
Source
pig build pkg pgcryptokey; # build rpm/debInstall
Make sure PGDG and PIGSTY repo available:
pig repo add pgsql -u # add both repo and update cacheInstall this extension with pig:
pig install pgcryptokey; # install via package name, for the active PG version
pig install pgcryptokey -v 18; # install for PG 18
pig install pgcryptokey -v 17; # install for PG 17
pig install pgcryptokey -v 16; # install for PG 16
pig install pgcryptokey -v 15; # install for PG 15
pig install pgcryptokey -v 14; # install for PG 14Create this extension with:
CREATE EXTENSION pgcryptokey CASCADE; -- requires pgcryptoUsage
pgcryptokey manages cryptographic data encryption keys within PostgreSQL. Keys are stored encrypted and secured by access passwords, supporting both system-wide and per-session key access.
CREATE EXTENSION pgcryptokey;Key Management Functions
| Function | Description |
|---|---|
create_cryptokey(name, byte_len) | Generate a new cryptographic key |
set_cryptokey(name) | Set the active key for operations |
get_cryptokey(name) | Retrieve key material |
drop_cryptokey(name) | Remove a key |
supersede_cryptokey() | Rotate to a new key (same access password) |
change_key_access_password() | Update key authentication credentials |
reencrypt_data() | Re-encrypt data with a different key |
Session Control
| Function | Description |
|---|---|
get_shared_key() | Establish client/server shared secret (SSL/Unix only) |
set_session_access_password() | Client-supplied password authentication |
Typical Workflow
-- Create a key
SELECT create_cryptokey('mykey', 32);
-- Set active key
SELECT set_cryptokey('mykey');
-- Encrypt data using pgcrypto functions with the managed key
UPDATE secrets SET data = pgp_sym_encrypt(plaintext, get_cryptokey('mykey'));
-- Decrypt data
SELECT pgp_sym_decrypt(data, get_cryptokey('mykey')) FROM secrets;
-- Rotate key
SELECT supersede_cryptokey();Access passwords can be configured at database boot time for system-wide access, or per-session by individual clients for granular security control.
Last updated on