Transparent Column Encryption for PostgreSQL, written in Rust with pgrx.

Warning

This is an educational reimplementation of The Cryptic Elephant by Dalibo. It is experimental. DO NOT USE IN PRODUCTION. If you need this extension, please refer to the original project.

Usage

CREATE EXTENSION pg_cipher;

-- Load the secret key (32 bytes, hex encoded) from a remote file...
SELECT fetch_key_from_remote_file('https://secure.server.local/secret_key.txt');

-- ...or from a local file on the server
SELECT fetch_key_from_local_file('/path/to/secret_key.txt');

-- Use TCETEXT instead of TEXT
CREATE TABLE person (
    id   SERIAL,
    name TCETEXT
);

INSERT INTO person (name) VALUES ('alice');

-- Values are decrypted on output
SELECT name FROM person;

-- Inspect the ciphertext stored on disk
SELECT raw(name) FROM person;

Build

1. Install pgrx: see the pgrx README.

2. Build and run (pick a PostgreSQL version, e.g. pg17):

   cargo pgrx run pg17

3. Run the tests:

   cargo pgrx test pg17
   cargo pgrx regress pg17

To do

• Add more types
• Automatically fetch the key when a user connects
• Substitute TCETEXT for the regular TEXT type
• Implement AES encryption instead of ChaCha20

License

See LICENSE.