pgcryptokey
pgcryptokey
pgcryptokey : cryptographic key management
Overview
| ID | Extension | Package | Version | Category | License | Language |
|---|---|---|---|---|---|---|
| 7320 | pgcryptokey
|
pgcryptokey
|
0.85 |
SEC
|
PostgreSQL
|
C
|
| Attribute | Has Binary | Has Library | Need Load | Has DDL | Relocatable | Trusted |
|---|---|---|---|---|---|---|
--s-d-r
|
No
|
Yes
|
No
|
Yes
|
yes
|
no
|
| Relationships | |
|---|---|
| Requires | pgcrypto
|
| See Also | pgsodium
pgsmcrypto
pg_tde
faker
passwordcheck_cracklib
supautils
supabase_vault
|
missing 14 on el pgdg repo
Packages
| Type | Repo | Version | PG Major Compatibility | Package Pattern | Dependencies |
|---|---|---|---|---|---|
| EXT | MIXED
|
0.85 |
18
17
16
15
14
|
pgcryptokey |
pgcrypto |
| RPM | PIGSTY
|
0.85 |
18
17
16
15
14
|
pgcryptokey_$v |
- |
| DEB | PIGSTY
|
0.85 |
18
17
16
15
14
|
postgresql-$v-pgcryptokey |
- |
| Linux / PG | PG18 | PG17 | PG16 | PG15 | PG14 |
|---|---|---|---|---|---|
el8.x86_64
|
PIGSTY 0.85
|
PGDG 0.85
|
PGDG 0.85
|
PGDG 0.85
|
PGDG 0.85
|
el8.aarch64
|
PIGSTY 0.85
|
PGDG 0.85
|
PGDG 0.85
|
PGDG 0.85
|
PGDG 0.85
|
el9.x86_64
|
PIGSTY 0.85
|
PGDG 0.85
|
PGDG 0.85
|
PGDG 0.85
|
PIGSTY 0.85
|
el9.aarch64
|
PIGSTY 0.85
|
PGDG 0.85
|
PGDG 0.85
|
PGDG 0.85
|
PGDG 0.85
|
el10.x86_64
|
PIGSTY 0.85
|
PGDG 0.85
|
PGDG 0.85
|
PGDG 0.85
|
PGDG 0.85
|
el10.aarch64
|
PIGSTY 0.85
|
PGDG 0.85
|
PGDG 0.85
|
PGDG 0.85
|
PGDG 0.85
|
d12.x86_64
|
PIGSTY 0.85
|
PIGSTY 0.85
|
PIGSTY 0.85
|
PIGSTY 0.85
|
PIGSTY 0.85
|
d12.aarch64
|
PIGSTY 0.85
|
PIGSTY 0.85
|
PIGSTY 0.85
|
PIGSTY 0.85
|
PIGSTY 0.85
|
d13.x86_64
|
PIGSTY 0.85
|
PIGSTY 0.85
|
PIGSTY 0.85
|
PIGSTY 0.85
|
PIGSTY 0.85
|
d13.aarch64
|
PIGSTY 0.85
|
PIGSTY 0.85
|
PIGSTY 0.85
|
PIGSTY 0.85
|
PIGSTY 0.85
|
u22.x86_64
|
PIGSTY 0.85
|
PIGSTY 0.85
|
PIGSTY 0.85
|
PIGSTY 0.85
|
PIGSTY 0.85
|
u22.aarch64
|
PIGSTY 0.85
|
PIGSTY 0.85
|
PIGSTY 0.85
|
PIGSTY 0.85
|
PIGSTY 0.85
|
u24.x86_64
|
PIGSTY 0.85
|
PIGSTY 0.85
|
PIGSTY 0.85
|
PIGSTY 0.85
|
PIGSTY 0.85
|
u24.aarch64
|
PIGSTY 0.85
|
PIGSTY 0.85
|
PIGSTY 0.85
|
PIGSTY 0.85
|
PIGSTY 0.85
|
Source
pig build pkg pgcryptokey; # build rpm/debInstall
Make sure PGDG and PIGSTY repo available:
pig repo add pgsql -u # add both repo and update cacheInstall this extension with pig:
pig install pgcryptokey; # install via package name, for the active PG version
pig install pgcryptokey -v 18; # install for PG 18
pig install pgcryptokey -v 17; # install for PG 17
pig install pgcryptokey -v 16; # install for PG 16
pig install pgcryptokey -v 15; # install for PG 15
pig install pgcryptokey -v 14; # install for PG 14Create this extension with:
CREATE EXTENSION pgcryptokey CASCADE; -- requires pgcryptoUsage
pgcryptokey manages cryptographic data encryption keys within PostgreSQL. Keys are stored encrypted and secured by access passwords, supporting both system-wide and per-session key access.
CREATE EXTENSION pgcryptokey;Key Management Functions
| Function | Description |
|---|---|
create_cryptokey(name, byte_len) |
Generate a new cryptographic key |
set_cryptokey(name) |
Set the active key for operations |
get_cryptokey(name) |
Retrieve key material |
drop_cryptokey(name) |
Remove a key |
supersede_cryptokey() |
Rotate to a new key (same access password) |
change_key_access_password() |
Update key authentication credentials |
reencrypt_data() |
Re-encrypt data with a different key |
Session Control
| Function | Description |
|---|---|
get_shared_key() |
Establish client/server shared secret (SSL/Unix only) |
set_session_access_password() |
Client-supplied password authentication |
Typical Workflow
-- Create a key
SELECT create_cryptokey('mykey', 32);
-- Set active key
SELECT set_cryptokey('mykey');
-- Encrypt data using pgcrypto functions with the managed key
UPDATE secrets SET data = pgp_sym_encrypt(plaintext, get_cryptokey('mykey'));
-- Decrypt data
SELECT pgp_sym_decrypt(data, get_cryptokey('mykey')) FROM secrets;
-- Rotate key
SELECT supersede_cryptokey();Access passwords can be configured at database boot time for system-wide access, or per-session by individual clients for granular security control.
Last updated on