pgcryptokey
cryptographic key management
Repository
https://momjian.us/download/pgcryptokey/
https://momjian.us/download/pgcryptokey/
Source
pgcryptokey-0.85.tar.gz
pgcryptokey-0.85.tar.gz
Overview
| Package | Version | Category | License | Language |
|---|---|---|---|---|
pgcryptokey | 0.85 | SEC | PostgreSQL | C |
| ID | Extension | Bin | Lib | Load | Create | Trust | Reloc | Schema |
|---|---|---|---|---|---|---|---|---|
| 7320 | pgcryptokey | No | Yes | No | Yes | No | Yes | - |
| Related | pgcrypto pgsodium pgsmcrypto pg_tde faker passwordcheck_cracklib supautils supabase_vault |
|---|
missing 14 on el pgdg repo
Version
| Type | Repo | Version | PG Ver | Package | Deps |
|---|---|---|---|---|---|
| EXT | MIXED | 0.85 | 1817161514 | pgcryptokey | pgcrypto |
| RPM | PIGSTY | 0.85 | 1817161514 | pgcryptokey_$v | - |
| DEB | PIGSTY | 0.85 | 1817161514 | postgresql-$v-pgcryptokey | - |
Build
You can build the RPM / DEB packages for pgcryptokey using pig build:
pig build pkg pgcryptokey # build RPM / DEB packages
Install
You can install pgcryptokey directly. First, make sure the PGDG and PIGSTY repositories are added and enabled:
pig repo add pgsql -u # Add repo and update cache
Install the extension using pig or apt/yum/dnf:
pig install pgcryptokey; # Install for current active PG version
pig ext install -y pgcryptokey -v 18 # PG 18
pig ext install -y pgcryptokey -v 17 # PG 17
pig ext install -y pgcryptokey -v 16 # PG 16
pig ext install -y pgcryptokey -v 15 # PG 15
pig ext install -y pgcryptokey -v 14 # PG 14
dnf install -y pgcryptokey_18 # PG 18
dnf install -y pgcryptokey_17 # PG 17
dnf install -y pgcryptokey_16 # PG 16
dnf install -y pgcryptokey_15 # PG 15
dnf install -y pgcryptokey_14 # PG 14
apt install -y postgresql-18-pgcryptokey # PG 18
apt install -y postgresql-17-pgcryptokey # PG 17
apt install -y postgresql-16-pgcryptokey # PG 16
apt install -y postgresql-15-pgcryptokey # PG 15
apt install -y postgresql-14-pgcryptokey # PG 14
Create Extension:
CREATE EXTENSION pgcryptokey CASCADE; -- requires: pgcrypto
Usage
pgcryptokey manages cryptographic data encryption keys within PostgreSQL. Keys are stored encrypted and secured by access passwords, supporting both system-wide and per-session key access.
CREATE EXTENSION pgcryptokey;
Key Management Functions
| Function | Description |
|---|---|
create_cryptokey(name, byte_len) | Generate a new cryptographic key |
set_cryptokey(name) | Set the active key for operations |
get_cryptokey(name) | Retrieve key material |
drop_cryptokey(name) | Remove a key |
supersede_cryptokey() | Rotate to a new key (same access password) |
change_key_access_password() | Update key authentication credentials |
reencrypt_data() | Re-encrypt data with a different key |
Session Control
| Function | Description |
|---|---|
get_shared_key() | Establish client/server shared secret (SSL/Unix only) |
set_session_access_password() | Client-supplied password authentication |
Typical Workflow
-- Create a key
SELECT create_cryptokey('mykey', 32);
-- Set active key
SELECT set_cryptokey('mykey');
-- Encrypt data using pgcrypto functions with the managed key
UPDATE secrets SET data = pgp_sym_encrypt(plaintext, get_cryptokey('mykey'));
-- Decrypt data
SELECT pgp_sym_decrypt(data, get_cryptokey('mykey')) FROM secrets;
-- Rotate key
SELECT supersede_cryptokey();
Access passwords can be configured at database boot time for system-wide access, or per-session by individual clients for granular security control.
Feedback
Was this page helpful?
Thanks for the feedback! Please let us know how we can improve.
Sorry to hear that. Please let us know how we can improve.