pgsodium
Overview
| Package | Version | Category | License | Language |
|---|---|---|---|---|
pgsodium | 3.1.9 | SEC | BSD 3-Clause | C |
| ID | Extension | Bin | Lib | Load | Create | Trust | Reloc | Schema |
|---|---|---|---|---|---|---|---|---|
| 7020 | pgsodium | No | Yes | Yes | Yes | No | No | pgsodium |
| Related | pgsmcrypto pgcryptokey pgcrypto anon pg_tde sslutils faker |
|---|---|
| Depended By | supabase_vault |
+fix missing pg17
Version
| Type | Repo | Version | PG Ver | Package | Deps |
|---|---|---|---|---|---|
| EXT | PIGSTY | 3.1.9 | 1817161514 | pgsodium | - |
| RPM | PIGSTY | 3.1.9 | 1817161514 | pgsodium_$v | - |
| DEB | PIGSTY | 3.1.9 | 1817161514 | postgresql-$v-pgsodium | - |
Build
You can build the RPM / DEB packages for pgsodium using pig build:
pig build pkg pgsodium # build RPM / DEB packages
Install
You can install pgsodium directly. First, make sure the PGDG and PIGSTY repositories are added and enabled:
pig repo add pgsql -u # Add repo and update cache
Install the extension using pig or apt/yum/dnf:
pig install pgsodium; # Install for current active PG version
pig ext install -y pgsodium -v 18 # PG 18
pig ext install -y pgsodium -v 17 # PG 17
pig ext install -y pgsodium -v 16 # PG 16
pig ext install -y pgsodium -v 15 # PG 15
pig ext install -y pgsodium -v 14 # PG 14
dnf install -y pgsodium_18 # PG 18
dnf install -y pgsodium_17 # PG 17
dnf install -y pgsodium_16 # PG 16
dnf install -y pgsodium_15 # PG 15
dnf install -y pgsodium_14 # PG 14
apt install -y postgresql-18-pgsodium # PG 18
apt install -y postgresql-17-pgsodium # PG 17
apt install -y postgresql-16-pgsodium # PG 16
apt install -y postgresql-15-pgsodium # PG 15
apt install -y postgresql-14-pgsodium # PG 14
Preload:
shared_preload_libraries = 'pgsodium';
Create Extension:
CREATE EXTENSION pgsodium;
Usage
pgsodium: libsodium-based cryptographic functions for PostgreSQL
pgsodium is an encryption library extension for PostgreSQL using the libsodium library. It provides a direct SQL interface to libsodium, server-managed key derivation, and Transparent Column Encryption (TCE).
CREATE EXTENSION pgsodium;
Generating Random Data
SELECT pgsodium.randombytes_random();
SELECT pgsodium.randombytes_buf(16); -- 16 random bytes
SELECT pgsodium.randombytes_uniform(100); -- random int 0-99
Secret Key Encryption (Authenticated)
SELECT * FROM pgsodium.crypto_secretbox_keygen();
SELECT pgsodium.crypto_secretbox('message', nonce, key);
SELECT pgsodium.crypto_secretbox_open(ciphertext, nonce, key);
Public Key Encryption
SELECT * FROM pgsodium.crypto_box_new_keypair();
SELECT pgsodium.crypto_box('message', nonce, public_key, secret_key);
SELECT pgsodium.crypto_box_open(ciphertext, nonce, public_key, secret_key);
Public Key Signatures
SELECT * FROM pgsodium.crypto_sign_new_keypair();
SELECT pgsodium.crypto_sign('message', secret_key);
SELECT pgsodium.crypto_sign_open(signed_message, public_key);
Password Hashing
SELECT pgsodium.crypto_pwhash_str('my_password');
SELECT pgsodium.crypto_pwhash_str_verify(hash, 'my_password');
Hashing
SELECT pgsodium.crypto_generichash('data');
SELECT pgsodium.crypto_shorthash('data', key);
Server Key Management
pgsodium can load an external root key into memory that is never accessible to SQL. Sub-keys are derived by key id:
SELECT * FROM pgsodium.create_key();
-- Returns a UUID key id for use with TCE or encryption functions
Transparent Column Encryption (TCE)
CREATE TABLE private.users (
id bigserial PRIMARY KEY,
secret text
);
SECURITY LABEL FOR pgsodium ON COLUMN private.users.secret
IS 'ENCRYPT WITH KEY ID dfc44293-fa78-4a1a-9ef9-7e600e63e101';
Encrypted data is stored on disk and automatically decrypted via a generated view.
Security Roles
pgsodium_keyiduser– less privileged, can only access keys by UUIDpgsodium_keymaker– more privileged, can work with raw keys
Feedback
Was this page helpful?
Thanks for the feedback! Please let us know how we can improve.
Sorry to hear that. Please let us know how we can improve.