pg_vault_tde

pg_vault_tde is an open-source PostgreSQL extension that provides Transparent Data Encryption (TDE) for PostgreSQL versions 17 and 18, with planned support for version 19. It utilizes the AES-256-GCM encryption algorithm and operates at the Table Access Method layer, meaning data is encrypted before storage and decrypted upon retrieval, without requiring any modifications to the PostgreSQL core. The extension supports multiple key management solutions: HashiCorp Vault, OpenBao, local PKCS#12 wallets, and PKCS#11 HSMs. Encryption keys are managed externally and cached in shared memory with automatic rotation capabilities. Key features include: * **Transparent Encryption**: Encrypts every tuple with AES-256-GCM. Data is encrypted before reaching the storage manager and decrypted after leaving it. * **Key Management Options**: Supports HashiCorp Vault/OpenBao, local PKCS#12 wallets, and PKCS#11/HSM integration. * **No Core Modifications**: Operates as a plug-and-play extension. * **Index Encryption**: Supports AES-256-SIV for B-Tree indexes (`tde_btree`). Future versions plan support for GIN, Hash, and GiST equality indexes. * **WAL Encryption**: Data is encrypted before being written to the Write-Ahead Log (WAL). * **Per-Database KMS Configuration**: Allows different KMS settings for individual databases within the same cluster. * **Key Rotation**: Supports both per-table DEK rotation (online) and KEK rotation. Installation can be done by building from source or using `pgxn install`. Configuration involves modifying `postgresql.conf` to include `pg_vault_tde` in `shared_preload_libraries` and then creating the extension in the database. Specific GUC parameters are used to configure the chosen KMS provider and its settings. The extension defines a new table access method `encrypted_heap` for creating encrypted tables. Data is transparently decrypted on read. The wire format for encrypted tuples includes a header, IV, ciphertext, GCM tag, version, and generation counter, adding a small overhead per tuple.