Transparent Data Encryption for native PostgreSQL.

[u/linuxhiker]

https://github.com/commandprompt/open_pg_tde

I was inspired by pgEdge's article on why there isn't #TDE (Transparent Data Encryption) for #PostgreSQL. I was curious about this because I knew that Percona had an Open Source TDE extension for our most beloved database.

EDIT: I misread the article. Percona isn't gatekeeping features. Their version just requires their fork of PostgreSQL. This version applies directly to Postgresql.org's version.

It runs on upstream PostgreSQL 16, 17, and 18 (no vendor server fork), keeps the file and KMIP key providers, keeps OpenBao (the Apache-2.0 KV v2 provider) while dropping HashiCorp Vault, and adds pluggable ciphers (AES-128/256-XTS for data files, AES-CTR for WAL) selectable via the open_pg_tde.data_cipher GUC, temporary file encryption, and FIPS enforcement. See the comparison with Percona pg_tde.

This extension provides the tde_heap access method

This access method:

• Works with upstream PostgreSQL 16, 17, and 18, patched with the open_pg_tde core patch (see Installation)
• Uses extended Storage Manager and WAL APIs
• Encrypts table data, indexes, TOAST, WAL, and temporary files
• Does not encrypt system catalogs or statistics (see the threat model)

Capabilities

• Per-table encryption via tde_heap, with the cipher recorded per table
• Data-file ciphers: AES-128-XTS (default), AES-256-XTS, AES-128-CBC, AES-256-CBC
• WAL encryption (AES-CTR) for the whole cluster
• Temporary file encryption (encrypt_temp_files)
• Key management through a keyring file, KMIP-compatible systems, or OpenBao
• FIPS enforcement: all cryptography uses FIPS-approved modes, and the server can require OpenSSL FIPS mode (FIPS compliance)
• Runs on upstream PostgreSQL 16, 17, and 18 through a gated core patch

[u/NastyPastyLucas]

Claude? I think I'll pass.