pg_vault_tde has reached v1.7.1, offering Transparent Data Encryption (TDE) for PostgreSQL 17 and PostgreSQL 18. The extension ships an encrypted_heap table access method that encrypts every tuple with AES-256-GCM before it reaches the storage manager and decrypts it after it leaves. Because encryption happens below the SQL layer, existing applications require no changes. Keys live outside the database: HashiCorp Vault or OpenBao through the Transit engine, a PKCS#11 token or HSM, or a local PKCS#12 wallet. Data encryption keys are per table and can be rotated online.
- Fix in 1.7.1: the AAD derivation for out-of-line TOAST values is corrected. As a consequence, TOAST data written by 1.7.0 or earlier does not authenticate under 1.7.1, so affected tables must be exported before the new binary is installed.
- Migration procedure: documented in the project
README; follow it before upgrading to avoid authentication failures on existing TOAST data. - Requirements: PostgreSQL 17 or 18, OpenSSL 3.x, and the library added to
shared_preload_libraries. - Key management: external KMS/HSM via HashiCorp Vault or OpenBao Transit, PKCS#11, or a local PKCS#12 wallet.
- Packaging: binary
.deband.rpmpackages, sources, and documentation on GitHub; distribution also on PGXN. - Licence: released under the PostgreSQL licence.
For developers, the shift means encryption-at-rest can be added without rewriting queries or changing the application schema. The encrypted_heap access method keeps the encryption boundary at the storage manager, so tuples, indexes, and TOAST chunks are protected consistently. Per-table keys and online rotation simplify compliance work and reduce downtime during key lifecycle events. The 1.7.1 TOAST fix is the critical operational detail: teams already running 1.7.0 or earlier must export affected tables before swapping binaries, or previously written out-of-line values will fail authentication. Confirm your shared_preload_libraries configuration and OpenSSL version before deploying.