pgcryptokey

pig build pkg pgcryptokey;		# build rpm/deb

pig repo add pgsql -u   # add both repo and update cache

pig install pgcryptokey;		# install via package name, for the active PG version

pig install pgcryptokey -v 18;   # install for PG 18
pig install pgcryptokey -v 17;   # install for PG 17
pig install pgcryptokey -v 16;   # install for PG 16
pig install pgcryptokey -v 15;   # install for PG 15
pig install pgcryptokey -v 14;   # install for PG 14

CREATE EXTENSION pgcryptokey CASCADE; -- requires pgcrypto

CREATE EXTENSION pgcryptokey;

-- Create a key
SELECT create_cryptokey('mykey', 32);

-- Set active key
SELECT set_cryptokey('mykey');

-- Encrypt data using pgcrypto functions with the managed key
UPDATE secrets SET data = pgp_sym_encrypt(plaintext, get_cryptokey('mykey'));

-- Decrypt data
SELECT pgp_sym_decrypt(data, get_cryptokey('mykey')) FROM secrets;

-- Rotate key
SELECT supersede_cryptokey();