pgsodium: Encryption Features

pgsodium is a PostgreSQL extension which provides SQL access to libsodium's high-level cryptographic algorithms.

libsodium is a modern, easy-to-use software library for encryption, decryption, signatures, password hashing, and more. It is a portable, cross-compilable, installable, and packageable fork of the NaCl library, with a compatible but extended API to improve usability even further.

Its goal is to provide all of the core operations needed to build higher-level cryptographic tools. Sodium is cross-platform and cross-language. It runs on many compilers and operating systems, including Windows (with MinGW or Visual Studio, x86 and x86_64), iOS, and Android. JavaScript and WebAssembly versions are also available and fully supported. Furthermore, bindings for all common programming languages are available and well-supported.

The design choices emphasize security and ease of use. But despite the emphasis on high security, primitives are faster across-the-board than most implementations.

pgsodium exposes the following libsodium APIs to SQL:

• Generating Random Data
• Secret key cryptography
  • Authenticated encryption
  • Authentication
• Public key cryptography
  • Authenticated encryption
  • Public key signatures
  • Sealed boxes
• Hashing
• Password hashing
• Key Derivation
• Key Exchange
• HMAC512
• Advanced Stream API
• XChaCha20-SIV
• Signcryption

It also enables some Postgres specific features including:

• Server Key Management
• Transparent Column Encryption

Enable the extension#

Resources#

• Official pgsodium documentation