pgcrypto

What it is

pgcrypto is PostgreSQL's supplied cryptography extension. It exposes digest, keyed hash, password-hashing, PGP encryption, random-byte, and UUID functions inside the database.

What it provides

• SHA-family digests and HMACs
• Adaptive password hashes through crypt and gen_salt
• PGP encryption and decryption functions
• Cryptographically strong random bytes and UUIDs

Use it for searchable fingerprints, tamper checks, database-managed password verification, encrypted database fields, or random token material. For sensitive plaintext, use TLS and decide explicitly whether the application or database is the correct trust boundary.

Use it with Rent

extension pgcrypto {
  name = "pgcrypto"
}

The RSL declaration makes installation and migration intent part of the reviewed application schema. Register the typed pack at runtime to call its APIs:

let crypto = extensions.register_pack::<PgCrypto>()?;
let fingerprint = crypto.digest(
    crypto.value("payload"),
    DigestAlgorithm::Sha256,
);

let client = crypto.client(&pool);
let password_hash = client
    .hash_password(
        "secret",
        PasswordAlgorithm::Blowfish,
    )
    .await?;

let valid = client
    .verify_password("secret", &password_hash)
    .await?;

let id = client.random_uuid().await?;

Run the application

cargo run -p rent --example extension_10_pgcrypto

Set DATABASE_URL to a disposable PostgreSQL server whose role can create databases and install pgcrypto. The application installs the extension in a custom schema, compares token digests, hashes a password with Blowfish, verifies both the correct and incorrect password, and checks generated UUIDs. The isolated database is removed afterward.

A digest is useful for a high-entropy token fingerprint; a fast SHA digest is not a password-storage scheme. Password hashing and verification send plaintext to the database, so use TLS and avoid recording those bound values in query logs. Its standalone extension declaration is crates/rent/examples/extension_10_pgcrypto/schema.rsl.