Glossary
Data Encryption Key (DEK) : A symmetric ChaCha20-Poly1305 key used to encrypt and decrypt the actual data stored in the database. It is a cold key never disclosed outside the database and not directly available to the users.
Envelope : the Envelope contains the following information: * the database role identifier * the ciphered DEK * the ciphered EEK * the Nonce to decipher the DEK
Unsealing the Envelope : this is the operation of deciphering the EEK using the user's private key. If successful, the DEK can be restored using the plain EEK and the Nonce.
Sealing the Envelope : this is the operation of ciphering the DEK using a new EEK. The EEK is then ciphered using the user's public key and stored in the envelope.
Envelope Encryption Key (EEK) : the EEK is a symmetric ChaCha20-Poly1305 key used to decipher the DEK. The EEK is itself ciphered using the user's public key. Only this user who has the exclusive access to his private key can decipher the EEK.
User's Private Key : A private RSA key pair attached to a given database user. The database has no access to this key. When the user opens a session, the extension will use the FetchKey method to send the EEK to a remote system that can decipher it using the user's private key.
FetchKey Method : A Postgres security label that defines what key to use to decipher the EEK.
Unsecured Fetchkey Method : For testing (or demo) purposes, it is possible to specify a User Key hosted either internally (in the Security Label) or in a local or distant PEM file. Since Postgres'security labels are visible to all the database users, it may lead the according user's private key being disclosed.
If you can't find a term in the list below, take a look at the PostgreSQL Glossary: