encryption-strategy

Enable transparent data encryption by setting data_encryption on and creating encrypted tablespaces for sensitive tables. Alternatively, encrypt specific fields at the application level using the cryptography library's Fernet or AESGCM before inserting into the database.

Envelope encryption encrypts data with a data encryption key (DEK), then encrypts the DEK with a master key from KMS. Use it for large data volumes since bulk encryption happens locally with the DEK, avoiding KMS API latency while keeping keys secure.

Argon2 is the modern recommended choice because it is memory-hard and resistant to GPU cracking, with configurable time, memory, and parallelism costs. Bcrypt with 12+ rounds remains secure and acceptable for existing systems.

Yes, enable automatic rotation with enable_key_rotation, which rotates the key material annually. Old ciphertexts remain decryptable because KMS retains previous key versions, so no re-encryption of existing data is required.

Configure TLS 1.3 as the minimum with strong ciphers like TLS_AES_256_GCM_SHA384. TLS 1.0 and 1.1 are deprecated, and TLS 1.2 is acceptable but should be upgraded. Enable HSTS to force HTTPS connections.

Avoid MD5 and SHA-1 for hashing since they are broken, DES and 3DES due to small key sizes, RC4 as a weak stream cipher, and AES-ECB mode because it leaks data patterns. Use AES-256-GCM and SHA-256 instead.