Encryption at rest, in transit, and at the column level. KMS key management, post-quantum cryptography, and PCI-DSS tokenisation — all built in, zero external libraries.
All network connections use native TLS 1.3 implemented in pure C11:
| Component | Algorithm |
|---|---|
| Key exchange | X25519 ECDHE (+ ML-KEM-768 hybrid for PQC) |
| Key derivation | HKDF-SHA-256 |
| Symmetric encryption | AES-256-GCM, ChaCha20-Poly1305 |
| Session tickets | 0-RTT with replay protection |
| Handshake time | < 2 ms |
# Enable TLS
absdb-server --tls-cert /etc/absdb/server.crt --tls-key /etc/absdb/server.key
# Verify TLS from client
psql "host=localhost port=5433 sslmode=require"Absolute DB encrypts individual columns with AES-256-GCM:
-- Encrypt a column
ALTER TABLE patients ALTER COLUMN ssn SET (encrypted = true);
-- Data is transparently encrypted on write, decrypted on read
-- Only users with the appropriate role can see plaintext
INSERT INTO patients (name, ssn) VALUES ('Alice', '123-45-6789');
SELECT ssn FROM patients; -- returns plaintext if authorised| Feature | Details |
|---|---|
| Key hierarchy | Master Key → DEK per column/tenant |
| KDF | Argon2id (memory-hard, side-channel resistant) |
| Key wrapping | AES-256-GCM envelope encryption |
| Rotation | Online rotation with zero downtime |
| HSM support | PKCS#11 shim for FIPS 140-3 Level 4 hardware |
| Per-tenant keys | Each tenant gets its own DEK (multi-tenancy isolation) |
Quantum-resistant algorithms are built in for long-term data protection:
| FIPS Standard | Algorithm | Purpose |
|---|---|---|
| FIPS 203 | ML-KEM-768 | Key encapsulation (hybrid TLS handshake) |
| FIPS 204 | ML-DSA-65 | Digital signatures (node certs, audit log, WAL) |
| FIPS 205 | SLH-DSA | Hash-based signatures (CA root certs) |
-- Tokenise a credit card number (FF3-1 format-preserving encryption)
SELECT absdb_pci_tokenise('4111111111111111');
-- Returns: 4738291056473829 (same format, different value)
-- De-tokenise (role-restricted)
SELECT absdb_pci_detokenise(token);
-- Returns: 4111111111111111~154 KB binary · zero external dependencies · 2,737 tests passing