Postgres decrypting differences between v9 and v12 (pgcrypto 1.1 vs 1.3)

137 views Asked by At

I'm forced to migrate an existing DB to AWS RDS. RDS's earliest version of Postgres is v12, while previously the database was running on v9.6 (with pgcrypto v1.1 extension).

I moved the data using pg_dump and pg_restore. Some of the data was encrypted, and some SQL functions were using rijndael_decrypt to decrypt that data, however this function is not available in pgcrypto v1.3 (which is the only version of the extension you can get in RDS psql12). Can I somehow decrypt the data using pgcrypto's decrypt function or anything else? Tried all availble algo/mode/padding combination for decrypt function, tried converting the key to bytea or using it as plain text, but all I'm getting is ERROR: decrypt error: Data not a multiple of block size.

EDIT: Adding function definition from the DB:

postgres=# select pg_get_functiondef(oid) from pg_proc where proname = 'rijndael_decrypt';
                                pg_get_functiondef
----------------------------------------------------------------------------------
 CREATE OR REPLACE FUNCTION public.rijndael_decrypt(key text, input_text bytea)  +
  RETURNS text                                                                   +
  LANGUAGE c                                                                     +
  STRICT                                                                         +
 AS '/c_extensions/pg_rijndael/pg_rijndael', $function$rijndael_decrypt$function$+
1

There are 1 answers

1
Maimoona Abid On

Change the encryption and decryption methods to utilize PostgreSQL 12's pgp_sym_decrypt, which is available in pgcrypto 1.3. Make sure your application code has been adjusted appropriately and test the revised function.

Try this;

CREATE OR REPLACE FUNCTION public.decrypt_data(key text, encrypted_data bytea)
RETURNS text
LANGUAGE sql
AS $$
  SELECT pgp_sym_decrypt(encrypted_data, key, 'cipher-algo=aes256');
$$;

Hope it's helpful :)