A TDE fix that makes old ciphertext unreadable
pg_vault_tde 1.7.1 corrects the AAD derivation for out-of-line TOAST values in AES-256-GCM.
Words by Mahdi Rajaee
The change
Previously
TOAST values were encrypted with an AAD derived from the wrong tuple identity.
With this change
The AAD is now derived from the TOAST chunk itself, so authentication matches what was stored.
What it means
Operators must export affected tables before installing 1.7.1, because older TOAST ciphertext will not authenticate.
My take
A correctness fix in authenticated encryption is indistinguishable from data loss unless you migrate first.