Back to DashboardSoftware InfrastructurePhase 6 · Infrastructure & Performanceintermediate50 min

Database Encryption & PQC

Migrate database encryption to quantum-safe algorithms: TDE re-keying, BYOK/HYOK key ownership, queryable encryption compatibility, and fleet readiness assessment.

Why this matters: Database encryption keys often outlive the application built around them — a TDE re-key done wrong doesn't just risk downtime, it risks re-encrypting data that was never at risk while missing the columns that were.

Start here: Step through the TDE Migration Planner: the AES-256 master key is re-wrapped under ML-KEM, and you see what the database has to re-encrypt — the key hierarchy, not the data.

For your role

Developer / Engineer
Map the encryption layers of a database in Step 1, step through the TDE migration from AES-256 to an ML-KEM-wrapped key hierarchy, and check queryable encryption schemes against PQC compatibility in Step 4.
Security Architect
The BYOK Architecture Designer in Step 3 places key ownership with an external PQC KMS; the readiness assessment in Step 5 covers the fleet.
Researcher / Academic
Step 4's Queryable Encryption Lab lays out the schemes and their PQC compatibility matrix, the part of database encryption where the research is least settled.
IT Ops / DevOps
The TDE re-key walkthrough and Step 5's guided fleet readiness checklist are the operational path; a re-key done wrong re-encrypts the wrong data, and the walkthrough shows the order.
Curious Explorer
Databases keep their encryption keys for years; this module shows, layer by layer, what has to change so that stored data stays private after quantum computers arrive.
Practice in the Simulation

Database encryption is not a single switch — it is a layered architecture. Each layer addresses a different threat model. From outermost to innermost:

1. Transparent Data Encryption (TDE) — Innermost

encrypts database files on disk (data pages, log files, backups) using AES-256. It protects against physical theft of storage media or backup exfiltration — but provides no protection against a privileged DBA who has direct database access. The database engine decrypts data transparently on read.

Threat covered: stolen backup tapes, cloud storage breach, decommissioned disks
Threat NOT covered: DBA with SELECT privilege, memory scraping, SQL injection
2. Column-Level Encryption (CLE) — Middle Layer

CLE encrypts specific columns (PAN, SSN, date-of-birth) using per-column keys. In Always Encrypted (SQL Server), the Column Master Key (CMK) lives in Azure Key Vault or an HSM — the database engine never sees the plaintext CMK, only the Column Encryption Key (CEK) wrapped by it. A DBA querying the column sees only ciphertext.

3. Field-Level Encryption (FLE) — Application-Controlled

FLE is performed by the application before data reaches the database wire. MongoDB FLE 1.0/2.0 encrypts document fields client-side; the server stores only ciphertext. Key material never leaves the application, so the server stores only ciphertext. This architecture limits server-side query capabilities.

4. Queryable Encryption — Structured Encryption

Queryable Encryption (MongoDB FLE 2.0, SQL Server Always Encrypted with secure enclaves) allows specific query types (equality, range) to execute on encrypted data without full decryption. MongoDB uses HMAC-SHA-256 equality tokens and structured encryption over fully randomized ciphertext for range queries. SQL Server uses secure enclaves (VBS or SGX) to execute queries on plaintext inside a trusted execution environment.

PQC Impact on Encryption Layers

AES-256 symmetric encryption used at every layer is already quantum-safe (Grover's algorithm reduces effective security to 128 bits — still above the 112-bit minimum). The quantum vulnerability lies entirely in the key wrapping layer: RSA-OAEP and ECDH used to protect CMKs, CEKs, and DEKs. Migrating those wrapping algorithms to ML-KEM-1024 is the scope of PQC database migration.

Products shown here are a representative selection — not an exhaustive list. For the full vendor landscape with PQC readiness status, visit the Tools & Products tab in this module or browse the Migrate catalog →

Related Resources

KMS & PQC
Manage DEK and CMK lifecycles with PQC key wrapping
HSM & PQC
Hardware-backed TDE master key storage and ML-KEM support
Crypto Agility
Algorithm-agnostic encryption layers for future-proof databases
Secrets Management
Vault-based dynamic secrets and PQC BYOK patterns

Map encryption layers, plan TDE migration, design BYOK architecture, and assess your fleet readiness.

Check off all sections and mark this reading done.

Related modules

Check your understanding

15 questions on Database Encryption & PQC, each with its answer and the reason.

Take the quiz

Next step

Produce the artifact: Infrastructure Modernization Planner

This module belongs to phase 6 (Infrastructure & Performance); Infrastructure Modernization Planner produces a deliverable of that phase in the Command Center.

Learning module content can be inaccurate. Please double-check its information. Report inaccuracies in PQC Today GitHub Discussions.