#  How to Rotate Internal Encryption Keys in pg\_tde?

**URL:** https://forums.percona.com/t/how-to-rotate-internal-encryption-keys-in-pg-tde/39261
**Category:** PG\_TDE – Transparent Data Encryption (TDE)
**Tags:** percona
**Created:** [September 3, 2025, 5:17am UTC](https://forums.percona.com/t/how-to-rotate-internal-encryption-keys-in-pg-tde/39261 "2025-09-03T05:17:37Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![liebao](https://avatars.discourse-cdn.com/v4/letter/l/87869e/32.png) [@liebao](https://forums.percona.com/u/liebao)
#### Post date: [September 3, 2025, 5:17am UTC](https://forums.percona.com/t/how-to-rotate-internal-encryption-keys-in-pg-tde/39261/1 "2025-09-03T05:17:37Z")

</div>

Hi all,

If the master key (or “principal key”) is compromised, an attacker could potentially derive the unencrypted internal keys from it.

Currently, rotating the master key does not change the internal keys—it only re-encrypts them with the new master key.

After reviewing the documentation, I couldn’t find a built-in function to rotate the actual internal keys. Is there a way to do this? Would creating a new table be the only solution?

Thanks for your insights!

---

<div class="post-metadata">

### Author: ![zsolt.parragi](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/zsolt.parragi/32/16648_2.png) [@zsolt.parragi](https://forums.percona.com/u/zsolt.parragi)
#### Post date: [September 3, 2025, 6:52am UTC](https://forums.percona.com/t/how-to-rotate-internal-encryption-keys-in-pg-tde/39261/2 "2025-09-03T06:52:56Z")

</div>

Hello!

Thanks for trying out pg\_tde!

Yes, we currently do not have any specific functions to rotate the internal keys, because any operation that completely rewrites a table datafile (`VACUUM FULL`, some but not all `ALTER TABLE` operations, `TRUNCATE`, …) generates a new internal key, effectively rotating it.

So if you are worried about internal keys leaking, you can fix that by vacuuming the database.