# Index key encryption by default? **URL:** \ **Category:** PG\_TDE – Transparent Data Encryption (TDE)\ **Created:** [July 10, 2025, 8:03pm UTC](https://forums.percona.com/t/index-key-encryption-by-default/38636 "2025-07-10T20:03:12Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![jonesofarc](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/jonesofarc/32/21462_2.png) [@jonesofarc](https://forums.percona.com/u/jonesofarc)\ **Post date:** [July 10, 2025, 8:03pm UTC](https://forums.percona.com/t/index-key-encryption-by-default/38636/1 "2025-07-10T20:03:12Z")
Hi there, I have successfully enabled encryption on postgres. I have in postgres.conf: _pg\_tde.enforce\_encryption = on_ _default\_table\_access\_method = ‘tde\_heap’_ Everything works well. Everything is encrypted by default. However I have to use an application which creates indexes using “USE BTREE”. This causes postgres to throw an error _“error: pg\_tde.enforce\_encryption is ON, only the tde\_heap access method is allowed.”_, which I guess makes sense. I have no control over how the application works and so the only option to get it working is to comment out pg\_tde.enforce\_encryption = on. As the tables are created without any special handlers, the set _default\_table\_access\_method_ which uses tde\_heap works fine. However, does this mean that the indexes are not encrypted and can potentially leak data? Anyway around this, or does pg\_tde somehow know to index them anyway? I am not quite sure of the interaction between table data, pg\_tde and indexes, could it be it doesn’t matter if indexes are not encrypted as the data they index is? I would be very grateful for some clarity on this, Thanks in advance! ---
**Author:** ![Dragos\_Andriciuc](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/dragos_andriciuc/32/20787_2.png) [@Dragos\_Andriciuc](https://forums.percona.com/u/Dragos_Andriciuc)\ **Post date:** [July 14, 2025, 12:01pm UTC](https://forums.percona.com/t/index-key-encryption-by-default/38636/2 "2025-07-14T12:01:57Z")
Hello @jonesofarc! I forwarded your question to our dev team and they’ll investigate this. Thank you! ---
**Author:** ![zsolt.parragi](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/zsolt.parragi/32/16648_2.png) [@zsolt.parragi](https://forums.percona.com/u/zsolt.parragi)\ **Post date:** [July 14, 2025, 1:11pm UTC](https://forums.percona.com/t/index-key-encryption-by-default/38636/3 "2025-07-14T13:11:53Z")
Hello @jonesofarc, thank you for the report! Could you please share more information about it, for example exact reproduction steps? We weren’t able to reproduce it, `CREATE INDEX` with `USING btree` seems to work, so there’s maybe something more specific to this. ---
**Author:** ![jonesofarc](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/jonesofarc/32/21462_2.png) [@jonesofarc](https://forums.percona.com/u/jonesofarc)\ **Post date:** [July 14, 2025, 1:56pm UTC](https://forums.percona.com/t/index-key-encryption-by-default/38636/4 "2025-07-14T13:56:57Z")
Hi there, It was using tde with infiscial , which uses the node pgboss module. Its schemas create queues . Drilling down it was the creation of the the indexes. There was an ALTER owner command and a using BTREE command. I removed them both. I considered the using BTREE as the likely issue as that was directly USING another handler, ALTER didn’t seem a likely candidate, but could it be that? I remember if I got the SQL and removed the ALTER and the BTREE lines , the indexes were created, if I did not, pg\_tde threw the error. A bit vague I know, does this help? ---
**Author:** ![zsolt.parragi](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/zsolt.parragi/32/16648_2.png) [@zsolt.parragi](https://forums.percona.com/u/zsolt.parragi)\ **Post date:** [July 15, 2025, 12:19pm UTC](https://forums.percona.com/t/index-key-encryption-by-default/38636/5 "2025-07-15T12:19:51Z")
Hello! Unfortunately this doesn’t help much. We have extensive test coverage for this feature, if there is an issue with it, it will be something very specific - without details this is impossible to reproduce. I tried to run additional tests with alter/create index commands, but so far I wasn’t able to reproduce it. ---
**Author:** ![jonesofarc](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/jonesofarc/32/21462_2.png) [@jonesofarc](https://forums.percona.com/u/jonesofarc)\ **Post date:** [July 17, 2025, 7:34pm UTC](https://forums.percona.com/t/index-key-encryption-by-default/38636/6 "2025-07-17T19:34:04Z")
Hi there, Sorry for the delay in replying, I have since stopped using infisicsal. However I am trying to import my gitlab database , and the issue appears again. It seems to be when alter table is run on something that is not a basic table. for instance: CREATE SEQUENCE public.merge\_requests\_approval\_rules\_approver\_groups\_id\_seq START WITH 1 INCREMENT BY 1 NO MINVALUE NO MAXVALUE CACHE 1; ALTER TABLE public.merge\_requests\_approval\_rules\_approver\_groups\_id\_seq OWNER TO gitlab; This SQL always triggers the issue. This is with enforced encryption on. ---
**Author:** ![zsolt.parragi](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/zsolt.parragi/32/16648_2.png) [@zsolt.parragi](https://forums.percona.com/u/zsolt.parragi)\ **Post date:** [July 18, 2025, 4:42am UTC](https://forums.percona.com/t/index-key-encryption-by-default/38636/7 "2025-07-18T04:42:51Z")
Hello! Thank you, this is indeed a bug, I created the jira ticket [Jira](https://perconadev.atlassian.net/browse/PG-1741) about it. ---
**Author:** ![jonesofarc](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/jonesofarc/32/21462_2.png) [@jonesofarc](https://forums.percona.com/u/jonesofarc)\ **Post date:** [July 18, 2025, 8:11am UTC](https://forums.percona.com/t/index-key-encryption-by-default/38636/8 "2025-07-18T08:11:35Z")
Hi there, Nice! Looking forward to the resolution.