EQL v2

Encrypt Query Language (EQL) is a set of PostgreSQL types, operators, and functions that enable queries on encrypted data without decryption. EQL works seamlessly with the CipherCell format to provide searchable encryption capabilities directly in PostgreSQL.

What is EQL?

EQL provides the database-side components needed to query encrypted data. Unlike traditional PostgreSQL extensions, EQL is implemented as a collection of types, operators, and functions, making it compatible with managed database providers like AWS RDS that restrict extension installation.

When combined with the Stack SDK or CipherStash Proxy, EQL enables:

• Exact match queries using encrypted equality operators
• Range queries with order-preserving encryption
• Pattern matching using encrypted Bloom filters
• Unique constraints on encrypted columns
• JSON/JSONB operations on encrypted structured data

Core components

The eql_v2_encrypted type

The foundation of EQL is the eql_v2_encrypted data type, which stores CipherCells containing encrypted data and searchable encrypted metadata.

CREATE TABLE users (
    id SERIAL PRIMARY KEY,
    email eql_v2_encrypted,
    name eql_v2_encrypted
);

Operators

EQL provides PostgreSQL operators that work directly with encrypted data:

-- Exact match
SELECT * FROM users WHERE email = 'encrypted_search_value'::eql_v2_encrypted;

-- Range queries
SELECT * FROM products WHERE price > 'encrypted_value'::eql_v2_encrypted;

-- Pattern matching
SELECT * FROM documents WHERE content LIKE '%encrypted_pattern%';

Functions

EQL ships in the eql_v2 schema, with functions in three groups:

• Configuration — register tables, columns, and searchable indexes in the EQL configuration.
• Index-term extraction — eql_v2.hmac_256() (exact match), eql_v2.bloom_filter() (pattern matching), and eql_v2.ore_block_u64_8_256() (range) extract a searchable term from an encrypted value. These back the functional indexes — see Setting up indexes.
• Comparison — operators (=, <, LIKE, @>, …) are the query surface over encrypted columns.

For the complete function reference — every signature, parameter, and return type — see EQL functions.

Index types

EQL supports multiple searchable encryption index types. Each index type enables different query patterns:

unique: Exact match

Enables exact equality queries and unique constraints using HMAC-SHA256.

Learn more about equality queries

ore: Range queries

Enables range comparisons (<, >, BETWEEN) and ordering (ORDER BY) using Order Revealing Encryption.

Learn more about range queries

match: Pattern matching

Enables substring and full-text search (LIKE, ILIKE) using encrypted Bloom filters with trigrams.

Learn more about token matching

ste_vec: Structured data

Enables containment queries and JSON-style operations on encrypted arrays and JSONB data.

How it works

EQL leverages PostgreSQL's native indexing capabilities to enable efficient queries on encrypted data. The searchable encrypted metadata within CipherCells is indexed using standard PostgreSQL index types (B-tree for exact/range, GIN for pattern matching).

When a query is executed:

1. Client-side: The application encrypts the search value using the same encryption scheme, producing a CipherCell with the appropriate searchable encrypted metadata
2. Database-side: EQL operators extract and compare the searchable encrypted metadata from both the stored CipherCells and the search CipherCell
3. Result: Matching rows are returned without ever decrypting the data in the database

Compatibility

EQL is designed to work with:

• PostgreSQL 14+: Full support for all EQL features
• Managed databases: Works with AWS RDS, Azure Database, Google Cloud SQL, and other managed PostgreSQL providers
• CipherStash SDKs: Integrates with all CipherStash SDKs as well as CipherStash Proxy

Related documentation

• CipherCell format: The data structure used by EQL
• Searchable encryption: Available encrypted query capabilities