</listitem>
   </varlistentry>
  </variablelist>

  <para>
   In ordinary usage, this parameter is set
   in <filename>postgresql.conf</filename>, although superusers can alter it
   on-the-fly within their own sessions.
  </para>
 </sect2>

 <sect2 id="pgcrypto-notes">
  <title>Notes</title>

  <sect3 id="pgcrypto-notes-config">
   <title>Configuration</title>

   <para>
    <filename>pgcrypto</filename> configures itself according to the findings of the
    main PostgreSQL <literal>configure</literal> script.  The options that
    affect it are <literal>--with-zlib</literal> and
    <literal>--with-ssl=openssl</literal>.
   </para>

   <para>
    When compiled with zlib, PGP encryption functions are able to
    compress data before encrypting.
   </para>

   <para>
    <filename>pgcrypto</filename> requires <productname>OpenSSL</productname>.
    Otherwise, it will not be built or installed.
   </para>

   <para>
    When compiled against <productname>OpenSSL</productname> 3.0.0 and later
    versions, the legacy provider must be activated in the
    <filename>openssl.cnf</filename> configuration file in order to use older
    ciphers like DES or Blowfish.
   </para>
  </sect3>

  <sect3 id="pgcrypto-notes-null-handling">
   <title>NULL Handling</title>

   <para>
    As is standard in SQL, all functions return NULL, if any of the arguments
    are NULL.  This may create security risks on careless usage.
   </para>
  </sect3>

  <sect3 id="pgcrypto-notes-sec-limits">
   <title>Security Limitations</title>

   <para>
    All <filename>pgcrypto</filename> functions run inside the database server.
    That means that all
    the data and passwords move between <filename>pgcrypto</filename> and client
    applications in clear text.  Thus you must:
   </para>

   <orderedlist>
    <listitem>
     <para>Connect locally or use SSL connections.</para>
    </listitem>
    <listitem>
     <para>Trust both system and database administrator.</para>
    </listitem>
   </orderedlist>

   <para>
    If you cannot, then better do crypto inside client application.
   </para>

   <para>
    The implementation does not resist
    <ulink url="https://en.wikipedia.org/wiki/Side-channel_attack">side-channel
    attacks</ulink>.  For example, the time required for
    a <filename>pgcrypto</filename> decryption function to complete varies among
    ciphertexts of a given size.
   </para>
  </sect3>
 </sect2>

 <sect2 id="pgcrypto-author">
  <title>Author</title>

  <para>
   Marko Kreen <email>markokr@gmail.com</email>
  </para>

  <para>
   <filename>pgcrypto</filename> uses code from the following sources:
  </para>

  <informaltable>
   <tgroup cols="3">
    <thead>
     <row>
      <entry>Algorithm</entry>
      <entry>Author</entry>
      <entry>Source origin</entry>
     </row>
    </thead>
    <tbody>
     <row>
      <entry>DES crypt</entry>
      <entry>David Burren and others</entry>
      <entry>FreeBSD libcrypt</entry>
     </row>
     <row>
      <entry>MD5 crypt</entry>
      <entry>Poul-Henning Kamp</entry>
      <entry>FreeBSD libcrypt</entry>
     </row>
     <row>
      <entry>Blowfish crypt</entry>
      <entry>Solar Designer</entry>
      <entry>www.openwall.com</entry>
     </row>
    </tbody>
   </tgroup>
  </informaltable>
 </sect2>

</sect1>