The query hits the socket like a bullet. Postgres waits. The proxy listens. But the data is never raw. It is encrypted end-to-end with homomorphic encryption, even across the binary protocol.
Homomorphic encryption allows computation directly on ciphertext. Postgres can process queries without ever seeing the plaintext. This means arithmetic, filtering, aggregations—all happen on encrypted values with no decryption inside the database. The binary protocol layer is critical here. It carries parameters, results, and row data in a compact format. A proxy that understands and respects this layer can intercept traffic, apply encryption and decryption operations, and preserve Postgres wire-level semantics without breaking compatibility.
With homomorphic encryption in place, the proxy becomes the computation gateway. It wraps client connections, translating query inputs into encrypted forms before they reach Postgres. It receives encrypted outputs from Postgres, applies homomorphic transformations if needed, and decrypts only for the authorized client. Queries remain valid at the protocol level, ensuring extensions, prepared statements, and binary-format data exchange work as expected.
Building such a proxy requires precise control over the message flow. The Postgres binary protocol uses a series of messages—Parse, Bind, Execute, DataRow, CommandComplete. Each must be inspected, understood, and possibly transformed in-flight. Homomorphic encryption integration demands deterministic encryption for indexes, probabilistic encryption for sensitive fields, and a rigid mapping between encrypted schema and logical schema. The proxy must handle large objects, binary arrays, and custom types without leaking plaintext.