Aes-gcm

DuckDB 1.4 adds on-disk encryption (AES-GCM-256/CTR-256) with key derivation, WAL and temporary-file encryption, and near-zero OpenSSL-backed performance impact, but it is not yet aligned with NIST standards.

wolfCOSE is a zero-allocation, embedded COSE/CBOR stack from wolfSSL with a tiny footprint and post-quantum support, backed by GPLv3 and regulatory/compliance pathways.