How does data-at-rest encryption work in MariaDB?

How does data-at-rest encryption work in MariaDB?

MariaDB’s data-at-rest encryption requires the use of a key management and encryption plugin. These plugins are responsible both for the management of encryption keys and for the actual encryption and decryption of data. MariaDB supports the use of multiple encryption keys. Each encryption key uses a 32-bit integer as a key identifier.

Which is the best encryption plugin for MariaDB?

The File Key Management plugin is the easiest key management and encryption plugin to set up for users who want to use data-at-rest encryption. Some of the plugin’s primary features are: It reads encryption keys from a plain-text key file. As an extra protection mechanism, the plain-text key file can be encrypted.

How to encrypt a table using a plugin?

In order to encrypt your tables with encryption keys using the File Key Management plugin, you first need to create the file that contains the encryption keys. The file needs to contain two pieces of information for each encryption key. First, each encryption key needs to be identified with a 32-bit integer as the key identifier.

What kind of encryption does file key management plugin use?

The File Key Management plugin uses Advanced Encryption Standard (AES) to encrypt data, which supports 128-bit, 192-bit, and 256-bit encryption keys. Therefore, the plugin also supports 128-bit, 192-bit, and 256-bit encryption keys.

Can a MariaDB error log be sent to syslog?

The error log can contain query text and data in some cases, including crashes, assertion failures, and cases where InnoDB/XtraDB write monitor output to the log to aid in debugging. It can be sent to syslog too, if needed. MariaDB’s data-at-rest encryption requires the use of a key management and encryption plugin.

How is data and only at rest encrypted?

Only data and only at rest is encrypted. Metadata (for example .frm files) and data sent to the client are not encrypted (but see Secure Connections ). mysqlbinlog can read encrypted binary logs only when –read-from-remote-server is used ( MDEV-8813 ).