Aria Encryption Keys
Key management and encryption plugins support using multiple encryption keys. Each encryption key can be defined with a different 32-bit integer as a key identifier.
Aria uses the encryption key with ID 1 to encrypt user-created tables.
Aria uses the encryption key with ID 2 to encrypt internal temporary tables if it exists. Otherwise, it uses the encryption key with ID 1.
Key Rotation
When your key management and encryption plugin provides the relevant support, you can automatically rotate and version your encryption keys. For example, the AWS key management plugin supports key rotation, but the file key management plugin does not.
The InnoDB storage engine has background encryption threads that can automatically re-encrypt pages when key rotations occur. The Aria storage engine does not currently have a similar mechanism to re-encrypt pages in the background when key rotations occur.