> For the complete documentation index, see [llms.txt](https://mariadb.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://mariadb.com/docs/server/security/encryption.md).

# Encryption

MariaDB's security architecture distinguishes between data moving across the network (Data-in-Transit) and data stored on disk (Data-at-Rest).

{% columns %}
{% column %}
{% content-ref url="/pages/TSTltR9Dzy0YuipOVvVK" %}
[TLS and Cryptography Libraries](/docs/server/security/encryption/tls-and-cryptography-libraries-used-by-mariadb.md)
{% endcontent-ref %}
{% endcolumn %}

{% column %}
MariaDB links to cryptography libraries (OpenSSL, wolfSSL, GnuTLS, Schannel) either statically or dynamically. How to verify the active library and version.
{% endcolumn %}
{% endcolumns %}

{% columns %}
{% column %}
{% content-ref url="/pages/DfsqBRazU61QxgbpCyVO" %}
[Data-in-Transit Encryption](/docs/server/security/encryption/data-in-transit-encryption.md)
{% endcontent-ref %}
{% endcolumn %}

{% column %}
**Data-in-Transit Encryption**

* Protects credentials and query results from "man-in-the-middle" attacks during client-server communication.
* Uses the TLS protocol. It handles the handshake, identity verification, and encryption of the network stream.
* Utilizes Asymmetric Key Pairs (Public/Private keys) and Certificates (PEM/CRT files) managed by libraries like OpenSSL.
* Defined in the `[mariadb]` section using `ssl_cert`, `ssl_key`, and `ssl_ca`.
  {% endcolumn %}
  {% endcolumns %}

{% columns %}
{% column %}
{% content-ref url="/pages/VUPEqb8RGR7dX9Nxd0pN" %}
[Data-at-Rest Encryption](/docs/server/security/encryption/data-at-rest-encryption.md)
{% endcontent-ref %}
{% endcolumn %}

{% column %}
**Data-at-Rest Encryption**

* Protects physical data files (InnoDB/Aria tables, Redo logs, and Binary logs) if the storage media or backups are stolen.
* Uses Symmetric Encryption (typically AES) managed by specialized Key Management Plugins.
* Uses Symmetric Keys identified by a `Key ID`. These are fetched from a local file, AWS KMS, or HashiCorp Vault.
* Enabled via variables like `innodb_encrypt_tables` and requires a specific plugin (e.g., `file_key_management`) to be loaded.
  {% endcolumn %}
  {% endcolumns %}