Manually rotation of the innodb system table encryption key on MariaDB 10.5 - Source

Revision: 112682
User: Sergio Alex
Date: 2022-01-17 08:46

Hello everyone,

I implemented data in rest encryption on MariaDB 10.5 (linux running on Ubuntu 18.04) using the plugin file_key_management.so.
Here is my current configuration:

plugin_dir=/usr/lib/mysql/plugin
    plugin_load_add = file_key_management.so
    loose_file_key_management_filename = /etc/mysql/keyfile.enc
    loose_file_key_management_filekey = FILE:/etc/mysql/keyfile.key
    loose_file_key_management_encryption_algorithm = AES_CTR
    encrypt_binlog = ON
    encrypt_tmp_disk_tables = ON
    encrypt_tmp_files = ON

innodb_encrypt_tables = FORCE
    innodb_encrypt_log = ON
    innodb_encryption_threads = 4
    innodb_encrypt_temporary_tables = ON
    innodb_encryption_rotate_key_age = 1
    innodb_encryption_rotation_iops = 3000

I was able to rotate manually the encryption key for all tables except for innodb_system

MariaDB [(none)]> SELECT NAME,CURRENT_KEY_ID  FROM information_schema.INNODB_TABLESPACES_ENCRYPTION where ENCRYPTION_SCHEME='1' and NAME like "%innodb%" \G
     *************************** 1. row ***************************
        NAME: innodb_system
        CURRENT_KEY_ID: 1
     *************************** 2. row ***************************
        NAME: mysql/innodb_table_stats
        CURRENT_KEY_ID: 3
     *************************** 3. row ***************************
        NAME: mysql/innodb_index_stats
        CURRENT_KEY_ID: 3

Using the same query I was not able to rotate the key (Other entrances in the information_schema.INNODB_TABLESPACES_ENCRYPTION table comes along with the database Eg: mysql/innodb_table_stats but not the innodb_system)

MariaDB [(none)]> alter table innodb_system encryption_key_id=3;
    ERROR 1046 (3D000): No database selected

I found some documentation on how to rotate on Mysql and if I understood correctly this is like a master key for innodb system tables.

mysql> ALTER INSTANCE ROTATE INNODB MASTER KEY;

Which it does not work.

Can anyone please show me how can I manually rotate the innodb_system encryption key?

Thank you in advance.

Answer

Content reproduced on this site is the property of its respective owners, and this content is not reviewed in advance by MariaDB. The views, information and opinions expressed by this content do not necessarily represent those of MariaDB or any other party.

Manually rotation of the innodb system table encryption key on MariaDB 10.5 - Source

Answer

Products

Services

Pricing

Resources

About Us

Download MariaDB