{"id":98088,"date":"2020-10-24T02:42:34","date_gmt":"2020-10-24T00:42:34","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/shifrovanie-v-mysql-rotacziya-master-key"},"modified":"2020-11-18T00:58:48","modified_gmt":"2020-11-17T22:58:48","slug":"shifrovanie-v-mysql-rotacziya-master-key","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/shifrovanie-v-mysql-rotacziya-master-key","title":{"rendered":"Encryption in MySQL: rotating the Master Key","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<\/p>\n

As we approach the start of a new course enrollment <\/em><\/strong>\"Databases\"<\/em><\/strong><\/a><\/noindex> we continue to publish a series of articles on encryption in MySQL.<\/em><\/strong><\/p>\n

In the previous article of this series, we discussed, how encryption with the Master Key works.<\/u><\/a><\/noindex>Today, based on the knowledge gained earlier, we will look at the rotation of master keys.<\/p>\n

Master key rotation involves generating a new master key, which is then used to re-encrypt the keys of the tablespaces (stored in the headers of the tablespaces).<\/p>\n

Let's recall what the header of an encrypted tablespace looks like:<\/p>\n

\"Encryption<\/p>\n

From the previous article, we know that the server reads the headers of all encrypted tablespaces at startup and remembers the highest KEY ID. For instance, if we have three tables with KEYID = 3 and one table with KEY<\/em>ID = 4, so the maximum key identifier will be 4. Let's call this KEY ID \u2014 MAX KEY ID.<\/p>\n

How master key rotation works<\/h3>\n

1. The user executes ALTER INNODB MASTER KEY.<\/p>\n

2. The server requests the key storage (keyring) to generate a new master key with the server's UUID and KEYID, which is equal to MAX<\/em>KEYID increased by one. Thus, we get the master key identifier equal to INNODB<\/em>KEY-UUID- (MAXKEY<\/em>ID + 1). Upon successful generation of the master key, MAX KEY ID is increased by one (i.e., MAXKEY<\/em>ID = MAXKEY<\/em>ID + 1).<\/p>\n

3. The server scans all tablespaces encrypted with the master key, and for each tablespace:<\/p>\n