{"id":98088,"date":"2020-10-24T02:42:34","date_gmt":"2020-10-24T00:42:34","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/shifrovanie-v-mysql-rotacziya-master-key"},"modified":"2020-11-18T00:58:48","modified_gmt":"2020-11-17T22:58:48","slug":"shifrovanie-v-mysql-rotacziya-master-key","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/administrirovanie\/shifrovanie-v-mysql-rotacziya-master-key","title":{"rendered":"Enkripcija u MySQL: rotacija glavnog klju\u010da","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<\/p>\n<p><strong><em>Uo\u010di po\u010detka novog upisa na te\u010daj&nbsp;<\/em><\/strong><noindex><a rel=\"nofollow\" href=\"https:\/\/otus.pw\/dADq\/\"><strong><em>\u00abBaze podataka\u00bb<\/em><\/strong><\/a><\/noindex><strong><em>&nbsp;nastavljamo s objavljivanjem serije \u010dlanaka o \u0161ifriranju u MySQL-u.<\/em><\/strong><\/p>\n<p>U prethodnom \u010dlanku ove serije razgovarali smo o <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/otus\/blog\/524050\/\"><u>kako radi \u0161ifriranje s glavnim klju\u010dem (Master Key)<\/u><\/a><\/noindex>. Danas, oslanjaju\u0107i se na prethodno ste\u010deno znanje, razmotrit \u0107emo rotaciju glavnih klju\u010deva.<\/p>\n<p>Rotacija glavnih klju\u010deva se sastoji od generiranja novog glavnog klju\u010da i ponovnog \u0161ifriranja klju\u010deva tabli\u010dnih prostora tim novim klju\u010dem (koji se pohranjuju u zaglavljima tabli\u010dnih prostora).<\/p>\n<p>Ponovo se prisjetimo kako izgleda zaglavlje \u0161ifriranog tabli\u010dnog prostora:<\/p>\n<p><img decoding=\"async\" alt=\"Enkripcija u MySQL: rotacija glavnog klju\u010da\" src=\"\/wp-content\/uploads\/2020\/10\/24057c50b96236c5ee2647aeca4b575f.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>Iz prethodnog \u010dlanka znamo da poslu\u017eitelj prilikom pokretanja \u010dita zaglavlja svih \u0161ifriranih tabli\u010dnih prostora i pamti najve\u0107i KEY ID. Na primjer, ako imamo tri tablice s KEY<em>ID = 3 i jednu tablicu s KEY<\/em>ID = 4, pa \u0107e maksimalni identifikator klju\u010da biti 4. Nazovimo ovaj KLJU\u010c ID \u2014 MAX KLJU\u010c ID.<\/p>\n<h3>Kako funkcionira rotacija glavnog klju\u010da<\/h3>\n<p>1. Korisnik izvr\u0161ava ALTER INNODB MASTER KEY.<\/p>\n<p>2. Poslu\u017eitelj tra\u017ei od skladi\u0161ta klju\u010deva (keyring) generiranje novog glavnog klju\u010da s UUID poslu\u017eitelja i KEY<em>ID, koji je pove\u0107an za jedan MAX<\/em>KEY<em>ID. Tako dobivamo identifikator glavnog klju\u010da jednak INNODB<\/em>KEY-UUID- (MAX<em>KEY<\/em>ID + 1). Nakon uspje\u0161nog generiranja glavnog klju\u010da, MAX KEY ID se pove\u0107ava za jedan (tj. MAX<em>KEY<\/em>ID = MAX<em>KEY<\/em>ID + 1).<\/p>\n<p>3. Poslu\u017eitelj pregledava sve tabli\u010dne prostore \u0161ifrirane pomo\u0107u glavnog klju\u010da i za svaki tabli\u010dni prostor:<\/p>\n<ul>\n<li>\n<p>\u0161ifrira klju\u010d tabli\u010dnog prostora novim glavnim klju\u010dem;<\/p>\n<\/li>\n<li>\n<p>a\u017eurira identifikator klju\u010da na novi MAX<em>KEY<\/em>ID;<\/p>\n<\/li>\n<li>\n<p>ako se UUID razlikuje od UUID poslu\u017eitelja, a\u017eurira UUID poslu\u017eitelja.<\/p>\n<\/li>\n<\/ul>\n<p>Kao \u0161to znamo, identifikator glavnog klju\u010da (Master Key ID), koji se koristi za de\u0161ifriranje tablice, sastoji se od UUID-a i KEY ID-a, pro\u010ditanih iz zaglavlja tabli\u010dnog prostora. Ono \u0161to radimo sada je a\u017euriranje tih informacija u zaglavlju \u0161ifriranja tabli\u010dnog prostora kako bi poslu\u017eitelj dobio pravi glavni klju\u010d.<\/p>\n<p>Ako imamo tabli\u010dne prostore dobivene iz razli\u010ditih izvora, poput razli\u010ditih sigurnosnih kopija, moglo bi se dogoditi da koriste razli\u010dite glavne klju\u010deve. Svi ti glavni klju\u010devi morat \u0107e se preuzeti iz spremi\u0161ta prilikom pokretanja poslu\u017eitelja. To mo\u017ee usporiti pokretanje poslu\u017eitelja, osobito ako se koristi poslu\u017eiteljsko spremi\u0161te klju\u010deva. Rotacijom glavnog klju\u010da ponovno \u0161ifriramo klju\u010deve tabli\u010dnih prostora jednim glavnim klju\u010dem, koji je isti za sve tabli\u010dne prostore. Sada, prilikom pokretanja, poslu\u017eitelj mora dobiti samo jedan glavni klju\u010d.<\/p>\n<p>To je, naravno, samo ugodna sporedna posljedica. Glavni cilj rotacije glavnih klju\u010deva je u\u010diniti na\u0161 poslu\u017eitelj sigurnijim. U slu\u010daju da je glavni klju\u010d na neki na\u010din ukraden iz spremi\u0161ta (npr. iz Vault Servera), mo\u017ee se generirati novi glavni klju\u010d i ponovno \u0161ifrirati klju\u010deve tabli\u010dnih prostora, \u010dine\u0107i ukradeni klju\u010d neva\u017ee\u0107im. Mi smo sigurni\u2026 gotovo.<\/p>\n<p>U prethodnom \u010dlanku sam govorio o tome da nakon kra\u0111e klju\u010da tabelarnog prostora tre\u0107a strana mo\u017ee koristiti taj klju\u010d za de\u0161ifriranje podataka, pod uvjetom da ima pristup na\u0161em disku. U slu\u010daju kra\u0111e glavnog klju\u010da i ako postoji pristup enkriptiranim podacima, ukradeni glavni klju\u010d mo\u017ee se koristiti za de\u0161ifriranje klju\u010da tabelarnog prostora i dobivanje de\u0161ifriranih podataka. Kao \u0161to vidimo, rotacija glavnog klju\u010da u ovom slu\u010daju ne poma\u017ee. Ponovno \u0161ifriramo klju\u010d tabelarnog prostora novim glavnim klju\u010dem, ali stvarni klju\u010d koji se koristi za \u0161ifriranje \/ de\u0161ifriranje podataka ostaje nepromijenjen. Stoga 'haker' mo\u017ee i dalje koristiti taj klju\u010d za de\u0161ifriranje podataka. Ranije sam nagovijestio da <noindex><a rel=\"nofollow\" href=\"https:\/\/www.percona.com\/software\/mysql-database\/percona-server\"><u>Percona Server for MySQL<\/u><\/a><\/noindex> mo\u017ee izvr\u0161iti stvarnu ponovnu \u0161ifriranje tabli\u010dnih prostora, a ne samo jednostavno ponovno \u0161ifriranje klju\u010da tabli\u010dnog prostora. Ova funkcija se zove tokovi \u0161ifriranja (encryption threads). Me\u0111utim, trenutno je ta funkcionalnost jo\u0161 uvijek eksperimentalna.<\/p>\n<p>Rotacija glavnog klju\u010da korisna je kada je glavni klju\u010d ukraden, ali napada\u010d nema mogu\u0107nost njegovog kori\u0161tenja i de\u0161ifriranja klju\u010deva tabli\u010dnih prostora.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/otus.pw\/dADq\/\"><strong>Prijavite se na besplatni demo sat.<\/strong><\/a><\/noindex><\/p>\n<h4>\u010citajte vi\u0161e:<\/h4>\n<ul>\n<li>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/otus\/blog\/522092\/\">Enkripcija u MySQL: skladi\u0161te klju\u010deva<\/a><\/noindex><\/p>\n<\/li>\n<li>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/otus\/blog\/524050\/\">\u0160ifriranje u MySQL-u: kori\u0161tenje glavnog klju\u010da<\/a><\/noindex><\/p>\n<\/li>\n<\/ul>\n<p>Izvor: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/otus\/blog\/524624\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u043f\u0440\u0435\u0434\u0434\u0432\u0435\u0440\u0438\u0438 \u0441\u0442\u0430\u0440\u0442\u0430 \u043d\u043e\u0432\u043e\u0433\u043e \u043d\u0430\u0431\u043e\u0440\u0430 \u043d\u0430 \u043a\u0443\u0440\u0441&nbsp;\u00ab\u0411\u0430\u0437\u044b \u0434\u0430\u043d\u043d\u044b\u0445\u00bb&nbsp;\u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u043c \u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u0442\u044c \u0441\u0435\u0440\u0438\u044e \u0441\u0442\u0430\u0442\u0435\u0439 \u043f\u0440\u043e \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0432 MySQL. \u0412 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0435\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u044d\u0442\u043e\u0439 \u0441\u0435\u0440\u0438\u0438 \u043c\u044b \u043e\u0431\u0441\u0443\u0434\u0438\u043b\u0438, \u043a\u0430\u043a \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441 \u0433\u043b\u0430\u0432\u043d\u044b\u043c \u043a\u043b\u044e\u0447\u043e\u043c (Master Key). \u0421\u0435\u0433\u043e\u0434\u043d\u044f, \u043e\u0441\u043d\u043e\u0432\u044b\u0432\u0430\u044f\u0441\u044c \u043d\u0430 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u043d\u044b\u0445 \u0440\u0430\u043d\u0435\u0435 \u0437\u043d\u0430\u043d\u0438\u044f\u0445, \u043f\u043e\u0441\u043c\u043e\u0442\u0440\u0438\u043c \u043d\u0430 \u0440\u043e\u0442\u0430\u0446\u0438\u044e \u0433\u043b\u0430\u0432\u043d\u044b\u0445 \u043a\u043b\u044e\u0447\u0435\u0439. \u0420\u043e\u0442\u0430\u0446\u0438\u044f \u0433\u043b\u0430\u0432\u043d\u044b\u0445 \u043a\u043b\u044e\u0447\u0435\u0439 \u0437\u0430\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u0433\u0435\u043d\u0435\u0440\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u043d\u043e\u0432\u044b\u0439 \u0433\u043b\u0430\u0432\u043d\u044b\u0439 \u043a\u043b\u044e\u0447 \u0438 \u044d\u0442\u0438\u043c \u043d\u043e\u0432\u044b\u043c [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":98089,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-98088","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 \u043f\u0440\u0435\u0434\u0434\u0432\u0435\u0440\u0438\u0438 \u0441\u0442\u0430\u0440\u0442\u0430 \u043d\u043e\u0432\u043e\u0433\u043e \u043d\u0430\u0431\u043e\u0440\u0430 \u043d\u0430 \u043a\u0443\u0440\u0441 \u00ab\u0411\u0430\u0437\u044b \u0434\u0430\u043d\u043d\u044b\u0445\u00bb \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u043c.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/hr\/blog\/administrirovanie\/shifrovanie-v-mysql-rotacziya-master-key\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"hr_HR\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0428\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0432 MySQL: \u0440\u043e\u0442\u0430\u0446\u0438\u044f Master Key | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 \u043f\u0440\u0435\u0434\u0434\u0432\u0435\u0440\u0438\u0438 \u0441\u0442\u0430\u0440\u0442\u0430 \u043d\u043e\u0432\u043e\u0433\u043e \u043d\u0430\u0431\u043e\u0440\u0430 \u043d\u0430 \u043a\u0443\u0440\u0441 \u00ab\u0411\u0430\u0437\u044b \u0434\u0430\u043d\u043d\u044b\u0445\u00bb \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u043c.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/hr\/blog\/administrirovanie\/shifrovanie-v-mysql-rotacziya-master-key\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-10-24T00:42:34+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-11-17T22:58:48+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47\u0160ifriranje u MySQL-u: rotacija Master Key | ProHoster","description":"Uo\u010di po\u010detka novog ciklusa te\u010daja 'Baze podataka' nastavljamo.","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/administrirovanie\/shifrovanie-v-mysql-rotacziya-master-key","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0428\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0432 MySQL: \u0440\u043e\u0442\u0430\u0446\u0438\u044f Master Key | ProHoster","og:description":"\u0412 \u043f\u0440\u0435\u0434\u0434\u0432\u0435\u0440\u0438\u0438 \u0441\u0442\u0430\u0440\u0442\u0430 \u043d\u043e\u0432\u043e\u0433\u043e \u043d\u0430\u0431\u043e\u0440\u0430 \u043d\u0430 \u043a\u0443\u0440\u0441 \u00ab\u0411\u0430\u0437\u044b \u0434\u0430\u043d\u043d\u044b\u0445\u00bb \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u043c.","og:url":"https:\/\/prohoster.info\/hr\/blog\/administrirovanie\/shifrovanie-v-mysql-rotacziya-master-key","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-10-24T00:42:34+00:00","article:modified_time":"2020-11-17T22:58:48+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"98088","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 10:05:50","updated":"2022-10-03 07:13:53","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/98088","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=98088"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/98088\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media\/98089"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=98088"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=98088"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=98088"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}