{"id":98088,"date":"2020-10-24T02:42:34","date_gmt":"2020-10-24T00:42:34","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/shifrovanie-v-mysql-rotacziya-master-key"},"modified":"2020-11-18T00:58:48","modified_gmt":"2020-11-17T22:58:48","slug":"shifrovanie-v-mysql-rotacziya-master-key","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/shifrovanie-v-mysql-rotacziya-master-key","title":{"rendered":"Criptarea \u00een MySQL: rota\u021bia cheii principale","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<\/p>\n<p><strong><em>\u00cenainte de \u00eenceperea unui nou grup pentru curs&nbsp;<\/em><\/strong><noindex><a rel=\"nofollow\" href=\"https:\/\/otus.pw\/dADq\/\"><strong><em>\u201eBaze de date\u201d<\/em><\/strong><\/a><\/noindex><strong><em>&nbsp;Continu\u0103m s\u0103 public\u0103m o serie de articole despre criptarea \u00een MySQL.<\/em><\/strong><\/p>\n<p>\u00cen articolul precedent din aceast\u0103 serie, am discutat despre <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/otus\/blog\/524050\/\"><u>cum func\u021bioneaz\u0103 criptarea cu cheia principal\u0103 (Master Key)<\/u><\/a><\/noindex>. Ast\u0103zi, baz\u00e2ndu-ne pe cuno\u0219tin\u021bele dob\u00e2ndite anterior, vom analiza rota\u021bia cheilor principale.<\/p>\n<p>Rota\u021bia cheilor principale const\u0103 \u00een generarea unei noi chei principale, iar cu aceast\u0103 nou\u0103 cheie se recripteaz\u0103 cheile spa\u021biilor de tabele (care sunt stocate \u00een anteturile spa\u021biilor de tabele).<\/p>\n<p>S\u0103 ne amintim cum arat\u0103 antetul unui spa\u021biu de tabele criptat:<\/p>\n<p><img decoding=\"async\" alt=\"Criptarea \u00een MySQL: rota\u021bia cheii principale\" src=\"\/wp-content\/uploads\/2020\/10\/24057c50b96236c5ee2647aeca4b575f.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>Din articolul precedent \u0219tim c\u0103 serverul, la pornire, cite\u0219te anteturile tuturor spa\u021biilor de tabele criptate \u0219i re\u021bine cel mai mare KEY ID. De exemplu, dac\u0103 avem trei tabele cu KEY<em>ID = 3 \u0219i o tabel\u0103 cu KEY<\/em>ID = 4, astfel \u00eenc\u00e2t identificatorul maxim al cheii va fi 4. S\u0103 numim aceast\u0103 CHEIE ID \u2014 MAX KEY ID.<\/p>\n<h3>Cum func\u021bioneaz\u0103 rota\u021bia cheii principale<\/h3>\n<p>1. Utilizatorul execut\u0103 ALTER INNODB MASTER KEY.<\/p>\n<p>2. Serverul solicit\u0103 \u00een stocarea cheilor (keyring) generarea unei noi chei principale cu UUID-ul serverului \u0219i KEY<em>ID, egal cu MAX<\/em>KEY<em>ID crescut cu unu. Astfel, ob\u021binem un identificator al cheii principale, egal cu INNODB<\/em>KEY-UUID-(MAX<em>KEY<\/em>ID + 1). La generarea cu succes a cheii principale, MAX KEY ID cre\u0219te cu unu (adic\u0103 MAX<em>KEY<\/em>ID = MAX<em>KEY<\/em>ID + 1).<\/p>\n<p>3. Serverul examineaz\u0103 toate spa\u021biile de tabele criptate cu ajutorul cheii principale \u0219i, pentru fiecare spa\u021biu de tabele:<\/p>\n<ul>\n<li>\n<p>cripteaz\u0103 cheia spa\u021biului de tabele cu noua cheie principal\u0103;<\/p>\n<\/li>\n<li>\n<p>actualizeaz\u0103 identificatorul cheii la noul MAX<em>KEY<\/em>ID;<\/p>\n<\/li>\n<li>\n<p>dac\u0103 UUID-ul difer\u0103 de UUID-ul serverului, actualizeaz\u0103 UUID-ul serverului.<\/p>\n<\/li>\n<\/ul>\n<p>A\u0219a cum \u0219tim, identificatorul cheii principale (Master Key ID) utilizat pentru decriptarea tabelului const\u0103 din UUID \u0219i KEY ID, citite din antetul spa\u021biului de tabele. Ceea ce facem acum este s\u0103 actualiz\u0103m aceste informa\u021bii \u00een antetul de criptare al spa\u021biului de tabele, astfel \u00eenc\u00e2t serverul s\u0103 primeasc\u0103 cheia principal\u0103 corect\u0103.<\/p>\n<p>Dac\u0103 avem spa\u021bii de tabel ob\u021binute din diferite locuri, de exemplu, din diverse backup-uri, acestea pot avea chei principale diferite. Toate aceste chei principale trebuie ob\u021binute din stocare la pornirea serverului. Acest lucru poate \u00eent\u00e2rzia pornirea serverului, mai ales dac\u0103 se folose\u0219te o stocare de chei server. Prin rotirea cheii principale, recript\u0103m cheile spa\u021biilor de tabel cu o cheie principal\u0103, aceea\u0219i pentru toate spa\u021biile de tabel. Acum, la pornire, serverul trebuie s\u0103 ob\u021bin\u0103 doar o cheie principal\u0103.<\/p>\n<p>Acesta este, desigur, doar un efect secundar pl\u0103cut. Scopul principal al rotirii cheilor principale este de a face serverul nostru mai sigur. \u00cen cazul \u00een care cheia principal\u0103 a fost furat\u0103 din stocare (de exemplu, din Vault Server), se poate genera o nou\u0103 cheie principal\u0103 \u0219i recript\u0103m cheile spa\u021biilor de tabel, f\u0103c\u00e2nd cheia furat\u0103 inexistent\u0103. Suntem \u00een siguran\u021b\u0103... aproape.<\/p>\n<p>\u00cen articolul anterior am men\u021bionat c\u0103 dup\u0103 furtul cheii spa\u021biului de tabele, o ter\u021b\u0103 parte ar putea folosi aceasta pentru a decripta datele. Cu condi\u021bia s\u0103 aib\u0103 acces la discul nostru. \u00cen cazul furtului cheii principale \u0219i av\u00e2nd acces la datele criptate, se poate folosi cheia principal\u0103 furat\u0103 pentru a decripta cheia spa\u021biului de tabele \u0219i a ob\u021bine datele decriptate. A\u0219a cum vedem, rota\u021bia cheii principale nu ajut\u0103 \u00een acest caz. Recript\u0103m cheia spa\u021biului de tabele cu o nou\u0103 cheie principal\u0103, dar cheia efectiv\u0103 folosit\u0103 pentru criptarea\/decriptarea datelor r\u0103m\u00e2ne aceea\u0219i. Prin urmare, \u201ehackerul\u201d poate continua s\u0103 o foloseasc\u0103 pentru a decripta datele. Anterior, am sugerat c\u0103 <noindex><a rel=\"nofollow\" href=\"https:\/\/www.percona.com\/software\/mysql-database\/percona-server\"><u>Percona Server for MySQL<\/u><\/a><\/noindex> poate executa o recriptare real\u0103 a spa\u021biilor de tabel, nu doar o simpl\u0103 recriptare a cheii spa\u021biului de tabel. Aceast\u0103 func\u021bionalitate se nume\u0219te fire de criptare (encryption threads). Cu toate acestea, \u00een acest moment, aceast\u0103 func\u021bionalitate este \u00eenc\u0103 experimental\u0103.<\/p>\n<p>Rotirea cheii principale este util\u0103 atunci c\u00e2nd cheia principal\u0103 a fost furat\u0103, dar atacatorul nu are capacitatea de a o folosi \u0219i de a decripta cheile spa\u021biilor de tabel.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/otus.pw\/dADq\/\"><strong>\u00censcrie-te pentru o lec\u021bie demo gratuit\u0103.<\/strong><\/a><\/noindex><\/p>\n<h4>Cite\u0219te mai mult:<\/h4>\n<ul>\n<li>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/otus\/blog\/522092\/\">Criptarea \u00een MySQL: stocarea cheilor<\/a><\/noindex><\/p>\n<\/li>\n<li>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/otus\/blog\/524050\/\">Criptarea \u00een MySQL: utilizarea Master Key<\/a><\/noindex><\/p>\n<\/li>\n<\/ul>\n<p>Sursa: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/otus\/blog\/524624\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u043f\u0440\u0435\u0434\u0434\u0432\u0435\u0440\u0438\u0438 \u0441\u0442\u0430\u0440\u0442\u0430 \u043d\u043e\u0432\u043e\u0433\u043e \u043d\u0430\u0431\u043e\u0440\u0430 \u043d\u0430 \u043a\u0443\u0440\u0441&nbsp;\u00ab\u0411\u0430\u0437\u044b \u0434\u0430\u043d\u043d\u044b\u0445\u00bb&nbsp;\u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u043c \u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u0442\u044c \u0441\u0435\u0440\u0438\u044e \u0441\u0442\u0430\u0442\u0435\u0439 \u043f\u0440\u043e \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0432 MySQL. \u0412 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0435\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u044d\u0442\u043e\u0439 \u0441\u0435\u0440\u0438\u0438 \u043c\u044b \u043e\u0431\u0441\u0443\u0434\u0438\u043b\u0438, \u043a\u0430\u043a \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441 \u0433\u043b\u0430\u0432\u043d\u044b\u043c \u043a\u043b\u044e\u0447\u043e\u043c (Master Key). \u0421\u0435\u0433\u043e\u0434\u043d\u044f, \u043e\u0441\u043d\u043e\u0432\u044b\u0432\u0430\u044f\u0441\u044c \u043d\u0430 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u043d\u044b\u0445 \u0440\u0430\u043d\u0435\u0435 \u0437\u043d\u0430\u043d\u0438\u044f\u0445, \u043f\u043e\u0441\u043c\u043e\u0442\u0440\u0438\u043c \u043d\u0430 \u0440\u043e\u0442\u0430\u0446\u0438\u044e \u0433\u043b\u0430\u0432\u043d\u044b\u0445 \u043a\u043b\u044e\u0447\u0435\u0439. \u0420\u043e\u0442\u0430\u0446\u0438\u044f \u0433\u043b\u0430\u0432\u043d\u044b\u0445 \u043a\u043b\u044e\u0447\u0435\u0439 \u0437\u0430\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u0433\u0435\u043d\u0435\u0440\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u043d\u043e\u0432\u044b\u0439 \u0433\u043b\u0430\u0432\u043d\u044b\u0439 \u043a\u043b\u044e\u0447 \u0438 \u044d\u0442\u0438\u043c \u043d\u043e\u0432\u044b\u043c [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":98089,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-98088","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 \u043f\u0440\u0435\u0434\u0434\u0432\u0435\u0440\u0438\u0438 \u0441\u0442\u0430\u0440\u0442\u0430 \u043d\u043e\u0432\u043e\u0433\u043e \u043d\u0430\u0431\u043e\u0440\u0430 \u043d\u0430 \u043a\u0443\u0440\u0441 \u00ab\u0411\u0430\u0437\u044b \u0434\u0430\u043d\u043d\u044b\u0445\u00bb \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u043c.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/shifrovanie-v-mysql-rotacziya-master-key\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0428\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0432 MySQL: \u0440\u043e\u0442\u0430\u0446\u0438\u044f Master Key | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 \u043f\u0440\u0435\u0434\u0434\u0432\u0435\u0440\u0438\u0438 \u0441\u0442\u0430\u0440\u0442\u0430 \u043d\u043e\u0432\u043e\u0433\u043e \u043d\u0430\u0431\u043e\u0440\u0430 \u043d\u0430 \u043a\u0443\u0440\u0441 \u00ab\u0411\u0430\u0437\u044b \u0434\u0430\u043d\u043d\u044b\u0445\u00bb \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u043c.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/shifrovanie-v-mysql-rotacziya-master-key\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-10-24T00:42:34+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-11-17T22:58:48+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Criptare \u00een MySQL: rota\u021bia Cheii Master | ProHoster","description":"\u00cen apropierea \u00eenceperii unui nou curs pentru cursul \u201eBaze de date\u201d, continu\u0103m.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/shifrovanie-v-mysql-rotacziya-master-key","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0428\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0432 MySQL: \u0440\u043e\u0442\u0430\u0446\u0438\u044f Master Key | ProHoster","og:description":"\u0412 \u043f\u0440\u0435\u0434\u0434\u0432\u0435\u0440\u0438\u0438 \u0441\u0442\u0430\u0440\u0442\u0430 \u043d\u043e\u0432\u043e\u0433\u043e \u043d\u0430\u0431\u043e\u0440\u0430 \u043d\u0430 \u043a\u0443\u0440\u0441 \u00ab\u0411\u0430\u0437\u044b \u0434\u0430\u043d\u043d\u044b\u0445\u00bb \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u043c.","og:url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/shifrovanie-v-mysql-rotacziya-master-key","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-10-24T00:42:34+00:00","article:modified_time":"2020-11-17T22:58:48+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"98088","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 10:05:50","updated":"2022-10-03 07:13:53","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/98088","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=98088"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/98088\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/98089"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=98088"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=98088"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=98088"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}