{"id":98088,"date":"2020-10-24T02:42:34","date_gmt":"2020-10-24T00:42:34","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/shifrovanie-v-mysql-rotacziya-master-key"},"modified":"2020-11-18T00:58:48","modified_gmt":"2020-11-17T22:58:48","slug":"shifrovanie-v-mysql-rotacziya-master-key","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/shifrovanie-v-mysql-rotacziya-master-key","title":{"rendered":"\u0160ifriranje v MySQL: rotacija glavnega klju\u010da","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<\/p>\n<p><strong><em>Uo\u010di po\u010detka novog upisa na kurs&nbsp;<\/em><\/strong><noindex><a rel=\"nofollow\" href=\"https:\/\/otus.pw\/dADq\/\"><strong><em>\u201eBaze podataka\u201c<\/em><\/strong><\/a><\/noindex><strong><em>&nbsp;Nadaljevanje serije \u010dlankov o \u0161ifriranju v MySQL.<\/em><\/strong><\/p>\n<p>V prej\u0161njem \u010dlanku te serije smo obravnavali, <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/otus\/blog\/524050\/\"><u>kako deluje \u0161ifriranje z glavnim klju\u010dem (Master Key)<\/u><\/a><\/noindex>. Danes, na osnovi prej pridobljenega znanja, bomo pogledali rotacijo glavnih klju\u010dev.<\/p>\n<p>Rotacija glavnih klju\u010dev pomeni, da se ustvari nov glavni klju\u010d, s katerim se ponovno \u0161ifrirajo klju\u010di tabelarnih prostorov (ki so shranjeni v glavi tabelarnih prostorov).<\/p>\n<p>Poglejmo, kako izgleda glava \u0161ifriranega tabelarnega prostora:<\/p>\n<p><img decoding=\"async\" alt=\"\u0160ifriranje v MySQL: rotacija glavnega klju\u010da\" src=\"\/wp-content\/uploads\/2020\/10\/24057c50b96236c5ee2647aeca4b575f.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>Iz prej\u0161njega \u010dlanka vemo, da stre\u017enik ob zagonu prebere glave vseh \u0161ifriranih tabelarnih prostorov in si zapomni najve\u010dji KEY ID. Na primer, \u010de imamo tri tabele z KEY<em>ID = 3 in eno tabelo z KEY<\/em>ID = 4, to je najve\u010dji identifikator klju\u010da, ki bo enak 4. Poimenujmo ta KLJU\u010c ID \u2014 MAX KEY ID.<\/p>\n<h3>Kako deluje rotacija glavnega klju\u010daa<\/h3>\n<p>1. Uporabnik izvede ALTER INNODB MASTER KEY.<\/p>\n<p>2. Stre\u017enik zahteva v shrambo klju\u010dev (keyring) generiranje novega glavnega klju\u010daa z UUID stre\u017enika in KEY<em>ID, enak povi\u0161anemu za enoto MAX<\/em>KEY<em>ID. Tako dobimo identifikator glavnega klju\u010daa, enak INNODB<\/em>KEY-UUID- (MAX<em>KEY<\/em>ID + 1). Pri uspe\u0161ni generaciji glavnega klju\u010daa se MAX KEY ID pove\u010da za enico (tj. MAX<em>KEY<\/em>ID = MAX<em>KEY<\/em>ID + 1).<\/p>\n<p>3. Stre\u017enik pregleda vse tabelarne prostore, ki so \u0161ifrirani z glavnim klju\u010dem, in za vsak tabelarni prostor:<\/p>\n<ul>\n<li>\n<p>\u0161ifrira klju\u010d tabelarnega prostora z novim glavnim klju\u010dem;<\/p>\n<\/li>\n<li>\n<p>posodobi identifikator klju\u010da na nov MAX<em>KEY<\/em>ID;<\/p>\n<\/li>\n<li>\n<p>\u010de se UUID razlikuje od UUID stre\u017enika, potem posodobi UUID stre\u017enika.<\/p>\n<\/li>\n<\/ul>\n<p>Kot vemo, identifikator glavnega klju\u010daa (Master Key ID), uporabljen za de\u0161ifriranje tabele, sestavlja UUID in KEY ID, prebrana iz glave tabelarnega prostora. To, kar zdaj po\u010dnemo, je posodobitev teh informacij v glavi \u0161ifriranja tabelarnega prostora, da stre\u017enik dobi pravilen glavni klju\u010d.<\/p>\n<p>\u010ce imamo razdelk prostora, pridobljenih z razli\u010dnih mest, na primer iz razli\u010dnih varnostnih kopij, lahko uporabljajo razli\u010dne glavne klju\u010de. Vse te glavne klju\u010de bo treba pridobiti iz skladi\u0161\u010da ob zagonu stre\u017enika. To lahko upo\u010dasni zagon stre\u017enika, \u0161e posebej, \u010de se uporablja stre\u017eni\u0161ko skladi\u0161\u010de klju\u010dev. Z ro\u010dno rotacijo glavnega klju\u010da ponovno \u0161ifriramo klju\u010de razdelkov prostora z enim glavnim klju\u010dem, ki je enak za vse razdelke. Zdaj ob zagonu stre\u017enik potrebuje le en glavni klju\u010d.<\/p>\n<p>To je seveda le prijetna stranska korist. Glavni cilj rotacije glavnih klju\u010dev je pove\u010dati varnost na\u0161ega stre\u017enika. V primeru, da je bil glavni klju\u010d na kakr\u0161en koli na\u010din ukraden iz skladi\u0161\u010da (na primer iz Vault Server), lahko ustvarimo nov glavni klju\u010d in ponovno \u0161ifriramo klju\u010de razdelkov prostora, kar bo ukradeni klju\u010d naredilo neveljaven. Tako smo varni\u2026 skoraj.<\/p>\n<p>V prej\u0161njem \u010dlanku sem omenil, da lahko tretja stran po kraji klju\u010da prostora za tabele ta klju\u010d uporabi za de\u0161ifriranje podatkov. Pod pogojem, da ima dostop do na\u0161ega diska. V primeru kraje glavnega klju\u010da in dostopa do \u0161ifriranih podatkov lahko ukraden glavni klju\u010d uporabimo za de\u0161ifriranje klju\u010da prostora za tabele in pridobimo de\u0161ifrirane podatke. Kot vidimo, rotacija glavnega klju\u010da v tem primeru ne pomaga. Ponovno \u0161ifriramo klju\u010d prostora za tabele z novim glavnim klju\u010dem, a dejanski klju\u010d, uporabljen za \u0161ifriranje\/de\u0161ifriranje podatkov, ostaja enak. Zato lahko 'hacker' \u0161e naprej uporablja ta klju\u010d za de\u0161ifriranje podatkov. Prej sem nakazal, da <noindex><a rel=\"nofollow\" href=\"https:\/\/www.percona.com\/software\/mysql-database\/percona-server\"><u>Percona Server za MySQL<\/u><\/a><\/noindex> lahko dejansko izvaja ponovno \u0161ifriranje razdelkov prostora in ne le preproste ponovne \u0161ifriranje klju\u010da razdelka prostora. Ta funkcija se imenuje \u0161ifrirni tokovi (encryption threads). Vendar pa je ta funkcionalnost za zdaj \u0161e vedno eksperimentalna.<\/p>\n<p>Rotacija glavnega klju\u010da je koristna, ko je glavni klju\u010d ukraden, vendar nima zlonamerna oseba mo\u017enosti za njegovo uporabo in de\u0161ifriranje klju\u010dev razdelkov prostora.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/otus.pw\/dADq\/\"><strong>Prijavite se za brezpla\u010dni demo te\u010daj.<\/strong><\/a><\/noindex><\/p>\n<h4>Preberi ve\u010d:<\/h4>\n<ul>\n<li>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/otus\/blog\/522092\/\">\u0160ifriranje u MySQL-u: skladi\u0161te klju\u010deva<\/a><\/noindex><\/p>\n<\/li>\n<li>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/otus\/blog\/524050\/\">\u0160ifriranje v MySQL: uporaba Master Key<\/a><\/noindex><\/p>\n<\/li>\n<\/ul>\n<p>Izvor: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/otus\/blog\/524624\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u043f\u0440\u0435\u0434\u0434\u0432\u0435\u0440\u0438\u0438 \u0441\u0442\u0430\u0440\u0442\u0430 \u043d\u043e\u0432\u043e\u0433\u043e \u043d\u0430\u0431\u043e\u0440\u0430 \u043d\u0430 \u043a\u0443\u0440\u0441&nbsp;\u00ab\u0411\u0430\u0437\u044b \u0434\u0430\u043d\u043d\u044b\u0445\u00bb&nbsp;\u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u043c \u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u0442\u044c \u0441\u0435\u0440\u0438\u044e \u0441\u0442\u0430\u0442\u0435\u0439 \u043f\u0440\u043e \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0432 MySQL. \u0412 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0435\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u044d\u0442\u043e\u0439 \u0441\u0435\u0440\u0438\u0438 \u043c\u044b \u043e\u0431\u0441\u0443\u0434\u0438\u043b\u0438, \u043a\u0430\u043a \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441 \u0433\u043b\u0430\u0432\u043d\u044b\u043c \u043a\u043b\u044e\u0447\u043e\u043c (Master Key). \u0421\u0435\u0433\u043e\u0434\u043d\u044f, \u043e\u0441\u043d\u043e\u0432\u044b\u0432\u0430\u044f\u0441\u044c \u043d\u0430 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u043d\u044b\u0445 \u0440\u0430\u043d\u0435\u0435 \u0437\u043d\u0430\u043d\u0438\u044f\u0445, \u043f\u043e\u0441\u043c\u043e\u0442\u0440\u0438\u043c \u043d\u0430 \u0440\u043e\u0442\u0430\u0446\u0438\u044e \u0433\u043b\u0430\u0432\u043d\u044b\u0445 \u043a\u043b\u044e\u0447\u0435\u0439. \u0420\u043e\u0442\u0430\u0446\u0438\u044f \u0433\u043b\u0430\u0432\u043d\u044b\u0445 \u043a\u043b\u044e\u0447\u0435\u0439 \u0437\u0430\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u0433\u0435\u043d\u0435\u0440\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u043d\u043e\u0432\u044b\u0439 \u0433\u043b\u0430\u0432\u043d\u044b\u0439 \u043a\u043b\u044e\u0447 \u0438 \u044d\u0442\u0438\u043c \u043d\u043e\u0432\u044b\u043c [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":98089,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-98088","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.5 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 \u043f\u0440\u0435\u0434\u0434\u0432\u0435\u0440\u0438\u0438 \u0441\u0442\u0430\u0440\u0442\u0430 \u043d\u043e\u0432\u043e\u0433\u043e \u043d\u0430\u0431\u043e\u0440\u0430 \u043d\u0430 \u043a\u0443\u0440\u0441 \u00ab\u0411\u0430\u0437\u044b \u0434\u0430\u043d\u043d\u044b\u0445\u00bb \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u043c.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/shifrovanie-v-mysql-rotacziya-master-key\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.5\" \/>\n\t\t<meta property=\"og:locale\" content=\"sl_SI\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0428\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0432 MySQL: \u0440\u043e\u0442\u0430\u0446\u0438\u044f Master Key | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 \u043f\u0440\u0435\u0434\u0434\u0432\u0435\u0440\u0438\u0438 \u0441\u0442\u0430\u0440\u0442\u0430 \u043d\u043e\u0432\u043e\u0433\u043e \u043d\u0430\u0431\u043e\u0440\u0430 \u043d\u0430 \u043a\u0443\u0440\u0441 \u00ab\u0411\u0430\u0437\u044b \u0434\u0430\u043d\u043d\u044b\u0445\u00bb \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u043c.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/shifrovanie-v-mysql-rotacziya-master-key\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-10-24T00:42:34+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-11-17T22:58:48+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47\u0160ifriranje v MySQL: rotacija glavnega klju\u010da | ProHoster","description":"Ob za\u010detku novega sklopa te\u010daja \"Baze podatkov\" nadaljujemo.","canonical_url":"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/shifrovanie-v-mysql-rotacziya-master-key","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sl_SI","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0428\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0432 MySQL: \u0440\u043e\u0442\u0430\u0446\u0438\u044f Master Key | ProHoster","og:description":"\u0412 \u043f\u0440\u0435\u0434\u0434\u0432\u0435\u0440\u0438\u0438 \u0441\u0442\u0430\u0440\u0442\u0430 \u043d\u043e\u0432\u043e\u0433\u043e \u043d\u0430\u0431\u043e\u0440\u0430 \u043d\u0430 \u043a\u0443\u0440\u0441 \u00ab\u0411\u0430\u0437\u044b \u0434\u0430\u043d\u043d\u044b\u0445\u00bb \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u043c.","og:url":"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/shifrovanie-v-mysql-rotacziya-master-key","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-10-24T00:42:34+00:00","article:modified_time":"2020-11-17T22:58:48+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"98088","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 10:05:50","updated":"2022-10-03 07:13:53","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/98088","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/comments?post=98088"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/98088\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media\/98089"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media?parent=98088"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/categories?post=98088"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/tags?post=98088"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}