An Introduction to MariaDB’s Data at Rest

Encryption (DARE) – Part 1

Encryption is becoming more and more prevalent and increasingly necessary in today’s world, so
I wanted to provide a good overall “getting started” article on using MariaDB’s data at rest
encryption (DARE) for anyone out there interested in setting this up in their environment.

MariaDB’s data encryption at rest manual page covers a lot of the specifics, but I wanted to
create a quick start guide and also note a few items that might not be immediately obvious.

And due to the number of my examples, I’m splitting this into two posts. The first will focus
solely on setting up encryption so you can use it. The second will focus on using it with a
number of examples and common use cases.

Also, I feel that I should mention from the outset that, currently, this data at rest encryption only
applies to InnoDB/XtraDB tables and Aria tables (that are created with
ROW_FORMAT=PAGE, the default), and other limitations are listed on the above page.

1. First off, you will need to create a keys.txt file. The example on the above page works fine for
this, but you may want to eventually create your own:

1;770A8A65DA156D24EE2A093277530142
18;F5502320F8429037B8DAEF761B189D12F5502320F8429037B8DAEF761B189D12

Save that as keys.txt (or whatever you want) and I’ll place it in the datadir for the sake of this
example.

The first number is the encryption key identifier (a 32-bit number), and the latter the actual hex-
encoded encryption key (which can be 128, 192, or 256-bit). The two values are to be separated
by a semi-colon. You only need the first key (i.e., #1), but you can add as many keys as you like,
and use various keys for various tables if you desire. The number 1 key is also the default.

2. Add the following lines to your configuration file (these are the basics from the manual page
above):

plugin-load-add=file_key_management.dll
file-key-management
file-key-management-filename = "C:/Program Files/MySQL/mariadb-
10.1.21/data/keys.txt"
innodb-encrypt-tables
innodb-encrypt-log
innodb-encryption-threads=4

Of course if on Linux, change the “.dll” to “.so”. Or you can always load it dynamically, but
when you also need to set related variables, I prefer this way.
  The first three lines load the key_management plugin, enable file-key-management, and
point to the file-key file you created.
 The fourth is what enables encryption. You can set to 0 (off), 1 (on), or FORCE (to
always force every single table to be encrypted).
 The fifth tells the server to enable encryption for the log files. From what I understand,
this is for the InnoDB log files. There is a separate option to encrypt binary logs (- -
encrypt-binlog). The manual recommends to enable this if you are encrypting tables since
the data in the logs would not be encrypted otherwise, and thus viewable.
 The sixth specifies how many background encryption threads to startup and use. These
threads perform background key rotation and scrubbing. Note that this will add some
overhead, and these background threads can cause higher CPU utilization since they are
running and checking tables all of the time. More on this topic can be found here:
https://jira.mariadb.org/browse/MDEV-11581

3. Restart your instance, and check that all looks normal.

Verify that the plugin loaded properly:

MariaDB> SHOW PLUGINS;

+-------------------------------+----------+--------------------+------------
-------------+---------+
| Name | Status | Type | Library
| License |
+-------------------------------+----------+--------------------+------------
-------------+---------+
...
| file_key_management | ACTIVE | ENCRYPTION |
file_key_management.dll | GPL |
+-------------------------------+----------+--------------------+------------
-------------+---------+

And if using the above, you will see the 4 encryption threads start up in the error log:

2017-02-08 16:41:44 55840 [Note] InnoDB: Creating #1 thread id 33908 total

threads 4.
2017-02-08 16:41:44 55840 [Note] InnoDB: Creating #2 thread id 33924 total
threads 4.
2017-02-08 16:41:44 55840 [Note] InnoDB: Creating #3 thread id 38532 total
threads 4.
2017-02-08 16:41:44 55840 [Note] InnoDB: Creating #4 thread id 29060 total
threads 4.

4. Now you are ready to create an encrypted table. More on this in part #2