Some users are requesting that we implement key rotation for file_key_management plugin.
I'm not sure that it's practical. How would key rotation work in file_key_management plugin? The plugin has some serious limitations that would likely make it impractical to implement key rotation. Some open questions are listed below.
How would new key versions be generated?
The file_key_management plugin currently doesn't generate any encryption keys itself, and it doesn't even have a backend KMS to generate encryption keys for it either.
With file_key_management plugin, any encryption keys currently need to be generated by the user with external tools, such as openssl. For example:
And then the keys currently need to be manually saved to the key file.
- Would the user still have to manually generate the new key versions, and then manually save them to the key file?
- Would we implement a UDF in the file_key_management plugin that can be used to generate random keys, and a UDF that can save a key version to a key file? For example:
How would the format of the key file change to allow different key versions of the same key ID?
The format of file_key_management plugin's key file is pretty simplistic. It simply stores encryption keys in a plain-text file that uses the format.
For example, if we had two keys with key ID 1 and 2, then the key file could look like this:
This format currently has no way to store different versions of the same encryption key. However, this is something that it would need to support in order to support key rotation.
It's possible that we could extend the format, but it could get very ugly. For example:
For example, if we had two key versions of two different keys with key ID 1 and 2, then the key file could look like this:
If we decide that new key versions need to be manually generated, then how would the file_key_management plugin reload the new key versions?
- file_key_management plugin currently only parses the key file at startup. Would we still want to require a server restart to reload keys?
- Would we want to implement some FLUSH command? For example:
- Would we want to implement some UDF? For example:
Is there similar functionality in other databases that we could use as inspiration?
Users migrating from Oracle might have used Oracle Wallet: