Details
-
Task
-
Status: Closed (View Workflow)
-
Major
-
Resolution: Fixed
-
None
-
10.2.0-7, 10.2.0-8
Description
- Whenever a new key or a key version is required (e.g CREATE TABLE ... ENCRYPTED=YES), plugins issues GenerateDataKeyWithoutPlaintext AWS API call to generate a new datakey, and stores ciphered key it in a file in the data directory. The file name for a key-number $key and version $ver will be aws-kms-key.$key.$ver
- Ciphered datakeys are decrypted(in memory) using Decrypt API call , and returned by get_key() encryption API calls.
- The data is encrypted with plain key, using AES-128 or AES-256 , depending on plain key length.
Attachments
Activity
| Field | Original Value | New Value |
|---|---|---|
| Assignee | Vladislav Vaintroub [ wlad ] |
| Description |
h1. Mode of operation
* Whenever a new key or a key version is required (e.g ```CREATE TABLE ... ENCRYPTED=YES```), plugins issues [GenerateDataKeyWithoutPlaintext AWS API call|http://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKeyWithoutPlaintext.html] to generate a new datakey, and story it in a file in the data directory. The file name for a key-number $key and version $ver will be aws-kms.$key.$ver * The key will be decrypted in memory using [Decrypt API call | http://docs.aws.amazon.com/kms/latest/APIReference/API_Decrypt.html] |
| Description |
h1. Mode of operation
* Whenever a new key or a key version is required (e.g ```CREATE TABLE ... ENCRYPTED=YES```), plugins issues [GenerateDataKeyWithoutPlaintext AWS API call|http://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKeyWithoutPlaintext.html] to generate a new datakey, and story it in a file in the data directory. The file name for a key-number $key and version $ver will be aws-kms.$key.$ver * The key will be decrypted in memory using [Decrypt API call | http://docs.aws.amazon.com/kms/latest/APIReference/API_Decrypt.html] |
h1. General mode of operation
* Whenever a new key or a key version is required (e.g {{CREATE TABLE ... ENCRYPTED=YES}}), plugins issues [GenerateDataKeyWithoutPlaintext AWS API call|http://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKeyWithoutPlaintext.html] to generate a new datakey, and story it in a file in the data directory. The file name for a key-number $key and version $ver will be aws-kms.$key.$ver * The key will be decrypted in memory using [Decrypt API call | http://docs.aws.amazon.com/kms/latest/APIReference/API_Decrypt.html] * The data is encrypted using either AES-128 or AES-256 , depending on key length h1. |
| Description |
h1. General mode of operation
* Whenever a new key or a key version is required (e.g {{CREATE TABLE ... ENCRYPTED=YES}}), plugins issues [GenerateDataKeyWithoutPlaintext AWS API call|http://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKeyWithoutPlaintext.html] to generate a new datakey, and story it in a file in the data directory. The file name for a key-number $key and version $ver will be aws-kms.$key.$ver * The key will be decrypted in memory using [Decrypt API call | http://docs.aws.amazon.com/kms/latest/APIReference/API_Decrypt.html] * The data is encrypted using either AES-128 or AES-256 , depending on key length h1. |
* Whenever a new key or a key version is required (e.g {{CREATE TABLE ... ENCRYPTED=YES}}), plugins issues [GenerateDataKeyWithoutPlaintext AWS API call|http://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKeyWithoutPlaintext.html] to generate a new datakey, and stores ciphered key it in a file in the data directory. The file name for a key-number $key and version $ver will be aws-kms-key.$key.$ver
* Ciphered datakeys are decrypted(in memory) using [Decrypt API call | http://docs.aws.amazon.com/kms/latest/APIReference/API_Decrypt.html], and returned by {{get_key()}} encryption API calls. * The data is encrypted with plain key, using AES-128 or AES-256 , depending on plain key length. |
| Sprint | 10.2.0-7 [ 39 ] |
| Rank | Ranked higher |
| Status | Open [ 1 ] | In Progress [ 3 ] |
| Assignee | Vladislav Vaintroub [ wlad ] | Sergei Golubchik [ serg ] |
| Status | In Progress [ 3 ] | In Review [ 10002 ] |
| Assignee | Sergei Golubchik [ serg ] | Vladislav Vaintroub [ wlad ] |
| Status | In Review [ 10002 ] | Stalled [ 10000 ] |
| Sprint | 10.2.0-7 [ 39 ] | 10.2.0-7, 10.2.0-8 [ 39, 41 ] |
| Component/s | Encryption [ 11200 ] | |
| Component/s | Plugins [ 10118 ] | |
| Fix Version/s | 10.1.13 [ 21803 ] | |
| Fix Version/s | 10.1 [ 16100 ] | |
| Resolution | Fixed [ 1 ] | |
| Status | Stalled [ 10000 ] | Closed [ 6 ] |
| Workflow | MariaDB v3 [ 74410 ] | MariaDB v4 [ 132802 ] |