[MDEV-18049] Support ENCRYPTED and ENCRYPTION_KEY_ID table options for Aria Created: 2018-12-20  Updated: 2023-11-30

Status: Open
Project: MariaDB Server
Component/s: Encryption, Storage Engine - Aria
Fix Version/s: None

Type: New Feature Priority: Major
Reporter: Geoff Montee (Inactive) Assignee: Unassigned
Resolution: Unresolved Votes: 0
Labels: None

Issue Links:
Relates
relates to MDEV-8587 Aria log encryption Open
relates to MDEV-17324 Make information_schema table that sh... Open
relates to MDEV-18971 Add background encryption threads for... Open
relates to MDEV-20099 Implement key rotation for Aria Open

 Description   

InnoDB supports manually encrypting tables with the ENCRYPTED and ENCRYPTION_KEY_ID table options:

https://mariadb.com/kb/en/library/innodb-enabling-encryption/#enabling-encryption-for-manually-encrypted-tablespaces

Aria does support data-at-rest encryption:

https://mariadb.com/kb/en/library/aria-encryption-overview/

But Aria does not currently support manual encryption using these table options:

https://mariadb.com/kb/en/library/aria-enabling-encryption/#manually-encrypting-tables

See the following:

MariaDB [db1]> CREATE TABLE aria_tab (
 
    ->    id int primary key,
 
    ->    str varchar(50)
 
    -> )
 
    -> ENGINE = Aria
 
    -> ROW_FORMAT=PAGE
 
    -> ENCRYPTED = YES
 
    -> ENCRYPTION_KEY_ID = 1;
 
ERROR 1911 (HY000): Unknown option 'ENCRYPTED'



 Comments   
Comment by Geoff Montee (Inactive) [ 2018-12-20 ]

I added a note about this to the documentation:

https://mariadb.com/kb/en/library/encrypting-data-for-aria/#enabling-encryption-for-manually-encrypted-tables

Comment by Federico Razzoli [ 2019-03-19 ]

Will it be possible to encrypt Aria tables in mysql database?

Comment by Geoff Montee (Inactive) [ 2019-03-19 ]

Hi f_razzoli,

Yeah, you just can't do it by setting ENCRYPTED=YES. You have to globally enable encryption for all Aria tables, and then explicitly rebuild the table. See the following documentation section:

https://mariadb.com/kb/en/library/aria-enabling-encryption/#encrypting-existing-tables

e.g.:

1.) Enable Aria encryption:

MariaDB [(none)]> SET GLOBAL aria_encrypt_tables=ON;
 
Query OK, 0 rows affected (0.000 sec)

2.) Rebuild the table that you want to ensure is encrypted:

MariaDB [(none)]> ALTER TABLE mysql.global_priv ENGINE=Aria;
 
Query OK, 7 rows affected (0.017 sec)
 
Records: 7  Duplicates: 0  Warnings: 0

3.) Confirm that the table is encrypted. See the following documentation section for that:

https://mariadb.com/kb/en/library/aria-encryption-overview/#determining-whether-a-table-is-encrypted

e.g.:

$ sudo strings /var/lib/mysql/mysql/global_priv.MAD | grep "root"

Generated at Thu Feb 08 08:41:07 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.