<div id="docs-body">
 <div class="section">
  <div class="titlepage">
   <div>
    <div>
     <h2 class="title">
      <a name="innodb-data-encryption">
      </a>
      17.13 InnoDB Data-at-Rest Encryption
     </h2>
    </div>
   </div>
  </div>
  <a class="indexterm" name="idm46045159423296">
  </a>
  <a class="indexterm" name="idm46045159422224">
  </a>
  <a class="indexterm" name="idm46045159421152">
  </a>
  <a class="indexterm" name="idm46045159420080">
  </a>
  <a class="indexterm" name="idm46045159418992">
  </a>
  <a class="indexterm" name="idm46045159417920">
  </a>
  <a class="indexterm" name="idm46045159416832">
  </a>
  <a class="indexterm" name="idm46045159415728">
  </a>
  <a class="indexterm" name="idm46045159414656">
  </a>
  <a class="indexterm" name="idm46045159413584">
  </a>
  <a class="indexterm" name="idm46045159412496">
  </a>
  <p>
   <code class="literal">
    InnoDB
   </code>
   supports data-at-rest encryption for
   <a class="link" href="glossary.html#glos_file_per_table" title="file-per-table">
    file-per-table
   </a>
   tablespaces,
   <a class="link" href="glossary.html#glos_general_tablespace" title="general tablespace">
    general
   </a>
   tablespaces, the
   <code class="literal">
    mysql
   </code>
   system tablespace, redo
    logs, and undo logs.
  </p>
  <p>
   You can set an encryption default for schemas and general
    tablespaces; this permits DBAs to control whether tables created in
    those schemas and tablespaces are encrypted.
  </p>
  <p>
   <code class="literal">
    InnoDB
   </code>
   data-at-rest encryption features and
    capabilities are described under the following topics in this
    section.
  </p>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      <a class="xref" href="innodb-data-encryption.html#innodb-data-encryption-about" title="About Data-at-Rest Encryption">
       About Data-at-Rest Encryption
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="innodb-data-encryption.html#innodb-data-encryption-encryption-prerequisites" title="Encryption Prerequisites">
       Encryption Prerequisites
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="innodb-data-encryption.html#innodb-schema-tablespace-encryption-default" title="Defining an Encryption Default for Schemas and General Tablespaces">
       Defining an Encryption Default for Schemas and General Tablespaces
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="innodb-data-encryption.html#innodb-data-encryption-enabling-disabling" title="File-Per-Table Tablespace Encryption">
       File-Per-Table Tablespace Encryption
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="innodb-data-encryption.html#innodb-general-tablespace-encryption-enabling-disabling" title="General Tablespace Encryption">
       General Tablespace Encryption
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="innodb-data-encryption.html#innodb-doublewrite-file-encryption" title="Doublewrite File Encryption">
       Doublewrite File Encryption
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="innodb-data-encryption.html#innodb-mysql-tablespace-encryption-enabling-disabling" title="mysql System Tablespace Encryption">
       mysql System Tablespace Encryption
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="innodb-data-encryption.html#innodb-data-encryption-redo-log" title="Redo Log Encryption">
       Redo Log Encryption
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="innodb-data-encryption.html#innodb-data-encryption-undo-log" title="Undo Log Encryption">
       Undo Log Encryption
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="innodb-data-encryption.html#innodb-data-encryption-master-key-rotation" title="Master Key Rotation">
       Master Key Rotation
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="innodb-data-encryption.html#innodb-data-encryption-recovery" title="Encryption and Recovery">
       Encryption and Recovery
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="innodb-data-encryption.html#innodb-data-encryption-exporting" title="Exporting Encrypted Tablespaces">
       Exporting Encrypted Tablespaces
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="innodb-data-encryption.html#innodb-data-encryption-replication" title="Encryption and Replication">
       Encryption and Replication
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="innodb-data-encryption.html#innodb-data-encryption-identifying" title="Identifying Encrypted Tablespaces and Schemas">
       Identifying Encrypted Tablespaces and Schemas
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="innodb-data-encryption.html#innodb-data-encryption-progress-monitoring" title="Monitoring Encryption Progress">
       Monitoring Encryption Progress
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="innodb-data-encryption.html#innodb-data-encryption-usage-notes" title="Encryption Usage Notes">
       Encryption Usage Notes
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="innodb-data-encryption.html#innodb-data-encryption-limitations" title="Encryption Limitations">
       Encryption Limitations
      </a>
     </p>
    </li>
   </ul>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h3 class="title">
       <a name="innodb-data-encryption-about">
       </a>
       About Data-at-Rest Encryption
      </h3>
     </div>
    </div>
   </div>
   <p>
    <code class="literal">
     InnoDB
    </code>
    uses a two tier encryption key
      architecture, consisting of a master encryption key and tablespace
      keys. When a tablespace is encrypted, a tablespace key is
      encrypted and stored in the tablespace header. When an application
      or authenticated user wants to access encrypted tablespace data,
    <code class="literal">
     InnoDB
    </code>
    uses a master encryption key to decrypt
      the tablespace key. The decrypted version of a tablespace key
      never changes, but the master encryption key can be changed as
      required. This action is referred to as
    <span class="emphasis">
     <em>
      master key
      rotation
     </em>
    </span>
    .
   </p>
   <p>
    The data-at-rest encryption feature relies on a keyring component
      or plugin for master encryption key management.
   </p>
   <p>
    All MySQL editions provide a
    <code class="literal">
     component_keyring_file
    </code>
    component, which stores
      keyring data in a file local to the server host.
   </p>
   <p>
    MySQL Enterprise Edition offers additional keyring components and plugins:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <code class="literal">
        component_keyring_encrypted_file
       </code>
       : Stores
          keyring data in an encrypted, password-protected file local to
          the server host.
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        keyring_okv
       </code>
       : A KMIP 1.1 plugin for use with
          KMIP-compatible back end keyring storage products. Supported
          KMIP-compatible products include centralized key management
          solutions such as Oracle Key Vault, Gemalto KeySecure, Thales
          Vormetric key management server, and Fornetix Key
          Orchestration.
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        keyring_aws
       </code>
       : Communicates with the Amazon
          Web Services Key Management Service (AWS KMS) as a back end
          for key generation and uses a local file for key storage.
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        keyring_hashicorp
       </code>
       : Communicates with
          HashiCorp Vault for back end storage.
      </p>
     </li>
    </ul>
   </div>
   <div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;">
    <div class="admon-title">
     Warning
    </div>
    <p>
     For encryption key management, the
     <code class="literal">
      component_keyring_file
     </code>
     and
     <code class="literal">
      component_keyring_encrypted_file
     </code>
     components
        are not intended as a regulatory compliance solution. Security
        standards such as PCI, FIPS, and others require use of key
        management systems to secure, manage, and protect encryption
        keys in key vaults or hardware security modules (HSMs).
    </p>
   </div>
   <p>
    A secure and robust encryption key management solution is critical
      for security and for compliance with various security standards.
      When the data-at-rest encryption feature uses a centralized key
      management solution, the feature is referred to as
    <span class="quote">
     “
     <span class="quote">
      MySQL
      Enterprise Transparent Data Encryption (TDE)
     </span>
     ”
    </span>
    .
   </p>
   <p>
    The data-at-rest encryption feature supports the Advanced
      Encryption Standard (AES) block-based encryption algorithm. It
      uses Electronic Codebook (ECB) block encryption mode for
      tablespace key encryption and Cipher Block Chaining (CBC) block
      encryption mode for data encryption.
   </p>
   <p>
    For frequently asked questions about the data-at-rest encryption
      feature, see
    <a class="xref" href="faqs-tablespace-encryption.html" title="A.17 MySQL 8.4 FAQ: InnoDB Data-at-Rest Encryption">
     Section A.17, “MySQL 8.4 FAQ: InnoDB Data-at-Rest Encryption”
    </a>
    .
   </p>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h3 class="title">
       <a name="innodb-data-encryption-encryption-prerequisites">
       </a>
       Encryption Prerequisites
      </h3>
     </div>
    </div>
   </div>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       A keyring component or plugin must be installed and configured
          at startup. Early loading ensures that the component or plugin
          is available prior to initialization of the
       <code class="literal">
        InnoDB
       </code>
       storage engine. For keyring
          installation and configuration instructions, see
       <a class="xref" href="keyring.html" title="8.4.4 The MySQL Keyring">
        Section 8.4.4, “The MySQL Keyring”
       </a>
       . The instructions show how to ensure
          that the chosen component or plugin is active.
      </p>
      <p>
       Only one keyring component or plugin should be enabled at a
          time. Enabling multiple keyring components or plugins is
          unsupported and results may not be as anticipated.
      </p>
      <div class="important" style="margin-left: 0.5in; margin-right: 0.5in;">
       <div class="admon-title">
        Important
       </div>
       <p>
        Once encrypted tablespaces are created in a MySQL instance,
            the keyring component or plugin that was loaded when
            creating the encrypted tablespace must continue to be loaded
            at startup. Failing to do so results in errors when starting
            the server and during
        <code class="literal">
         InnoDB
        </code>
        recovery.
       </p>
      </div>
     </li>
     <li class="listitem">
      <p>
       When encrypting production data, ensure that you take steps to
          prevent loss of the master encryption key.
       <span class="emphasis">
        <em>
         If the
          master encryption key is lost, data stored in encrypted
          tablespace files is unrecoverable.
        </em>
       </span>
       If you use the
       <code class="literal">
        component_keyring_file
       </code>
       or
       <code class="literal">
        component_keyring_encrypted_file
       </code>
       component
          create a backup of the keyring data file immediately after
          creating the first encrypted tablespace, before master key
          rotation, and after master key rotation. For each component,
          its configuration file indicates the data file location. If
          you use the
       <code class="literal">
        keyring_okv
       </code>
       or
       <code class="literal">
        keyring_aws
       </code>
       plugin, ensure that you have
          performed the necessary configuration. For instructions, see
       <a class="xref" href="keyring.html" title="8.4.4 The MySQL Keyring">
        Section 8.4.4, “The MySQL Keyring”
       </a>
       .
      </p>
     </li>
    </ul>
   </div>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h3 class="title">
       <a name="innodb-schema-tablespace-encryption-default">
       </a>
       Defining an Encryption Default for Schemas and General Tablespaces
      </h3>
     </div>
    </div>
   </div>
   <a class="indexterm" name="idm46045159355680">
   </a>
   <p>
    <a class="link" href="server-system-variables.html#sysvar_default_table_encryption">
     <code class="literal">
      default_table_encryption
     </code>
    </a>
    system
      variable defines the default encryption setting for schemas and
      general tablespaces.
    <a class="link" href="create-tablespace.html" title="15.1.21 CREATE TABLESPACE Statement">
     <code class="literal">
      CREATE
      TABLESPACE
     </code>
    </a>
    and
    <a class="link" href="create-database.html" title="15.1.12 CREATE DATABASE Statement">
     <code class="literal">
      CREATE
      SCHEMA
     </code>
    </a>
    operations apply the
    <a class="link" href="server-system-variables.html#sysvar_default_table_encryption">
     <code class="literal">
      default_table_encryption
     </code>
    </a>
    setting
      when an
    <code class="literal">
     ENCRYPTION
    </code>
    clause is not specified
      explicitly.
   </p>
   <p>
    <a class="link" href="alter-database.html" title="15.1.2 ALTER DATABASE Statement">
     <code class="literal">
      ALTER
      SCHEMA
     </code>
    </a>
    and
    <a class="link" href="alter-tablespace.html" title="15.1.10 ALTER TABLESPACE Statement">
     <code class="literal">
      ALTER
      TABLESPACE
     </code>
    </a>
    operations do not apply the
    <a class="link" href="server-system-variables.html#sysvar_default_table_encryption">
     <code class="literal">
      default_table_encryption
     </code>
    </a>
    setting.
      An
    <code class="literal">
     ENCRYPTION
    </code>
    clause must be specified
      explicitly to alter the encryption of an existing schema or
      general tablespace.
   </p>
   <p>
    The
    <a class="link" href="server-system-variables.html#sysvar_default_table_encryption">
     <code class="literal">
      default_table_encryption
     </code>
    </a>
    variable can be set for an individual client connection or
      globally using
    <a class="link" href="set-variable.html" title="15.7.6.1 SET Syntax for Variable Assignment">
     <code class="literal">
      SET
     </code>
    </a>
    syntax. For example, the following statement enables default
      schema and tablespace encryption globally:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa78783373"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">SET</span> <span class="token keyword">GLOBAL</span> default_table_encryption<span class="token operator">=</span><span class="token keyword">ON</span><span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    The default encryption setting for a schema can also be defined
      using the
    <code class="literal">
     DEFAULT ENCRYPTION
    </code>
    clause when
      creating or altering a schema, as in this example:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa11914170"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">CREATE</span> <span class="token keyword">SCHEMA</span> test <span class="token keyword">DEFAULT</span> <span class="token keyword">ENCRYPTION</span> <span class="token operator">=</span> <span class="token string">'Y'</span><span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    If the
    <code class="literal">
     DEFAULT ENCRYPTION
    </code>
    clause is not
      specified when creating a schema, the
    <a class="link" href="server-system-variables.html#sysvar_default_table_encryption">
     <code class="literal">
      default_table_encryption
     </code>
    </a>
    setting
      is applied. The
    <code class="literal">
     DEFAULT ENCRYPTION
    </code>
    clause must
      be specified to alter the default encryption of an existing
      schema. Otherwise, the schema retains its current encryption
      setting.
   </p>
   <p>
    By default, a table inherits the encryption setting of the schema
      or general tablespace it is created in. For example, a table
      created in an encryption-enabled schema is encrypted by default.
      This behavior enables a DBA to control table encryption usage by
      defining and enforcing schema and general tablespace encryption
      defaults.
   </p>
   <p>
    Encryption defaults are enforced by enabling the
    <a class="link" href="server-system-variables.html#sysvar_table_encryption_privilege_check">
     <code class="literal">
      table_encryption_privilege_check
     </code>
    </a>
    system variable. When
    <a class="link" href="server-system-variables.html#sysvar_table_encryption_privilege_check">
     <code class="literal">
      table_encryption_privilege_check
     </code>
    </a>
    is enabled, a privilege check occurs when creating or altering a
      schema or general tablespace with an encryption setting that
      differs from the
    <a class="link" href="server-system-variables.html#sysvar_default_table_encryption">
     <code class="literal">
      default_table_encryption
     </code>
    </a>
    setting,
      or when creating or altering a table with an encryption setting
      that differs from the default schema encryption. When
    <a class="link" href="server-system-variables.html#sysvar_table_encryption_privilege_check">
     <code class="literal">
      table_encryption_privilege_check
     </code>
    </a>
    is disabled (the default), the privilege check does not occur and
      the previously mentioned operations are permitted to proceed with
      a warning.
   </p>
   <p>
    The
    <a class="link" href="privileges-provided.html#priv_table-encryption-admin">
     <code class="literal">
      TABLE_ENCRYPTION_ADMIN
     </code>
    </a>
    privilege is required to override default encryption settings when
    <a class="link" href="server-system-variables.html#sysvar_table_encryption_privilege_check">
     <code class="literal">
      table_encryption_privilege_check
     </code>
    </a>
    is enabled. A DBA can grant this privilege to enable a user to
      deviate from the
    <a class="link" href="server-system-variables.html#sysvar_default_table_encryption">
     <code class="literal">
      default_table_encryption
     </code>
    </a>
    setting
      when creating or altering a schema or general tablespace, or to
      deviate from the default schema encryption when creating or
      altering a table. This privilege does not permit deviating from
      the encryption of a general tablespace when creating or altering a
      table. A table must have the same encryption setting as the
      general tablespace it resides in.
   </p>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h3 class="title">
       <a name="innodb-data-encryption-enabling-disabling">
       </a>
       File-Per-Table Tablespace Encryption
      </h3>
     </div>
    </div>
   </div>
   <p>
    A file-per-table tablespace inherits the default encryption of the
      schema in which the table is created unless an
    <code class="literal">
     ENCRYPTION
    </code>
    clause is specified explicitly in
      the
    <a class="link" href="create-table.html" title="15.1.20 CREATE TABLE Statement">
     <code class="literal">
      CREATE TABLE
     </code>
    </a>
    statement.
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa10778616"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">CREATE</span> <span class="token keyword">TABLE</span> t1 <span class="token punctuation">(</span>c1 <span class="token datatype">INT</span><span class="token punctuation">)</span> <span class="token keyword">ENCRYPTION</span> <span class="token operator">=</span> <span class="token string">'Y'</span><span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    To alter the encryption of an existing file-per-table tablespace,
      an
    <code class="literal">
     ENCRYPTION
    </code>
    clause must be specified.
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa79173968"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">ALTER</span> <span class="token keyword">TABLE</span> t1 <span class="token keyword">ENCRYPTION</span> <span class="token operator">=</span> <span class="token string">'Y'</span><span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    <a class="link" href="server-system-variables.html#sysvar_table_encryption_privilege_check">
     <code class="literal">
      table_encryption_privilege_check
     </code>
    </a>
    is enabled, specifying an
    <code class="literal">
     ENCRYPTION
    </code>
    clause
      with a setting that differs from the default schema encryption
      requires the
    <a class="link" href="privileges-provided.html#priv_table-encryption-admin">
     <code class="literal">
      TABLE_ENCRYPTION_ADMIN
     </code>
    </a>
    privilege. See
    <a class="xref" href="innodb-data-encryption.html#innodb-schema-tablespace-encryption-default" title="Defining an Encryption Default for Schemas and General Tablespaces">
     Defining an Encryption Default for Schemas and General Tablespaces
    </a>
    .
   </p>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h3 class="title">
       <a name="innodb-general-tablespace-encryption-enabling-disabling">
       </a>
       General Tablespace Encryption
      </h3>
     </div>
    </div>
   </div>
   <p>
    The
    <a class="link" href="server-system-variables.html#sysvar_default_table_encryption">
     <code class="literal">
      default_table_encryption
     </code>
    </a>
    variable determines the encryption of a newly created general
      tablespace unless an
    <code class="literal">
     ENCRYPTION
    </code>
    clause is
      specified explicitly in the
    <a class="link" href="create-tablespace.html" title="15.1.21 CREATE TABLESPACE Statement">
     <code class="literal">
      CREATE
      TABLESPACE
     </code>
    </a>
    statement.
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa65627116"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">CREATE</span> <span class="token keyword">TABLESPACE</span> <span class="token punctuation">`</span>ts1<span class="token punctuation">`</span> <span class="token keyword">ADD</span> <span class="token keyword">DATAFILE</span> <span class="token string">'ts1.ibd'</span> <span class="token keyword">ENCRYPTION</span> <span class="token operator">=</span> <span class="token string">'Y'</span> <span class="token keyword">Engine</span><span class="token operator">=</span>InnoDB<span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    To alter the encryption of an existing general tablespace, an
    <code class="literal">
     ENCRYPTION
    </code>
    clause must be specified.
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa86187467"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">ALTER</span> <span class="token keyword">TABLESPACE</span> ts1 <span class="token keyword">ENCRYPTION</span> <span class="token operator">=</span> <span class="token string">'Y'</span><span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    If
    <a class="link" href="server-system-variables.html#sysvar_table_encryption_privilege_check">
     <code class="literal">
      table_encryption_privilege_check
     </code>
    </a>
    is enabled, specifying an
    <code class="literal">
     ENCRYPTION
    </code>
    clause
      with a setting that differs from the
    <a class="link" href="server-system-variables.html#sysvar_default_table_encryption">
     <code class="literal">
      default_table_encryption
     </code>
    </a>
    setting
      requires the
    <a class="link" href="privileges-provided.html#priv_table-encryption-admin">
     <code class="literal">
      TABLE_ENCRYPTION_ADMIN
     </code>
    </a>
    privilege. See
    <a class="xref" href="innodb-data-encryption.html#innodb-schema-tablespace-encryption-default" title="Defining an Encryption Default for Schemas and General Tablespaces">
     Defining an Encryption Default for Schemas and General Tablespaces
    </a>
    .
   </p>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h3 class="title">
       <a name="innodb-doublewrite-file-encryption">
       </a>
       Doublewrite File Encryption
      </h3>
     </div>
    </div>
   </div>
   <p>
    In MySQL 8.4,
    <code class="literal">
     InnoDB
    </code>
    automatically
      encrypts doublewrite file pages that belong to encrypted
      tablespaces. No action is required. Doublewrite file pages are
      encrypted using the encryption key of the associated tablespace.
      The same encrypted page written to a tablespace data file is also
      written to a doublewrite file. Doublewrite file pages that belong
      to an unencrypted tablespace remain unencrypted.
   </p>
   <p>
    During recovery, encrypted doublewrite file pages are unencrypted
      and checked for corruption.
   </p>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h3 class="title">
       <a name="innodb-mysql-tablespace-encryption-enabling-disabling">
       </a>
       mysql System Tablespace Encryption
      </h3>
     </div>
    </div>
   </div>
   <p>
    The
    <code class="literal">
     mysql
    </code>
    system tablespace contains the
    <code class="literal">
     mysql
    </code>
    system database and MySQL data dictionary
      tables. It is unencrypted by default. To enable encryption for the
    <code class="literal">
     mysql
    </code>
    system tablespace, specify the tablespace
      name and the
    <code class="literal">
     ENCRYPTION
    </code>
    option in an
    <a class="link" href="alter-tablespace.html" title="15.1.10 ALTER TABLESPACE Statement">
     <code class="literal">
      ALTER TABLESPACE
     </code>
    </a>
    statement.
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa4952043"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">ALTER</span> <span class="token keyword">TABLESPACE</span> mysql <span class="token keyword">ENCRYPTION</span> <span class="token operator">=</span> <span class="token string">'Y'</span><span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    To disable encryption for the
    <code class="literal">
     mysql
    </code>
    system
      tablespace, set
    <code class="literal">
     ENCRYPTION = 'N'
    </code>
    using an
    <a class="link" href="alter-tablespace.html" title="15.1.10 ALTER TABLESPACE Statement">
     <code class="literal">
      ALTER TABLESPACE
     </code>
    </a>
    statement.
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa79180576"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">ALTER</span> <span class="token keyword">TABLESPACE</span> mysql <span class="token keyword">ENCRYPTION</span> <span class="token operator">=</span> <span class="token string">'N'</span><span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    Enabling or disabling encryption for the
    <code class="literal">
     mysql
    </code>
    system tablespace requires the
    <a class="link" href="privileges-provided.html#priv_create-tablespace">
     <code class="literal">
      CREATE
      TABLESPACE
     </code>
    </a>
    privilege on all tables in the instance
      (
    <code class="literal">
     CREATE TABLESPACE on *.*)
    </code>
    .
   </p>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h3 class="title">
       <a name="innodb-data-encryption-redo-log">
       </a>
       Redo Log Encryption
      </h3>
     </div>
    </div>
   </div>
   <p>
    Redo log data encryption is enabled using the
    <a class="link" href="innodb-parameters.html#sysvar_innodb_redo_log_encrypt">
     <code class="literal">
      innodb_redo_log_encrypt
     </code>
    </a>
    configuration option. Redo log encryption is disabled by default.
   </p>
   <p>
    As with tablespace data, redo log data encryption occurs when redo
      log data is written to disk, and decryption occurs when redo log
      data is read from disk. Once redo log data is read into memory, it
      is in unencrypted form. Redo log data is encrypted and decrypted
      using the tablespace encryption key.
   </p>
   <p>
    When
    <a class="link" href="innodb-parameters.html#sysvar_innodb_redo_log_encrypt">
     <code class="literal">
      innodb_redo_log_encrypt
     </code>
    </a>
    is
      enabled, unencrypted redo log pages that are present on disk
      remain unencrypted, and new redo log pages are written to disk in
      encrypted form. Likewise, when
    <a class="link" href="innodb-parameters.html#sysvar_innodb_redo_log_encrypt">
     <code class="literal">
      innodb_redo_log_encrypt
     </code>
    </a>
    is
      disabled, encrypted redo log pages that are present on disk remain
      encrypted, and new redo log pages are written to disk in
      unencrypted form.
   </p>
   <p>
    Redo log encryption metadata, including the tablespace encryption
      key, is stored in the header of the redo log file with the most
      recent checkpoint LSN. If the redo log file with the encryption
      metadata is removed, redo log encryption is disabled.
   </p>
   <p>
    Once redo log encryption is enabled, a normal restart without the
      keyring component or plugin or without the encryption key is not
      possible, as
    <code class="literal">
     InnoDB
    </code>
    must be able to scan redo
      pages during startup, which is not possible if redo log pages are
      encrypted. Without the keyring component or plugin or the
      encryption key, only a forced startup without the redo logs
      (
    <code class="literal">
     SRV_FORCE_NO_LOG_REDO
    </code>
    ) is possible. See
    <a class="xref" href="forcing-innodb-recovery.html" title="17.20.3 Forcing InnoDB Recovery">
     Section 17.20.3, “Forcing InnoDB Recovery”
    </a>
    .
   </p>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h3 class="title">
       <a name="innodb-data-encryption-undo-log">
       </a>
       Undo Log Encryption
      </h3>
     </div>
    </div>
   </div>
   <p>
    Undo log data encryption is enabled using the
    <a class="link" href="innodb-parameters.html#sysvar_innodb_undo_log_encrypt">
     <code class="literal">
      innodb_undo_log_encrypt
     </code>
    </a>
    configuration option. Undo log encryption applies to undo logs
      that reside in
    <a class="link" href="glossary.html#glos_undo_tablespace" title="undo tablespace">
     undo
      tablespaces
    </a>
    . See
    <a class="xref" href="innodb-undo-tablespaces.html" title="17.6.3.4 Undo Tablespaces">
     Section 17.6.3.4, “Undo Tablespaces”
    </a>
    .
      Undo log data encryption is disabled by default.
   </p>
   <p>
    As with tablespace data, undo log data encryption occurs when undo
      log data is written to disk, and decryption occurs when undo log
      data is read from disk. Once undo log data is read into memory, it
      is in unencrypted form. Undo log data is encrypted and decrypted
      using the tablespace encryption key.
   </p>
   <p>
    When
    <a class="link" href="innodb-parameters.html#sysvar_innodb_undo_log_encrypt">
     <code class="literal">
      innodb_undo_log_encrypt
     </code>
    </a>
    is
      enabled, unencrypted undo log pages that are present on disk
      remain unencrypted, and new undo log pages are written to disk in
      encrypted form. Likewise, when
    <a class="link" href="innodb-parameters.html#sysvar_innodb_undo_log_encrypt">
     <code class="literal">
      innodb_undo_log_encrypt
     </code>
    </a>
    is
      disabled, encrypted undo log pages that are present on disk remain
      encrypted, and new undo log pages are written to disk in
      unencrypted form.
   </p>
   <p>
    Undo log encryption metadata, including the tablespace encryption
      key, is stored in the header of the undo log file.
   </p>
   <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
    <div class="admon-title">
     Note
    </div>
    <p>
     When undo log encryption is disabled, the server continues to
        require the keyring component or plugin that was used to encrypt
        undo log data until the undo tablespaces that contained the
        encrypted undo log data are truncated. (An encryption header is
        only removed from an undo tablespace when the undo tablespace is
        truncated.) For information about truncating undo tablespaces,
        see
     <a class="xref" href="innodb-undo-tablespaces.html#truncate-undo-tablespace" title="Truncating Undo Tablespaces">
      Truncating Undo Tablespaces
     </a>
     .
    </p>
   </div>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h3 class="title">
       <a name="innodb-data-encryption-master-key-rotation">
       </a>
       Master Key Rotation
      </h3>
     </div>
    </div>
   </div>
   <p>
    The master encryption key should be rotated periodically and
      whenever you suspect that the key has been compromised.
   </p>
   <p>
    Master key rotation is an atomic, instance-level operation. Each
      time the master encryption key is rotated, all tablespace keys in
      the MySQL instance are re-encrypted and saved back to their
      respective tablespace headers. As an atomic operation,
      re-encryption must succeed for all tablespace keys once a rotation
      operation is initiated. If master key rotation is interrupted by a
      server failure,
    <code class="literal">
     InnoDB
    </code>
    rolls the operation
      forward on server restart. For more information, see
    <a class="xref" href="innodb-data-encryption.html#innodb-data-encryption-recovery" title="Encryption and Recovery">
     Encryption and Recovery
    </a>
    .
   </p>
   <p>
    Rotating the master encryption key only changes the master
      encryption key and re-encrypts tablespace keys. It does not
      decrypt or re-encrypt associated tablespace data.
   </p>
   <p>
    Rotating the master encryption key requires the
    <a class="link" href="privileges-provided.html#priv_encryption-key-admin">
     <code class="literal">
      ENCRYPTION_KEY_ADMIN
     </code>
    </a>
    privilege (or
      the deprecated
    <a class="link" href="privileges-provided.html#priv_super">
     <code class="literal">
      SUPER
     </code>
    </a>
    privilege).
   </p>
   <p>
    To rotate the master encryption key, run:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa99196688"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">ALTER</span> <span class="token keyword">INSTANCE</span> <span class="token keyword">ROTATE</span> INNODB <span class="token keyword">MASTER</span> <span class="token keyword">KEY</span><span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    <a class="link" href="alter-instance.html#alter-instance-rotate-innodb-master-key">
     <code class="literal">
      ALTER INSTANCE ROTATE INNODB MASTER
      KEY
     </code>
    </a>
    supports concurrent DML. However, it cannot be run
      concurrently with tablespace encryption operations, and locks are
      taken to prevent conflicts that could arise from concurrent
      execution. If an
    <a class="link" href="alter-instance.html#alter-instance-rotate-innodb-master-key">
     <code class="literal">
      ALTER INSTANCE ROTATE INNODB
      MASTER KEY
     </code>
    </a>
    operation is running, it must finish before a
      tablespace encryption operation can proceed, and vice versa.
   </p>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h3 class="title">
       <a name="innodb-data-encryption-recovery">
       </a>
       Encryption and Recovery
      </h3>
     </div>
    </div>
   </div>
   <p>
    If a server failure occurs during an encryption operation, the
      operation is rolled forward when the server is restarted. For
      general tablespaces, the encryption operation is resumed in a
      background thread from the last processed page.
   </p>
   <p>
    If a server failure occurs during master key rotation,
    <code class="literal">
     InnoDB
    </code>
    continues the operation on server
      restart.
   </p>
   <p>
    The keyring component or plugin must be loaded prior to storage
      engine initialization so that the information necessary to decrypt
      tablespace data pages can be retrieved from tablespace headers
      before
    <code class="literal">
     InnoDB
    </code>
    initialization and recovery
      activities access tablespace data. (See
    <a class="xref" href="innodb-data-encryption.html#innodb-data-encryption-encryption-prerequisites" title="Encryption Prerequisites">
     Encryption Prerequisites
    </a>
    .)
   </p>
   <p>
    When
    <code class="literal">
     InnoDB
    </code>
    initialization and recovery begin,
      the master key rotation operation resumes. Due to the server
      failure, some tablespace keys may already be encrypted using the
      new master encryption key.
    <code class="literal">
     InnoDB
    </code>
    reads the
      encryption data from each tablespace header, and if the data
      indicates that the tablespace key is encrypted using the old
      master encryption key,
    <code class="literal">
     InnoDB
    </code>
    retrieves the old
      key from the keyring and uses it to decrypt the tablespace key.
    <code class="literal">
     InnoDB
    </code>
    then re-encrypts the tablespace key
      using the new master encryption key and saves the re-encrypted
      tablespace key back to the tablespace header.
   </p>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h3 class="title">
       <a name="innodb-data-encryption-exporting">
       </a>
       Exporting Encrypted Tablespaces
      </h3>
     </div>
    </div>
   </div>
   <p>
    Tablespace export is only supported for file-per-table
      tablespaces.
   </p>
   <p>
    When an encrypted tablespace is exported,
    <code class="literal">
     InnoDB
    </code>
    generates a
    <span class="emphasis">
     <em>
      transfer
      key
     </em>
    </span>
    that is used to encrypt the tablespace key. The
      encrypted tablespace key and transfer key are stored in a
    <code class="filename">
     <em class="replaceable">
      <code>
       tablespace_name
      </code>
     </em>
     .cfp
    </code>
    file. This file together with the encrypted tablespace file is
      required to perform an import operation. On import,
    <code class="literal">
     InnoDB
    </code>
    uses the transfer key to decrypt the
      tablespace key in the
    <code class="filename">
     <em class="replaceable">
      <code>
       tablespace_name
      </code>
     </em>
     .cfp
    </code>
    file. For related information, see
    <a class="xref" href="innodb-table-import.html" title="17.6.1.3 Importing InnoDB Tables">
     Section 17.6.1.3, “Importing InnoDB Tables”
    </a>
    .
   </p>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h3 class="title">
       <a name="innodb-data-encryption-replication">
       </a>
       Encryption and Replication
      </h3>
     </div>
    </div>
   </div>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       The
       <a class="link" href="alter-instance.html#alter-instance-rotate-innodb-master-key">
        <code class="literal">
         ALTER INSTANCE ROTATE INNODB MASTER
          KEY
        </code>
       </a>
       statement is only supported in replication
          environments where the source and replica run a version of
          MySQL that supports tablespace encryption.
      </p>
     </li>
     <li class="listitem">
      <p>
       Successful
       <a class="link" href="alter-instance.html#alter-instance-rotate-innodb-master-key">
        <code class="literal">
         ALTER INSTANCE ROTATE INNODB
          MASTER KEY
        </code>
       </a>
       statements are written to the binary log
          for replication on replicas.
      </p>
     </li>
     <li class="listitem">
      <p>
       If an
       <a class="link" href="alter-instance.html#alter-instance-rotate-innodb-master-key">
        <code class="literal">
         ALTER INSTANCE ROTATE INNODB MASTER
          KEY
        </code>
       </a>
       statement fails, it is not logged to the binary
          log and is not replicated on replicas.
      </p>
     </li>
     <li class="listitem">
      <p>
       Replication of an
       <a class="link" href="alter-instance.html#alter-instance-rotate-innodb-master-key">
        <code class="literal">
         ALTER INSTANCE ROTATE
          INNODB MASTER KEY
        </code>
       </a>
       operation fails if the keyring
          component or plugin is installed on the source but not on the
          replica.
      </p>
     </li>
    </ul>
   </div>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h3 class="title">
       <a name="innodb-data-encryption-identifying">
       </a>
       Identifying Encrypted Tablespaces and Schemas
      </h3>
     </div>
    </div>
   </div>
   <p>
    The Information Schema
    <a class="link" href="information-schema-innodb-tablespaces-table.html" title="28.4.24 The INFORMATION_SCHEMA INNODB_TABLESPACES Table">
     <code class="literal">
      INNODB_TABLESPACES
     </code>
    </a>
    table includes an
    <code class="literal">
     ENCRYPTION
    </code>
    column that can be used to identify
      encrypted tablespaces.
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa97616289"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">SELECT</span> SPACE<span class="token punctuation">,</span> <span class="token keyword">NAME</span><span class="token punctuation">,</span> SPACE_TYPE<span class="token punctuation">,</span> <span class="token keyword">ENCRYPTION</span> <span class="token keyword">FROM</span> INFORMATION_SCHEMA<span class="token punctuation">.</span>INNODB_TABLESPACES
       <span class="token keyword">WHERE</span> <span class="token keyword">ENCRYPTION</span><span class="token operator">=</span><span class="token string">'Y'</span>\G
<span class="token output"><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span> 1. row <span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span>
     SPACE<span class="token punctuation">:</span> 4294967294
      NAME<span class="token punctuation">:</span> mysql
SPACE_TYPE<span class="token punctuation">:</span> General
ENCRYPTION<span class="token punctuation">:</span> Y
<span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span> 2. row <span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span>
     SPACE<span class="token punctuation">:</span> 2
      NAME<span class="token punctuation">:</span> test/t1
SPACE_TYPE<span class="token punctuation">:</span> Single
ENCRYPTION<span class="token punctuation">:</span> Y
<span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span> 3. row <span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span>
     SPACE<span class="token punctuation">:</span> 3
      NAME<span class="token punctuation">:</span> ts1
SPACE_TYPE<span class="token punctuation">:</span> General
ENCRYPTION<span class="token punctuation">:</span> Y</span></code></pre>
   </div>
   <p>
    When the
    <code class="literal">
     ENCRYPTION
    </code>
    option is specified in a
    <a class="link" href="create-table.html" title="15.1.20 CREATE TABLE Statement">
     <code class="literal">
      CREATE TABLE
     </code>
    </a>
    or
    <a class="link" href="alter-table.html" title="15.1.9 ALTER TABLE Statement">
     <code class="literal">
      ALTER TABLE
     </code>
    </a>
    statement, it is
      recorded in the
    <code class="literal">
     CREATE_OPTIONS
    </code>
    column of
    <a class="link" href="information-schema-tables-table.html" title="28.3.38 The INFORMATION_SCHEMA TABLES Table">
     <code class="literal">
      INFORMATION_SCHEMA.TABLES
     </code>
    </a>
    . This
      column can be queried to identify tables that reside in encrypted
      file-per-table tablespaces.
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa17443659"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">SELECT</span> TABLE_SCHEMA<span class="token punctuation">,</span> <span class="token keyword">TABLE_NAME</span><span class="token punctuation">,</span> CREATE_OPTIONS <span class="token keyword">FROM</span> INFORMATION_SCHEMA<span class="token punctuation">.</span><span class="token keyword">TABLES</span>
       <span class="token keyword">WHERE</span> CREATE_OPTIONS <span class="token operator">LIKE</span> <span class="token string">'%ENCRYPTION%'</span><span class="token punctuation">;</span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> TABLE_SCHEMA <span class="token punctuation">|</span> TABLE_NAME <span class="token punctuation">|</span> CREATE_OPTIONS <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> test         <span class="token punctuation">|</span> t1         <span class="token punctuation">|</span> ENCRYPTION="Y" <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span></code></pre>
   </div>
   <p>
    Query the Information Schema
    <a class="link" href="information-schema-innodb-tablespaces-table.html" title="28.4.24 The INFORMATION_SCHEMA INNODB_TABLESPACES Table">
     <code class="literal">
      INNODB_TABLESPACES
     </code>
    </a>
    table to retrieve
      information about the tablespace associated with a particular
      schema and table.
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa25065716"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">SELECT</span> SPACE<span class="token punctuation">,</span> <span class="token keyword">NAME</span><span class="token punctuation">,</span> SPACE_TYPE <span class="token keyword">FROM</span> INFORMATION_SCHEMA<span class="token punctuation">.</span>INNODB_TABLESPACES <span class="token keyword">WHERE</span> <span class="token keyword">NAME</span><span class="token operator">=</span><span class="token string">'test/t1'</span><span class="token punctuation">;</span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> SPACE <span class="token punctuation">|</span> NAME    <span class="token punctuation">|</span> SPACE_TYPE <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span>     3 <span class="token punctuation">|</span> test/t1 <span class="token punctuation">|</span> Single     <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span></code></pre>
   </div>
   <p>
    You can identify encryption-enabled schemas by querying the
      Information Schema
    <a class="link" href="information-schema-schemata-table.html" title="28.3.31 The INFORMATION_SCHEMA SCHEMATA Table">
     <code class="literal">
      SCHEMATA
     </code>
    </a>
    table.
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa69909464"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">SELECT</span> <span class="token keyword">SCHEMA_NAME</span><span class="token punctuation">,</span> DEFAULT_ENCRYPTION <span class="token keyword">FROM</span> INFORMATION_SCHEMA<span class="token punctuation">.</span>SCHEMATA
       <span class="token keyword">WHERE</span> DEFAULT_ENCRYPTION<span class="token operator">=</span><span class="token string">'YES'</span><span class="token punctuation">;</span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> SCHEMA_NAME <span class="token punctuation">|</span> DEFAULT_ENCRYPTION <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> test        <span class="token punctuation">|</span> YES                <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span></code></pre>
   </div>
   <p>
    <a class="link" href="show-create-database.html" title="15.7.7.7 SHOW CREATE DATABASE Statement">
     <code class="literal">
      SHOW CREATE
      SCHEMA
     </code>
    </a>
    also shows the
    <code class="literal">
     DEFAULT
      ENCRYPTION
    </code>
    clause.
   </p>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h3 class="title">
       <a name="innodb-data-encryption-progress-monitoring">
       </a>
       Monitoring Encryption Progress
      </h3>
     </div>
    </div>
   </div>
   <a class="indexterm" name="idm46045159187872">
   </a>
   <a class="indexterm" name="idm46045159186384">
   </a>
   <p>
    You can monitor general tablespace and
    <code class="literal">
     mysql
    </code>
    system tablespace encryption progress using
    <a class="link" href="performance-schema.html" title="Chapter 29 MySQL Performance Schema">
     Performance Schema
    </a>
    .
   </p>
   <p>
    The
    <code class="literal">
     stage/innodb/alter tablespace (encryption)
    </code>
    stage event instrument reports
    <code class="literal">
     WORK_ESTIMATED
    </code>
    and
    <code class="literal">
     WORK_COMPLETED
    </code>
    information for general
      tablespace encryption operations.
   </p>
   <p>
    The following example demonstrates how to enable the
    <code class="literal">
     stage/innodb/alter tablespace (encryption)
    </code>
    stage event instrument and related consumer tables to monitor
      general tablespace or
    <code class="literal">
     mysql
    </code>
    system tablespace
      encryption progress. For information about Performance Schema
      stage event instruments and related consumers, see
    <a class="xref" href="performance-schema-stage-tables.html" title="29.12.5 Performance Schema Stage Event Tables">
     Section 29.12.5, “Performance Schema Stage Event Tables”
    </a>
    .
   </p>
   <div class="orderedlist">
    <ol class="orderedlist" type="1">
     <li class="listitem">
      <p>
       Enable the
       <code class="literal">
        stage/innodb/alter tablespace
          (encryption)
       </code>
       instrument:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa21068893"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">USE</span> performance_schema<span class="token punctuation">;</span>
<span class="token prompt">mysql&gt;</span> <span class="token keyword">UPDATE</span> setup_instruments <span class="token keyword">SET</span> ENABLED <span class="token operator">=</span> <span class="token string">'YES'</span>
       <span class="token keyword">WHERE</span> <span class="token keyword">NAME</span> <span class="token operator">LIKE</span> <span class="token string">'stage/innodb/alter tablespace (encryption)'</span><span class="token punctuation">;</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       Enable the stage event consumer tables, which include
       <a class="link" href="performance-schema-events-stages-current-table.html" title="29.12.5.1 The events_stages_current Table">
        <code class="literal">
         events_stages_current
        </code>
       </a>
       ,
       <a class="link" href="performance-schema-events-stages-history-table.html" title="29.12.5.2 The events_stages_history Table">
        <code class="literal">
         events_stages_history
        </code>
       </a>
       , and
       <a class="link" href="performance-schema-events-stages-history-long-table.html" title="29.12.5.3 The events_stages_history_long Table">
        <code class="literal">
         events_stages_history_long
        </code>
       </a>
       .
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa10948058"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">UPDATE</span> setup_consumers <span class="token keyword">SET</span> ENABLED <span class="token operator">=</span> <span class="token string">'YES'</span> <span class="token keyword">WHERE</span> <span class="token keyword">NAME</span> <span class="token operator">LIKE</span> <span class="token string">'%stages%'</span><span class="token punctuation">;</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       Run a tablespace encryption operation. In this example, a
          general tablespace named
       <code class="literal">
        ts1
       </code>
       is encrypted.
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa68417008"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">ALTER</span> <span class="token keyword">TABLESPACE</span> ts1 <span class="token keyword">ENCRYPTION</span> <span class="token operator">=</span> <span class="token string">'Y'</span><span class="token punctuation">;</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       Check the progress of the encryption operation by querying the
          Performance Schema
       <a class="link" href="performance-schema-events-stages-current-table.html" title="29.12.5.1 The events_stages_current Table">
        <code class="literal">
         events_stages_current
        </code>
       </a>
       table.
       <code class="literal">
        WORK_ESTIMATED
       </code>
       reports the total number of
          pages in the tablespace.
       <code class="literal">
        WORK_COMPLETED
       </code>
       reports the number of pages processed.
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa96885494"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">SELECT</span> EVENT_NAME<span class="token punctuation">,</span> WORK_ESTIMATED<span class="token punctuation">,</span> WORK_COMPLETED <span class="token keyword">FROM</span> events_stages_current<span class="token punctuation">;</span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> EVENT_NAME                                 <span class="token punctuation">|</span> WORK_COMPLETED <span class="token punctuation">|</span> WORK_ESTIMATED <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> stage/innodb/alter tablespace (encryption) <span class="token punctuation">|</span>           1056 <span class="token punctuation">|</span>           1407 <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span></code></pre>
      </div>
      <p>
       The
       <a class="link" href="performance-schema-events-stages-current-table.html" title="29.12.5.1 The events_stages_current Table">
        <code class="literal">
         events_stages_current
        </code>
       </a>
       table
          returns an empty set if the encryption operation has
          completed. In this case, you can check the
       <a class="link" href="performance-schema-events-stages-history-table.html" title="29.12.5.2 The events_stages_history Table">
        <code class="literal">
         events_stages_history
        </code>
       </a>
       table to
          view event data for the completed operation. For example:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa89846846"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">SELECT</span> EVENT_NAME<span class="token punctuation">,</span> WORK_COMPLETED<span class="token punctuation">,</span> WORK_ESTIMATED <span class="token keyword">FROM</span> events_stages_history<span class="token punctuation">;</span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> EVENT_NAME                                 <span class="token punctuation">|</span> WORK_COMPLETED <span class="token punctuation">|</span> WORK_ESTIMATED <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> stage/innodb/alter tablespace (encryption) <span class="token punctuation">|</span>           1407 <span class="token punctuation">|</span>           1407 <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span></code></pre>
      </div>
     </li>
    </ol>
   </div>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h3 class="title">
       <a name="innodb-data-encryption-usage-notes">
       </a>
       Encryption Usage Notes
      </h3>
     </div>
    </div>
   </div>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       Plan appropriately when altering an existing file-per-table
          tablespace with the
       <code class="literal">
        ENCRYPTION
       </code>
       option.
          Tables residing in file-per-table tablespaces are rebuilt
          using the
       <code class="literal">
        COPY
       </code>
       algorithm. The
       <code class="literal">
        INPLACE
       </code>
       algorithm is used when altering the
       <code class="literal">
        ENCRYPTION
       </code>
       attribute of a general
          tablespace or the
       <code class="literal">
        mysql
       </code>
       system tablespace.
          The
       <code class="literal">
        INPLACE
       </code>
       algorithm permits concurrent
          DML on tables that reside in the general tablespace.
          Concurrent DDL is blocked.
      </p>
     </li>
     <li class="listitem">
      <p>
       When a general tablespace or the
       <code class="literal">
        mysql
       </code>
       system tablespace is encrypted, all tables residing in the
          tablespace are encrypted. Likewise, a table created in an
          encrypted tablespace is encrypted.
      </p>
     </li>
     <li class="listitem">
      <p>
       If the server exits or is stopped during normal operation, it
          is recommended to restart the server using the same encryption
          settings that were configured previously.
      </p>
     </li>
     <li class="listitem">
      <p>
       The first master encryption key is generated when the first
          new or existing tablespace is encrypted.
      </p>
     </li>
     <li class="listitem">
      <p>
       Master key rotation re-encrypts tablespaces keys but does not
          change the tablespace key itself. To change a tablespace key,
          you must disable and re-enable encryption. For file-per-table
          tablespaces, re-encrypting the tablespace is an
       <code class="literal">
        ALGORITHM=COPY
       </code>
       operation that rebuilds the
          table. For general tablespaces and the
       <code class="literal">
        mysql
       </code>
       system tablespace, it is an
       <code class="literal">
        ALGORITHM=INPLACE
       </code>
       operation, which does not
          require rebuilding tables that reside in the tablespace.
      </p>
     </li>
     <li class="listitem">
      <p>
       If a table is created with both the
       <a class="link" href="create-table.html" title="15.1.20 CREATE TABLE Statement">
        <code class="literal">
         COMPRESSION
        </code>
       </a>
       and
       <a class="link" href="create-table.html" title="15.1.20 CREATE TABLE Statement">
        <code class="literal">
         ENCRYPTION
        </code>
       </a>
       options, compression is performed before tablespace data is
          encrypted.
      </p>
     </li>
     <li class="listitem">
      <p>
       Uninstalling the
       <code class="literal">
        component_keyring_file
       </code>
       or
       <code class="literal">
        component_keyring_encrypted_file
       </code>
       component
          does not remove an existing keyring data file.
      </p>
     </li>
     <li class="listitem">
      <p>
       It is recommended that you not place a keyring data file under
          the same directory as tablespace data files.
      </p>
     </li>
     <li class="listitem">
      <p>
       Encryption is supported for the
       <code class="literal">
        InnoDB
       </code>
       <code class="literal">
        FULLTEXT
       </code>
       index tables that are created
          implicitly when adding a
       <code class="literal">
        FULLTEXT
       </code>
       index.
          For related information, see
       <a class="xref" href="innodb-fulltext-index.html#innodb-fulltext-index-tables" title="InnoDB Full-Text Index Tables">
        InnoDB Full-Text Index Tables
       </a>
       .
      </p>
     </li>
    </ul>
   </div>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h3 class="title">
       <a name="innodb-data-encryption-limitations">
       </a>
       Encryption Limitations
      </h3>
     </div>
    </div>
   </div>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       Advanced Encryption Standard (AES) is the only supported
          encryption algorithm.
       <code class="literal">
        InnoDB
       </code>
       tablespace
          encryption uses Electronic Codebook (ECB) block encryption
          mode for tablespace key encryption and Cipher Block Chaining
          (CBC) block encryption mode for data encryption. Padding is
          not used with CBC block encryption mode. Instead,
       <code class="literal">
        InnoDB
       </code>
       ensures that the text to be
          encrypted is a multiple of the block size.
      </p>
     </li>
     <li class="listitem">
      <p>
       Encryption is supported only for
       <a class="link" href="glossary.html#glos_file_per_table" title="file-per-table">
        file-per-table
       </a>
       tablespaces,
       <a class="link" href="glossary.html#glos_general_tablespace" title="general tablespace">
        general
       </a>
       tablespaces, and the
       <code class="literal">
        mysql
       </code>
       system
          tablespace. Encryption is not supported for other tablespace
          types including the
       <code class="literal">
        InnoDB
       </code>
       <a class="link" href="glossary.html#glos_system_tablespace" title="system tablespace">
        system
          tablespace
       </a>
       .
      </p>
     </li>
     <li class="listitem">
      <p>
       You cannot move or copy a table from an encrypted
       <a class="link" href="glossary.html#glos_file_per_table" title="file-per-table">
        file-per-table
       </a>
       tablespace,
       <a class="link" href="glossary.html#glos_general_tablespace" title="general tablespace">
        general
       </a>
       tablespace, or the
       <code class="literal">
        mysql
       </code>
       system tablespace
          to a tablespace type that does not support encryption.
      </p>
     </li>
     <li class="listitem">
      <p>
       You cannot move or copy a table from an encrypted tablespace
          to an unencrypted tablespace. However, moving a table from an
          unencrypted tablespace to an encrypted one is permitted. For
          example, you can move or copy a table from a unencrypted
       <a class="link" href="glossary.html#glos_file_per_table" title="file-per-table">
        file-per-table
       </a>
       or
       <a class="link" href="glossary.html#glos_general_tablespace" title="general tablespace">
        general
       </a>
       tablespace to an encrypted general tablespace.
      </p>
     </li>
     <li class="listitem">
      <p>
       By default, tablespace encryption only applies to data in the
          tablespace. Redo log and undo log data can be encrypted by
          enabling
       <a class="link" href="innodb-parameters.html#sysvar_innodb_redo_log_encrypt">
        <code class="literal">
         innodb_redo_log_encrypt
        </code>
       </a>
       and
       <a class="link" href="innodb-parameters.html#sysvar_innodb_undo_log_encrypt">
        <code class="literal">
         innodb_undo_log_encrypt
        </code>
       </a>
       . See
       <a class="xref" href="innodb-data-encryption.html#innodb-data-encryption-redo-log" title="Redo Log Encryption">
        Redo Log Encryption
       </a>
       , and
       <a class="xref" href="innodb-data-encryption.html#innodb-data-encryption-undo-log" title="Undo Log Encryption">
        Undo Log Encryption
       </a>
       . For
          information about binary log file and relay log file
          encryption, see
       <a class="xref" href="replication-binlog-encryption.html" title="19.3.2 Encrypting Binary Log Files and Relay Log Files">
        Section 19.3.2, “Encrypting Binary Log Files and Relay Log Files”
       </a>
       .
      </p>
     </li>
     <li class="listitem">
      <p>
       It is not permitted to change the storage engine of a table
          that resides in, or previously resided in, an encrypted
          tablespace.
      </p>
     </li>
    </ul>
   </div>
  </div>
 </div>
 <br/>
</div>
