<div id="docs-body">
 <div class="section">
  <div class="titlepage">
   <div>
    <div>
     <h4 class="title">
      <a name="replication-binlog-encryption-encryption-keys">
      </a>
      19.3.2.2 Binary Log Encryption Keys
     </h4>
    </div>
   </div>
  </div>
  <p>
   The binary log encryption keys used to encrypt the file
        passwords for the log files are 256-bit keys that are generated
        specifically for each MySQL server instance using MySQL Server's
        keyring service (see
   <a class="xref" href="keyring.html" title="8.4.4 The MySQL Keyring">
    Section 8.4.4, “The MySQL Keyring”
   </a>
   ). The keyring
        service handles the creation, retrieval, and deletion of the
        binary log encryption keys. A server instance only creates and
        removes keys generated for itself, but it can read keys
        generated for other instances if they are stored in the keyring,
        as in the case of a server instance that has been cloned by file
        copying.
  </p>
  <div class="important" style="margin-left: 0.5in; margin-right: 0.5in;">
   <div class="admon-title">
    Important
   </div>
   <p>
    The binary log encryption keys for a MySQL server instance
          must be included in your backup and recovery procedures,
          because if the keys required to decrypt the file passwords for
          current and retained binary log files or relay log files are
          lost, it might not be possible to start the server.
   </p>
  </div>
  <p>
   The format of binary log encryption keys in the keyring is as
        follows:
  </p>
  <div class="copytoclipboard-wrapper">
   <pre class="programlisting one-line language-simple"><div class="docs-select-all right" id="sa91417414"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-simple">MySQLReplicationKey_<span class="token punctuation">{</span>UUID<span class="token punctuation">}</span>_<span class="token punctuation">{</span>SEQ_NO<span class="token punctuation">}</span></code></pre>
  </div>
  <p>
   For example:
  </p>
  <div class="copytoclipboard-wrapper">
   <pre class="programlisting one-line language-simple"><div class="docs-select-all right" id="sa62654577"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-simple">MySQLReplicationKey_00508583<span class="token operator">-</span>b5ce<span class="token operator">-</span>11e8<span class="token operator">-</span>a6a5<span class="token operator">-</span>0010e0734796_1</code></pre>
  </div>
  <p>
   <code class="literal">
    {UUID}
   </code>
   is the true UUID generated by the
        MySQL server (the value of the
   <a class="link" href="replication-options.html#sysvar_server_uuid">
    <code class="literal">
     server_uuid
    </code>
   </a>
   system variable).
   <code class="literal">
    {SEQ_NO}
   </code>
   is the sequence number for the
        binary log encryption key, which is incremented by 1 for each
        new key that is generated on the server.
  </p>
  <p>
   The binary log encryption key that is currently in use on the
        server is called the binary log master key. The sequence number
        for the current binary log master key is stored in the keyring.
        The binary log master key is used to encrypt each new log
        file's file password, which is a randomly generated 32-byte
        file password specific to the log file that is used to encrypt
        the file data. The file password is encrypted using AES-CBC (AES
        Cipher Block Chaining mode) with the 256-bit binary log
        encryption key and a random initialization vector (IV), and is
        stored in the log file's file header. The file data is encrypted
        using AES-CTR (AES Counter mode) with a 256-bit key generated
        from the file password and a nonce also generated from the file
        password. It is technically possible to decrypt an encrypted
        file offline, if the binary log encryption key used to encrypt
        the file password is known, by using tools available in the
        OpenSSL cryptography toolkit.
  </p>
  <p>
   If you use file copying to clone a MySQL server instance that
        has encryption active so its binary log files and relay log
        files are encrypted, ensure that the keyring is also copied, so
        that the clone server can read the binary log encryption keys
        from the source server. When encryption is activated on the
        clone server (either at startup or subsequently), the clone
        server recognizes that the binary log encryption keys used with
        the copied files include the generated UUID of the source
        server. It automatically generates a new binary log encryption
        key using its own generated UUID, and uses this to encrypt the
        file passwords for subsequent binary log files and relay log
        files. The copied files continue to be read using the source
        server's keys.
  </p>
 </div>
 <br/>
</div>
