<div id="docs-body">
 <div class="section">
  <div class="titlepage">
   <div>
    <div>
     <h3 class="title">
      <a name="keyring">
      </a>
      8.4.4 The MySQL Keyring
     </h3>
    </div>
   </div>
  </div>
  <div class="toc">
   <dl class="toc">
    <dt>
     <span class="section">
      <a href="keyring-component-plugin-comparison.html">
       8.4.4.1 Keyring Components Versus Keyring Plugins
      </a>
     </span>
    </dt>
    <dt>
     <span class="section">
      <a href="keyring-component-installation.html">
       8.4.4.2 Keyring Component Installation
      </a>
     </span>
    </dt>
    <dt>
     <span class="section">
      <a href="keyring-plugin-installation.html">
       8.4.4.3 Keyring Plugin Installation
      </a>
     </span>
    </dt>
    <dt>
     <span class="section">
      <a href="keyring-file-component.html">
       8.4.4.4 Using the component_keyring_file File-Based Keyring Component
      </a>
     </span>
    </dt>
    <dt>
     <span class="section">
      <a href="keyring-encrypted-file-component.html">
       8.4.4.5 Using the component_keyring_encrypted_file Encrypted File-Based Keyring
Component
      </a>
     </span>
    </dt>
    <dt>
     <span class="section">
      <a href="keyring-okv-plugin.html">
       8.4.4.6 Using the keyring_okv KMIP Plugin
      </a>
     </span>
    </dt>
    <dt>
     <span class="section">
      <a href="keyring-aws-plugin.html">
       8.4.4.7 Using the keyring_aws Amazon Web Services Keyring Plugin
      </a>
     </span>
    </dt>
    <dt>
     <span class="section">
      <a href="keyring-hashicorp-plugin.html">
       8.4.4.8 Using the HashiCorp Vault Keyring Plugin
      </a>
     </span>
    </dt>
    <dt>
     <span class="section">
      <a href="keyring-oci-component.html">
       8.4.4.9 Using the Oracle Cloud Infrastructure Vault Keyring Component
      </a>
     </span>
    </dt>
    <dt>
     <span class="section">
      <a href="keyring-key-types.html">
       8.4.4.10 Supported Keyring Key Types and Lengths
      </a>
     </span>
    </dt>
    <dt>
     <span class="section">
      <a href="keyring-key-migration.html">
       8.4.4.11 Migrating Keys Between Keyring Keystores
      </a>
     </span>
    </dt>
    <dt>
     <span class="section">
      <a href="keyring-functions-general-purpose.html">
       8.4.4.12 General-Purpose Keyring Key-Management Functions
      </a>
     </span>
    </dt>
    <dt>
     <span class="section">
      <a href="keyring-functions-plugin-specific.html">
       8.4.4.13 Plugin-Specific Keyring Key-Management Functions
      </a>
     </span>
    </dt>
    <dt>
     <span class="section">
      <a href="keyring-metadata.html">
       8.4.4.14 Keyring Metadata
      </a>
     </span>
    </dt>
    <dt>
     <span class="section">
      <a href="keyring-options.html">
       8.4.4.15 Keyring Command Options
      </a>
     </span>
    </dt>
    <dt>
     <span class="section">
      <a href="keyring-system-variables.html">
       8.4.4.16 Keyring System Variables
      </a>
     </span>
    </dt>
   </dl>
  </div>
  <a class="indexterm" name="idm46045241058432">
  </a>
  <p>
   MySQL Server supports a keyring that enables internal server
      components and plugins to securely store sensitive information for
      later retrieval. The implementation comprises these elements:
  </p>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      Keyring components and plugins that manage a backing store or
          communicate with a storage back end. Keyring use involves
          installing one from among the available components and
          plugins. Keyring components and plugins both manage keyring
          data but are configured differently and may have operational
          differences (see
      <a class="xref" href="keyring-component-plugin-comparison.html" title="8.4.4.1 Keyring Components Versus Keyring Plugins">
       Section 8.4.4.1, “Keyring Components Versus Keyring Plugins”
      </a>
      ).
     </p>
     <p>
      These keyring components are available:
     </p>
     <div class="itemizedlist">
      <ul class="itemizedlist" style="list-style-type: circle; ">
       <li class="listitem">
        <p>
         <code class="literal">
          component_keyring_file
         </code>
         : Stores keyring
              data in a file local to the server host. Available in
              MySQL Community Edition and MySQL Enterprise Edition distributions. See
         <a class="xref" href="keyring-file-component.html" title="8.4.4.4 Using the component_keyring_file File-Based Keyring Component">
          Section 8.4.4.4, “Using the component_keyring_file File-Based Keyring Component”
         </a>
         .
        </p>
       </li>
       <li class="listitem">
        <p>
         <code class="literal">
          component_keyring_encrypted_file
         </code>
         :
              Stores keyring data in an encrypted, password-protected
              file local to the server host. Available in MySQL Enterprise Edition
              distributions. See
         <a class="xref" href="keyring-encrypted-file-component.html" title="8.4.4.5 Using the component_keyring_encrypted_file Encrypted File-Based Keyring Component">
          Section 8.4.4.5, “Using the component_keyring_encrypted_file Encrypted File-Based Keyring
        Component”
         </a>
         .
        </p>
       </li>
       <li class="listitem">
        <p>
         <code class="literal">
          component_keyring_oci
         </code>
         : Stores keyring
              data in the Oracle Cloud Infrastructure Vault. Available in MySQL Enterprise Edition distributions.
              See
         <a class="xref" href="keyring-oci-component.html" title="8.4.4.9 Using the Oracle Cloud Infrastructure Vault Keyring Component">
          Section 8.4.4.9, “Using the Oracle Cloud Infrastructure Vault Keyring Component”
         </a>
         .
        </p>
       </li>
      </ul>
     </div>
     <p>
      These keyring plugins are available:
     </p>
     <div class="itemizedlist">
      <ul class="itemizedlist" style="list-style-type: circle; ">
       <li class="listitem">
        <p>
         <code class="literal">
          keyring_okv
         </code>
         : A KMIP 1.1 plugin for use
              with KMIP-compatible back end keyring storage products
              such as Oracle Key Vault and Gemalto SafeNet KeySecure
              Appliance. Available in MySQL Enterprise Edition distributions. See
         <a class="xref" href="keyring-okv-plugin.html" title="8.4.4.6 Using the keyring_okv KMIP Plugin">
          Section 8.4.4.6, “Using the keyring_okv KMIP Plugin”
         </a>
         .
        </p>
       </li>
       <li class="listitem">
        <p>
         <code class="literal">
          keyring_aws
         </code>
         : Communicates with the
              Amazon Web Services Key Management Service for key
              generation and uses a local file for key storage.
              Available in MySQL Enterprise Edition distributions. See
         <a class="xref" href="keyring-aws-plugin.html" title="8.4.4.7 Using the keyring_aws Amazon Web Services Keyring Plugin">
          Section 8.4.4.7, “Using the keyring_aws Amazon Web Services Keyring Plugin”
         </a>
         .
        </p>
       </li>
       <li class="listitem">
        <p>
         <code class="literal">
          keyring_hashicorp
         </code>
         : Communicates with
              HashiCorp Vault for back end storage. Available in MySQL Enterprise Edition
              distributions. See
         <a class="xref" href="keyring-hashicorp-plugin.html" title="8.4.4.8 Using the HashiCorp Vault Keyring Plugin">
          Section 8.4.4.8, “Using the HashiCorp Vault Keyring Plugin”
         </a>
         .
        </p>
       </li>
      </ul>
     </div>
    </li>
    <li class="listitem">
     <p>
      A keyring service interface for keyring key management. This
          service is accessible at two levels:
     </p>
     <div class="itemizedlist">
      <ul class="itemizedlist" style="list-style-type: circle; ">
       <li class="listitem">
        <p>
         SQL interface: In SQL statements, call the functions
              described in
         <a class="xref" href="keyring-functions-general-purpose.html" title="8.4.4.12 General-Purpose Keyring Key-Management Functions">
          Section 8.4.4.12, “General-Purpose Keyring Key-Management Functions”
         </a>
         .
        </p>
       </li>
       <li class="listitem">
        <p>
         C interface: In C-language code, call the keyring service
              functions described in
         <a class="xref" href="keyring-service.html" title="7.6.9.2 The Keyring Service">
          Section 7.6.9.2, “The Keyring Service”
         </a>
         .
        </p>
       </li>
      </ul>
     </div>
    </li>
    <li class="listitem">
     <p>
      Key metadata access:
     </p>
     <div class="itemizedlist">
      <ul class="itemizedlist" style="list-style-type: circle; ">
       <li class="listitem">
        <p>
         The Performance Schema
         <a class="link" href="performance-schema-keyring-keys-table.html" title="29.12.18.2 The keyring_keys table">
          <code class="literal">
           keyring_keys
          </code>
         </a>
         table exposes
              metadata for keys in the keyring. Key metadata includes
              key IDs, key owners, and backend key IDs. The
         <a class="link" href="performance-schema-keyring-keys-table.html" title="29.12.18.2 The keyring_keys table">
          <code class="literal">
           keyring_keys
          </code>
         </a>
         table does not
              expose any sensitive keyring data such as key contents.
              See
         <a class="xref" href="performance-schema-keyring-keys-table.html" title="29.12.18.2 The keyring_keys table">
          Section 29.12.18.2, “The keyring_keys table”
         </a>
         .
        </p>
        <a class="indexterm" name="idm46045241027792">
        </a>
        <a class="indexterm" name="idm46045241026304">
        </a>
       </li>
       <li class="listitem">
        <p>
         The Performance Schema
         <a class="link" href="performance-schema-keyring-component-status-table.html" title="29.12.18.1 The keyring_component_status Table">
          <code class="literal">
           keyring_component_status
          </code>
         </a>
         table provides status information about the keyring
              component in use, if one is installed. See
         <a class="xref" href="performance-schema-keyring-component-status-table.html" title="29.12.18.1 The keyring_component_status Table">
          Section 29.12.18.1, “The keyring_component_status Table”
         </a>
         .
        </p>
        <a class="indexterm" name="idm46045241021616">
        </a>
        <a class="indexterm" name="idm46045241020112">
        </a>
       </li>
      </ul>
     </div>
    </li>
    <li class="listitem">
     <p>
      A key migration capability. MySQL supports migration of keys
          between keystores, enabling DBAs to switch a MySQL
          installation from one keystore to another. See
      <a class="xref" href="keyring-key-migration.html" title="8.4.4.11 Migrating Keys Between Keyring Keystores">
       Section 8.4.4.11, “Migrating Keys Between Keyring Keystores”
      </a>
      .
     </p>
    </li>
    <li class="listitem">
     <p>
      The implementation of keyring plugins is revised to use the
          component infrastructure. This is facilitated using the
          built-in plugin named
      <code class="literal">
       daemon_keyring_proxy_plugin
      </code>
      that acts as a
          bridge between the plugin and component service APIs. See
      <a class="xref" href="daemon-keyring-proxy-plugin.html" title="7.6.8 The Keyring Proxy Bridge Plugin">
       Section 7.6.8, “The Keyring Proxy Bridge Plugin”
      </a>
      .
     </p>
    </li>
   </ul>
  </div>
  <div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;">
   <div class="admon-title">
    Warning
   </div>
   <p>
    For encryption key management, the
    <code class="literal">
     component_keyring_file
    </code>
    and
    <code class="literal">
     component_keyring_encrypted_file
    </code>
    components
        are not intended as a regulatory compliance solution. Security
        standards such as PCI, FIPS, and others require use of key
        management systems to secure, manage, and protect encryption
        keys in key vaults or hardware security modules (HSMs).
   </p>
  </div>
  <p>
   Within MySQL, keyring service consumers include:
  </p>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      The
      <code class="literal">
       InnoDB
      </code>
      storage engine uses the keyring
          to store its key for tablespace encryption. See
      <a class="xref" href="innodb-data-encryption.html" title="17.13 InnoDB Data-at-Rest Encryption">
       Section 17.13, “InnoDB Data-at-Rest Encryption”
      </a>
      .
     </p>
    </li>
    <li class="listitem">
     <p>
      MySQL Enterprise Audit uses the keyring to store the audit log file
          encryption password. See
      <a class="xref" href="audit-log-logging-configuration.html#audit-log-file-encryption" title="Encrypting Audit Log Files">
       Encrypting Audit Log Files
      </a>
      .
     </p>
    </li>
    <li class="listitem">
     <p>
      Binary log and relay log management supports keyring-based
          encryption of log files. With log file encryption activated,
          the keyring stores the keys used to encrypt passwords for the
          binary log files and relay log files. See
      <a class="xref" href="replication-binlog-encryption.html" title="19.3.2 Encrypting Binary Log Files and Relay Log Files">
       Section 19.3.2, “Encrypting Binary Log Files and Relay Log Files”
      </a>
      .
     </p>
    </li>
    <li class="listitem">
     <p>
      The master key to decrypt the file key that decrypts the
          persisted values of sensitive system variables is stored in
          the keyring. A keyring component must be enabled on the MySQL
          Server instance to support secure storage for persisted system
          variable values, rather than a keyring plugin, which do not
          support the function. See
      <a class="xref" href="persisted-system-variables.html#persisted-system-variables-sensitive" title="Persisting Sensitive System Variables">
       Persisting Sensitive System Variables
      </a>
      .
     </p>
    </li>
   </ul>
  </div>
  <p>
   For general keyring installation instructions, see
   <a class="xref" href="keyring-component-installation.html" title="8.4.4.2 Keyring Component Installation">
    Section 8.4.4.2, “Keyring Component Installation”
   </a>
   , and
   <a class="xref" href="keyring-plugin-installation.html" title="8.4.4.3 Keyring Plugin Installation">
    Section 8.4.4.3, “Keyring Plugin Installation”
   </a>
   . For installation
      and configuration information specific to a given keyring
      component or plugin, see the section describing it.
  </p>
  <p>
   For information about using the keyring functions, see
   <a class="xref" href="keyring-functions-general-purpose.html" title="8.4.4.12 General-Purpose Keyring Key-Management Functions">
    Section 8.4.4.12, “General-Purpose Keyring Key-Management Functions”
   </a>
   .
  </p>
  <p>
   Keyring components, plugins, and functions access a keyring
      service that provides the interface to the keyring. For
      information about accessing this service and writing keyring
      plugins, see
   <a class="xref" href="keyring-service.html" title="7.6.9.2 The Keyring Service">
    Section 7.6.9.2, “The Keyring Service”
   </a>
   , and
   <a class="ulink" href="/doc/extending-mysql/8.4/en/writing-keyring-plugins.html" target="_top">
    Writing Keyring Plugins
   </a>
   .
  </p>
 </div>
 <br/>
</div>
