<div id="docs-body">
 <div class="section">
  <div class="titlepage">
   <div>
    <div>
     <h2 class="title">
      <a name="faqs-tablespace-encryption">
      </a>
      A.17 MySQL 8.4 FAQ: InnoDB Data-at-Rest Encryption
     </h2>
    </div>
   </div>
  </div>
  <a class="indexterm" name="idm46045054854464">
  </a>
  <div class="qandaset">
   <a name="idm46045054853008">
   </a>
   <dl>
    <dt>
     A.17.1.
     <a href="faqs-tablespace-encryption.html#faq-tablespace-encryption-access">
      Is data decrypted for users who are authorized to see it?
     </a>
    </dt>
    <dt>
     A.17.2.
     <a href="faqs-tablespace-encryption.html#faq-tablespace-encryption-overhead">
      What is the overhead associated with InnoDB
        data-at-rest encryption?
     </a>
    </dt>
    <dt>
     A.17.3.
     <a href="faqs-tablespace-encryption.html#faq-tablespace-encryption-algorithm">
      What are the encryption algorithms used with
        InnoDB data-at-rest encryption?
     </a>
    </dt>
    <dt>
     A.17.4.
     <a href="faqs-tablespace-encryption.html#faq-tablespace-encryption-other-algorithms">
      Is it possible to use 3rd party encryption algorithms in place
        of the one provided by the InnoDB
        data-at-rest encryption feature?
     </a>
    </dt>
    <dt>
     A.17.5.
     <a href="faqs-tablespace-encryption.html#faq-tablespace-encryption-indexed-columns">
      Can indexed columns be encrypted?
     </a>
    </dt>
    <dt>
     A.17.6.
     <a href="faqs-tablespace-encryption.html#faq-tablespace-encryption-data-types">
      What data types and data lengths does InnoDB
        data-at-rest encryption support?
     </a>
    </dt>
    <dt>
     A.17.7.
     <a href="faqs-tablespace-encryption.html#faq-tablespace-encryption-network">
      Does data remain encrypted on the network?
     </a>
    </dt>
    <dt>
     A.17.8.
     <a href="faqs-tablespace-encryption.html#faq-tablespace-encryption-database-memory">
      Does database memory contain cleartext or encrypted data?
     </a>
    </dt>
    <dt>
     A.17.9.
     <a href="faqs-tablespace-encryption.html#faq-tablespace-encryption-data-to-encrypt">
      How do I know which data to encrypt?
     </a>
    </dt>
    <dt>
     A.17.10.
     <a href="faqs-tablespace-encryption.html#faq-tablespace-encryption-mysql-encryption">
      How is InnoDB data-at-rest encryption
        different from encryption functions MySQL already provides?
     </a>
    </dt>
    <dt>
     A.17.11.
     <a href="faqs-tablespace-encryption.html#faq-tablespace-encryption-transportable-tablespaces">
      Does the transportable tablespaces feature work with
        InnoDB data-at-rest encryption?
     </a>
    </dt>
    <dt>
     A.17.12.
     <a href="faqs-tablespace-encryption.html#faq-tablespace-encryption-compression">
      Does compression work with InnoDB
        data-at-rest encryption?
     </a>
    </dt>
    <dt>
     A.17.13.
     <a href="faqs-tablespace-encryption.html#faq-tablespace-encryption-mysqldump">
      Can I use mysqldump with encrypted tables?
     </a>
    </dt>
    <dt>
     A.17.14.
     <a href="faqs-tablespace-encryption.html#faq-tablespace-encryption-key-rotation">
      How do I change (rotate, re-key) the master encryption key?
     </a>
    </dt>
    <dt>
     A.17.15.
     <a href="faqs-tablespace-encryption.html#faq-tablespace-encryption-data-migration">
      How do I migrate data from a cleartext InnoDB
        tablespace to an encrypted InnoDB tablespace?
     </a>
    </dt>
   </dl>
   <table border="0" style="width: 100%;">
    <colgroup>
     <col align="left" width="1%"/>
     <col/>
    </colgroup>
    <tbody>
     <tr class="question">
      <td align="left" valign="top">
       <a name="faq-tablespace-encryption-access">
       </a>
       <a name="idm46045054852256">
       </a>
       <p>
        <b>
         A.17.1.
        </b>
       </p>
      </td>
      <td align="left" valign="top">
       <p>
        Is data decrypted for users who are authorized to see it?
       </p>
      </td>
     </tr>
     <tr class="answer">
      <td align="left" valign="top">
      </td>
      <td align="left" valign="top">
       <p>
        Yes.
        <code class="literal">
         InnoDB
        </code>
        data-at-rest encryption is
        designed to transparently apply encryption within the database
        without impacting existing applications. Returning data in
        encrypted format would break most existing applications.
        <code class="literal">
         InnoDB
        </code>
        data-at-rest encryption provides the
        benefit of encryption without the overhead associated with
        traditional database encryption solutions, which would typically
        require expensive and substantial changes to applications,
        database triggers, and views.
       </p>
      </td>
     </tr>
     <tr class="question">
      <td align="left" valign="top">
       <a name="faq-tablespace-encryption-overhead">
       </a>
       <a name="idm46045054848336">
       </a>
       <p>
        <b>
         A.17.2.
        </b>
       </p>
      </td>
      <td align="left" valign="top">
       <p>
        What is the overhead associated with
        <code class="literal">
         InnoDB
        </code>
        data-at-rest encryption?
       </p>
      </td>
     </tr>
     <tr class="answer">
      <td align="left" valign="top">
      </td>
      <td align="left" valign="top">
       <p>
        There is no additional storage overhead. According to internal
        benchmarks, performance overhead amounts to a single digit
        percentage difference.
       </p>
      </td>
     </tr>
     <tr class="question">
      <td align="left" valign="top">
       <a name="faq-tablespace-encryption-algorithm">
       </a>
       <a name="idm46045054845472">
       </a>
       <p>
        <b>
         A.17.3.
        </b>
       </p>
      </td>
      <td align="left" valign="top">
       <p>
        What are the encryption algorithms used with
        <code class="literal">
         InnoDB
        </code>
        data-at-rest encryption?
       </p>
      </td>
     </tr>
     <tr class="answer">
      <td align="left" valign="top">
      </td>
      <td align="left" valign="top">
       <p>
        <code class="literal">
         InnoDB
        </code>
        data-at-rest encryption supports the
        Advanced Encryption Standard (AES256) block-based encryption
        algorithm. It uses Electronic Codebook (ECB) block encryption
        mode for tablespace key encryption and Cipher Block Chaining
        (CBC) block encryption mode for data encryption.
       </p>
      </td>
     </tr>
     <tr class="question">
      <td align="left" valign="top">
       <a name="faq-tablespace-encryption-other-algorithms">
       </a>
       <a name="idm46045054841360">
       </a>
       <p>
        <b>
         A.17.4.
        </b>
       </p>
      </td>
      <td align="left" valign="top">
       <p>
        Is it possible to use 3rd party encryption algorithms in place
        of the one provided by the
        <code class="literal">
         InnoDB
        </code>
        data-at-rest encryption feature?
       </p>
      </td>
     </tr>
     <tr class="answer">
      <td align="left" valign="top">
      </td>
      <td align="left" valign="top">
       <p>
        No, it is not possible to use other encryption algorithms. The
        provided encryption algorithm is broadly accepted.
       </p>
      </td>
     </tr>
     <tr class="question">
      <td align="left" valign="top">
       <a name="faq-tablespace-encryption-indexed-columns">
       </a>
       <a name="idm46045054838368">
       </a>
       <p>
        <b>
         A.17.5.
        </b>
       </p>
      </td>
      <td align="left" valign="top">
       <p>
        Can indexed columns be encrypted?
       </p>
      </td>
     </tr>
     <tr class="answer">
      <td align="left" valign="top">
      </td>
      <td align="left" valign="top">
       <p>
        <code class="literal">
         InnoDB
        </code>
        data-at-rest encryption supports all
        indexes transparently.
       </p>
      </td>
     </tr>
     <tr class="question">
      <td align="left" valign="top">
       <a name="faq-tablespace-encryption-data-types">
       </a>
       <a name="idm46045054835680">
       </a>
       <p>
        <b>
         A.17.6.
        </b>
       </p>
      </td>
      <td align="left" valign="top">
       <p>
        What data types and data lengths does
        <code class="literal">
         InnoDB
        </code>
        data-at-rest encryption support?
       </p>
      </td>
     </tr>
     <tr class="answer">
      <td align="left" valign="top">
      </td>
      <td align="left" valign="top">
       <p>
        <code class="literal">
         InnoDB
        </code>
        data-at-rest encryption supports all
        supported data types. There is no data length limitation.
       </p>
      </td>
     </tr>
     <tr class="question">
      <td align="left" valign="top">
       <a name="faq-tablespace-encryption-network">
       </a>
       <a name="idm46045054832128">
       </a>
       <p>
        <b>
         A.17.7.
        </b>
       </p>
      </td>
      <td align="left" valign="top">
       <p>
        Does data remain encrypted on the network?
       </p>
      </td>
     </tr>
     <tr class="answer">
      <td align="left" valign="top">
      </td>
      <td align="left" valign="top">
       <p>
        Data encrypted by the
        <code class="literal">
         InnoDB
        </code>
        data-at-rest
        feature is decrypted when it is read from the tablespace file.
        Thus, if the data is on the network, it is in cleartext form.
        However, data on the network can be encrypted using MySQL
        network encryption, which encrypts data traveling to and from a
        database using SSL/TLS.
       </p>
      </td>
     </tr>
     <tr class="question">
      <td align="left" valign="top">
       <a name="faq-tablespace-encryption-database-memory">
       </a>
       <a name="idm46045054828992">
       </a>
       <p>
        <b>
         A.17.8.
        </b>
       </p>
      </td>
      <td align="left" valign="top">
       <p>
        Does database memory contain cleartext or encrypted data?
       </p>
      </td>
     </tr>
     <tr class="answer">
      <td align="left" valign="top">
      </td>
      <td align="left" valign="top">
       <p>
        With
        <code class="literal">
         InnoDB
        </code>
        data-at-rest encryption,
        in-memory data is decrypted, which provides complete
        transparency.
       </p>
      </td>
     </tr>
     <tr class="question">
      <td align="left" valign="top">
       <a name="faq-tablespace-encryption-data-to-encrypt">
       </a>
       <a name="idm46045054826096">
       </a>
       <p>
        <b>
         A.17.9.
        </b>
       </p>
      </td>
      <td align="left" valign="top">
       <p>
        How do I know which data to encrypt?
       </p>
      </td>
     </tr>
     <tr class="answer">
      <td align="left" valign="top">
      </td>
      <td align="left" valign="top">
       <p>
        Compliance with the PCI-DSS standard requires that credit card
        numbers (Primary Account Number, or 'PAN') be stored in
        encrypted form. Breach Notification Laws (for example, CA SB
        1386, CA AB 1950, and similar laws in 43+ more US states)
        require encryption of first name, last name, driver license
        number, and other PII data. In early 2008, CA AB 1298 added
        medical and health insurance information to PII data.
        Additionally, industry specific privacy and security standards
        may require encryption of certain assets. For example, assets
        such as pharmaceutical research results, oil field exploration
        results, financial contracts, or personal data of law
        enforcement informants may require encryption. In the health
        care industry, the privacy of patient data, health records and
        X-ray images is of the highest importance.
       </p>
      </td>
     </tr>
     <tr class="question">
      <td align="left" valign="top">
       <a name="faq-tablespace-encryption-mysql-encryption">
       </a>
       <a name="idm46045054823120">
       </a>
       <p>
        <b>
         A.17.10.
        </b>
       </p>
      </td>
      <td align="left" valign="top">
       <p>
        How is
        <code class="literal">
         InnoDB
        </code>
        data-at-rest encryption
        different from encryption functions MySQL already provides?
       </p>
      </td>
     </tr>
     <tr class="answer">
      <td align="left" valign="top">
      </td>
      <td align="left" valign="top">
       <p>
        There are symmetric and asymmetric encryption APIs in MySQL that
        can be used to manually encrypt data within the database.
        However, the application must manage encryption keys and perform
        required encryption and decryption operations by calling API
        functions.
        <code class="literal">
         InnoDB
        </code>
        data-at-rest encryption
        requires no application changes, is transparent to end users,
        and provides automated, built-in key management.
       </p>
      </td>
     </tr>
     <tr class="question">
      <td align="left" valign="top">
       <a name="faq-tablespace-encryption-transportable-tablespaces">
       </a>
       <a name="idm46045054819216">
       </a>
       <p>
        <b>
         A.17.11.
        </b>
       </p>
      </td>
      <td align="left" valign="top">
       <p>
        Does the transportable tablespaces feature work with
        <code class="literal">
         InnoDB
        </code>
        data-at-rest encryption?
       </p>
      </td>
     </tr>
     <tr class="answer">
      <td align="left" valign="top">
      </td>
      <td align="left" valign="top">
       <p>
        Yes. It is supported for encrypted file-per-table tablespaces.
        For more information, see
        <a class="xref" href="innodb-data-encryption.html#innodb-data-encryption-exporting" title="Exporting Encrypted Tablespaces">
         Exporting Encrypted Tablespaces
        </a>
        .
       </p>
      </td>
     </tr>
     <tr class="question">
      <td align="left" valign="top">
       <a name="faq-tablespace-encryption-compression">
       </a>
       <a name="idm46045054815664">
       </a>
       <p>
        <b>
         A.17.12.
        </b>
       </p>
      </td>
      <td align="left" valign="top">
       <p>
        Does compression work with
        <code class="literal">
         InnoDB
        </code>
        data-at-rest encryption?
       </p>
      </td>
     </tr>
     <tr class="answer">
      <td align="left" valign="top">
      </td>
      <td align="left" valign="top">
       <p>
        Customers using
        <code class="literal">
         InnoDB
        </code>
        data-at-rest
        encryption receive the full benefit of compression because
        compression is applied before data blocks are encrypted.
       </p>
      </td>
     </tr>
     <tr class="question">
      <td align="left" valign="top">
       <a name="faq-tablespace-encryption-mysqldump">
       </a>
       <a name="idm46045054812096">
       </a>
       <p>
        <b>
         A.17.13.
        </b>
       </p>
      </td>
      <td align="left" valign="top">
       <p>
        Can I use
        <code class="literal">
         mysqldump
        </code>
        with encrypted tables?
       </p>
      </td>
     </tr>
     <tr class="answer">
      <td align="left" valign="top">
      </td>
      <td align="left" valign="top">
       <p>
        Yes. Because these utilities create logical backups, the data
        dumped from encrypted tables is not encrypted.
       </p>
      </td>
     </tr>
     <tr class="question">
      <td align="left" valign="top">
       <a name="faq-tablespace-encryption-key-rotation">
       </a>
       <a name="idm46045054809328">
       </a>
       <p>
        <b>
         A.17.14.
        </b>
       </p>
      </td>
      <td align="left" valign="top">
       <p>
        How do I change (rotate, re-key) the master encryption key?
       </p>
      </td>
     </tr>
     <tr class="answer">
      <td align="left" valign="top">
      </td>
      <td align="left" valign="top">
       <p>
        <code class="literal">
         InnoDB
        </code>
        data-at-rest encryption uses a two
        tier key mechanism. When data-at-rest encryption is used,
        individual tablespace keys are stored in the header of the
        underlying tablespace data file. Tablespace keys are encrypted
        using the master encryption key. The master encryption key is
        generated when tablespace encryption is enabled, and is stored
        outside the database. The master encryption key is rotated using
        the
        <a class="link" href="alter-instance.html" title="15.1.5 ALTER INSTANCE Statement">
         <code class="literal">
          ALTER
        INSTANCE ROTATE INNODB MASTER KEY
         </code>
        </a>
        statement, which
        generates a new master encryption key, stores the key, and
        rotates the key into use.
       </p>
      </td>
     </tr>
     <tr class="question">
      <td align="left" valign="top">
       <a name="faq-tablespace-encryption-data-migration">
       </a>
       <a name="idm46045054804784">
       </a>
       <p>
        <b>
         A.17.15.
        </b>
       </p>
      </td>
      <td align="left" valign="top">
       <p>
        How do I migrate data from a cleartext
        <code class="literal">
         InnoDB
        </code>
        tablespace to an encrypted
        <code class="literal">
         InnoDB
        </code>
        tablespace?
       </p>
      </td>
     </tr>
     <tr class="answer">
      <td align="left" valign="top">
      </td>
      <td align="left" valign="top">
       <p>
        Transferring data from one tablespace to another is not
        required. To encrypt data in an
        <code class="literal">
         InnoDB
        </code>
        file-per-table tablespace, run
        <a class="link" href="alter-table.html" title="15.1.9 ALTER TABLE Statement">
         <code class="literal">
          ALTER TABLE
          <em class="replaceable">
           <code>
            tbl_name
           </code>
          </em>
          ENCRYPTION = 'Y'
         </code>
        </a>
        .
        To encrypt a general tablespace or the
        <code class="literal">
         mysql
        </code>
        tablespace, run
        <a class="link" href="alter-tablespace.html" title="15.1.10 ALTER TABLESPACE Statement">
         <code class="literal">
          ALTER
        TABLESPACE
          <em class="replaceable">
           <code>
            tablespace_name
           </code>
          </em>
          ENCRYPTION
        = 'Y'
         </code>
        </a>
        . Encryption support for general tablespaces was
        introduced in MySQL 8.0.13. Encryption support for the
        <code class="literal">
         mysql
        </code>
        system tablespace is available as of
        MySQL 8.0.16.
       </p>
      </td>
     </tr>
    </tbody>
   </table>
  </div>
 </div>
 <br/>
</div>
