<div id="docs-body">
 <div class="section">
  <div class="titlepage">
   <div>
    <div>
     <h3 class="title">
      <a name="replication-binlog-encryption">
      </a>
      19.3.2 Encrypting Binary Log Files and Relay Log Files
     </h3>
    </div>
   </div>
  </div>
  <div class="toc">
   <dl class="toc">
    <dt>
     <span class="section">
      <a href="replication-binlog-encryption-scope.html">
       19.3.2.1 Scope of Binary Log Encryption
      </a>
     </span>
    </dt>
    <dt>
     <span class="section">
      <a href="replication-binlog-encryption-encryption-keys.html">
       19.3.2.2 Binary Log Encryption Keys
      </a>
     </span>
    </dt>
    <dt>
     <span class="section">
      <a href="replication-binlog-encryption-key-rotation.html">
       19.3.2.3 Binary Log Master Key Rotation
      </a>
     </span>
    </dt>
   </dl>
  </div>
  <a class="indexterm" name="idm46045137141760">
  </a>
  <a class="indexterm" name="idm46045137140688">
  </a>
  <p>
   MySQL binary log files and relay log files can be encrypted,
      helping to protect these files and the potentially sensitive data
      contained in them from being misused by outside attackers, and
      also from unauthorized viewing by users of the operating system
      where they are stored. The encryption algorithm used for the
      files, the AES (Advanced Encryption Standard) cipher algorithm, is
      built in to MySQL Server and cannot be configured.
  </p>
  <p>
   You enable this encryption on a MySQL server by setting the
   <a class="link" href="replication-options-binary-log.html#sysvar_binlog_encryption">
    <code class="literal">
     binlog_encryption
    </code>
   </a>
   system variable
      to
   <code class="literal">
    ON
   </code>
   .
   <code class="literal">
    OFF
   </code>
   is the default.
      The system variable sets encryption on for binary log files and
      relay log files. Binary logging does not need to be enabled on the
      server to enable encryption, so you can encrypt the relay log
      files on a replica that has no binary log. To use encryption, a
      keyring component or plugin must be installed and configured to
      supply MySQL Server's keyring service. For instructions to do
      this, see
   <a class="xref" href="keyring.html" title="8.4.4 The MySQL Keyring">
    Section 8.4.4, “The MySQL Keyring”
   </a>
   . Any supported keyring
      component or plugin can be used to store binary log encryption
      keys.
  </p>
  <p>
   When you first start the server with encryption enabled, a new
      binary log encryption key is generated before the binary log and
      relay logs are initialized. This key is used to encrypt a file
      password for each binary log file (if the server has binary
      logging enabled) and relay log file (if the server has replication
      channels), and further keys generated from the file passwords are
      used to encrypt the data in the files. The binary log encryption
      key that is currently in use on the server is called the binary
      log master key. The two tier encryption key architecture means
      that the binary log master key can be rotated (replaced by a new
      master key) as required, and only the file password for each file
      needs to be re-encrypted with the new master key, not the whole
      file. Relay log files are encrypted for all channels, including
      new channels that are created after encryption is activated. The
      binary log index file and relay log index file are never
      encrypted.
  </p>
  <p>
   If you activate encryption while the server is running, a new
      binary log encryption key is generated at that time. The exception
      is if encryption was active previously on the server and was then
      disabled, in which case the binary log encryption key that was in
      use before is used again. The binary log file and relay log files
      are rotated immediately, and file passwords for the new files and
      all subsequent binary log files and relay log files are encrypted
      using this binary log encryption key. Existing binary log files
      and relay log files still present on the server are not encrypted,
      but you can purge them if they are no longer needed.
  </p>
  <p>
   If you deactivate encryption by changing the
   <a class="link" href="replication-options-binary-log.html#sysvar_binlog_encryption">
    <code class="literal">
     binlog_encryption
    </code>
   </a>
   system variable
      to
   <code class="literal">
    OFF
   </code>
   , the binary log file and relay log files
      are rotated immediately and all subsequent logging is unencrypted.
      Previously encrypted files are not automatically decrypted, but
      the server is still able to read them. The
   <a class="link" href="privileges-provided.html#priv_binlog-encryption-admin">
    <code class="literal">
     BINLOG_ENCRYPTION_ADMIN
    </code>
   </a>
   privilege
      is required to activate or deactivate encryption while the server
      is running.
  </p>
  <p>
   Encrypted and unencrypted binary log files can be distinguished
      using the magic number at the start of the file header for
      encrypted log files (
   <code class="literal">
    0xFD62696E
   </code>
   ), which differs
      from that used for unencrypted log files
      (
   <code class="literal">
    0xFE62696E
   </code>
   ). The
   <a class="link" href="show-binary-logs.html" title="15.7.7.2 SHOW BINARY LOGS Statement">
    <code class="literal">
     SHOW
      BINARY LOGS
    </code>
   </a>
   statement shows whether each binary log file
      is encrypted or unencrypted.
  </p>
  <p>
   When binary log files have been encrypted,
   <a class="link" href="mysqlbinlog.html" title="6.6.9 mysqlbinlog — Utility for Processing Binary Log Files">
    <span class="command">
     <strong>
      mysqlbinlog
     </strong>
    </span>
   </a>
   cannot read them directly, but can
      read them from the server using the
   <a class="link" href="mysqlbinlog.html#option_mysqlbinlog_read-from-remote-server">
    <code class="option">
     --read-from-remote-server
    </code>
   </a>
   option. If you back up encrypted binary log files using
   <a class="link" href="mysqlbinlog.html" title="6.6.9 mysqlbinlog — Utility for Processing Binary Log Files">
    <span class="command">
     <strong>
      mysqlbinlog
     </strong>
    </span>
   </a>
   , note that the copies of the files
      that are generated using
   <a class="link" href="mysqlbinlog.html" title="6.6.9 mysqlbinlog — Utility for Processing Binary Log Files">
    <span class="command">
     <strong>
      mysqlbinlog
     </strong>
    </span>
   </a>
   are stored
      in an unencrypted format.
  </p>
  <p>
   Binary log encryption can be combined with binary log transaction
      compression. For more information on binary log transaction
      compression, see
   <a class="xref" href="binary-log-transaction-compression.html" title="7.4.4.5 Binary Log Transaction Compression">
    Section 7.4.4.5, “Binary Log Transaction Compression”
   </a>
   .
  </p>
 </div>
 <br/>
</div>
