<div id="docs-body">
 <div class="section">
  <div class="titlepage">
   <div>
    <div>
     <h4 class="title">
      <a name="keyring-key-types">
      </a>
      8.4.4.10 Supported Keyring Key Types and Lengths
     </h4>
    </div>
   </div>
  </div>
  <p>
   MySQL Keyring supports keys of different types (encryption
        algorithms) and lengths:
  </p>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      The available key types depend on which keyring plugin is
            installed.
     </p>
    </li>
    <li class="listitem">
     <p>
      The permitted key lengths are subject to multiple factors:
     </p>
     <div class="itemizedlist">
      <ul class="itemizedlist" style="list-style-type: circle; ">
       <li class="listitem">
        <p>
         General keyring loadable-function interface limits (for
                keys managed using one of the keyring functions
                described in
         <a class="xref" href="keyring-functions-general-purpose.html" title="8.4.4.12 General-Purpose Keyring Key-Management Functions">
          Section 8.4.4.12, “General-Purpose Keyring Key-Management Functions”
         </a>
         ), or
                limits from back end implementations. These length
                limits can vary by key operation type.
        </p>
       </li>
       <li class="listitem">
        <p>
         In addition to the general limits, individual keyring
                plugins may impose restrictions on key lengths per key
                type.
        </p>
       </li>
      </ul>
     </div>
    </li>
   </ul>
  </div>
  <p>
   <a class="xref" href="keyring-key-types.html#keyring-general-key-length-limits-table" title="Table 8.31 General Keyring Key Length Limits">
    Table 8.31, “General Keyring Key Length Limits”
   </a>
   shows
        the general key-length limits. (The lower limits for
   <code class="literal">
    keyring_aws
   </code>
   are imposed by the AWS KMS
        interface, not the keyring functions.) For keyring plugins,
   <a class="xref" href="keyring-key-types.html#keyring-key-types-table" title="Table 8.32 Keyring Plugin Key Types and Lengths">
    Table 8.32, “Keyring Plugin Key Types and Lengths”
   </a>
   shows the key types
        each keyring plugin permits, as well as any plugin-specific
        key-length restrictions. For most keyring components, the
        general key-length limits apply and there are no key-type
        restrictions.
  </p>
  <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
   <div class="admon-title">
    Note
   </div>
   <p>
    <code class="literal">
     component_keyring_oci
    </code>
    can generate keys of
          type
    <code class="literal">
     AES
    </code>
    with a size of 16, 24, or 32 bytes
          only.
   </p>
  </div>
  <div class="table">
   <a name="keyring-general-key-length-limits-table">
   </a>
   <p class="title">
    <b>
     Table 8.31 General Keyring Key Length Limits
    </b>
   </p>
   <div class="table-contents">
    <table summary="General limits on keyring key lengths.">
     <colgroup>
      <col style="width: 20%"/>
      <col style="width: 80%"/>
     </colgroup>
     <thead>
      <tr>
       <th>
        Key Operation
       </th>
       <th>
        Maximum Key Length
       </th>
      </tr>
     </thead>
     <tbody>
      <tr>
       <td>
        Generate key
       </td>
       <td>
        <p class="valid-value">
         16,384 bytes (2,048 previously); 1,024 for
         <code class="literal">
          keyring_aws
         </code>
        </p>
       </td>
      </tr>
      <tr>
       <td>
        Store key
       </td>
       <td>
        <p class="valid-value">
         16,384 bytes (2,048 previously); 4,096 for
         <code class="literal">
          keyring_aws
         </code>
        </p>
       </td>
      </tr>
      <tr>
       <td>
        Fetch key
       </td>
       <td>
        <p class="valid-value">
         16,384 bytes (2,048 previously); 4,096 for
         <code class="literal">
          keyring_aws
         </code>
        </p>
       </td>
      </tr>
     </tbody>
    </table>
   </div>
  </div>
  <br class="table-break"/>
  <div class="table">
   <a name="keyring-key-types-table">
   </a>
   <p class="title">
    <b>
     Table 8.32 Keyring Plugin Key Types and Lengths
    </b>
   </p>
   <div class="table-contents">
    <table summary="Key types and lengths supported by keyring plugins.">
     <colgroup>
      <col style="width: 30%"/>
      <col style="width: 25%"/>
      <col style="width: 45%"/>
     </colgroup>
     <thead>
      <tr>
       <th scope="col">
        Plugin Name
       </th>
       <th scope="col">
        Permitted Key Type
       </th>
       <th scope="col">
        Plugin-Specific Length Restrictions
       </th>
      </tr>
     </thead>
     <tbody>
      <tr>
       <th scope="row" valign="top">
        <code class="literal">
         keyring_aws
        </code>
       </th>
       <td>
        <p class="valid-value">
         <code class="literal">
          AES
         </code>
        </p>
        <p class="valid-value">
         <code class="literal">
          SECRET
         </code>
        </p>
       </td>
       <td>
        <p class="valid-value">
         16, 24, or 32 bytes
        </p>
        <p class="valid-value">
         None
        </p>
       </td>
      </tr>
      <tr>
       <th scope="row" valign="top">
        <code class="literal">
         keyring_hashicorp
        </code>
       </th>
       <td>
        <p class="valid-value">
         <code class="literal">
          AES
         </code>
        </p>
        <p class="valid-value">
         <code class="literal">
          DSA
         </code>
        </p>
        <p class="valid-value">
         <code class="literal">
          RSA
         </code>
        </p>
        <p class="valid-value">
         <code class="literal">
          SECRET
         </code>
        </p>
       </td>
       <td>
        <p class="valid-value">
         None
        </p>
        <p class="valid-value">
         None
        </p>
        <p class="valid-value">
         None
        </p>
        <p class="valid-value">
         None
        </p>
       </td>
      </tr>
      <tr>
       <th scope="row" valign="top">
        <code class="literal">
         keyring_okv
        </code>
       </th>
       <td>
        <p class="valid-value">
         <code class="literal">
          AES
         </code>
        </p>
        <p class="valid-value">
         <code class="literal">
          SECRET
         </code>
        </p>
       </td>
       <td>
        <p class="valid-value">
         16, 24, or 32 bytes
        </p>
        <p class="valid-value">
         None
        </p>
       </td>
      </tr>
     </tbody>
    </table>
   </div>
  </div>
  <br class="table-break"/>
  <p>
   The
   <code class="literal">
    SECRET
   </code>
   key type is intended for
        general-purpose storage of sensitive data using the MySQL
        keyring, and is supported by most keyring components and keyring
        plugins. The keyring encrypts and decrypts
   <code class="literal">
    SECRET
   </code>
   data as a byte stream upon storage and
        retrieval.
  </p>
  <p>
   Example keyring operations involving the
   <code class="literal">
    SECRET
   </code>
   key type:
  </p>
  <div class="copytoclipboard-wrapper">
   <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa74989040"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">SELECT</span> keyring_key_generate<span class="token punctuation">(</span><span class="token string">'MySecret1'</span><span class="token punctuation">,</span> <span class="token string">'SECRET'</span><span class="token punctuation">,</span> <span class="token number">20</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token keyword">SELECT</span> keyring_key_remove<span class="token punctuation">(</span><span class="token string">'MySecret1'</span><span class="token punctuation">)</span><span class="token punctuation">;</span>

<span class="token keyword">SELECT</span> keyring_key_store<span class="token punctuation">(</span><span class="token string">'MySecret2'</span><span class="token punctuation">,</span> <span class="token string">'SECRET'</span><span class="token punctuation">,</span> <span class="token string">'MySecretData'</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token keyword">SELECT</span> keyring_key_fetch<span class="token punctuation">(</span><span class="token string">'MySecret2'</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token keyword">SELECT</span> keyring_key_length_fetch<span class="token punctuation">(</span><span class="token string">'MySecret2'</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token keyword">SELECT</span> keyring_key_type_fetch<span class="token punctuation">(</span><span class="token string">'MySecret2'</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token keyword">SELECT</span> keyring_key_remove<span class="token punctuation">(</span><span class="token string">'MySecret2'</span><span class="token punctuation">)</span><span class="token punctuation">;</span></code></pre>
  </div>
 </div>
 <br/>
</div>
