<div id="docs-body">
 <div class="section">
  <div class="titlepage">
   <div>
    <div>
     <h3 class="title">
      <a name="enterprise-encryption-functions">
      </a>
      8.6.5 MySQL Enterprise Encryption Component Function Descriptions
     </h3>
    </div>
   </div>
  </div>
  <p>
   MySQL Enterprise Encryption functions have these general characteristics:
  </p>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      For arguments of the wrong type or an incorrect number of
          arguments, each function returns an error.
     </p>
    </li>
    <li class="listitem">
     <p>
      If the arguments are not suitable to permit a function to
          perform the requested operation, it returns
      <code class="literal">
       NULL
      </code>
      or 0 as appropriate. This occurs, for
          example, if a function does not support a specified algorithm,
          a key length is too short or long, or a string expected to be
          a key string in PEM format is not a valid key.
     </p>
    </li>
    <li class="listitem">
     <p>
      The underlying SSL library takes care of randomness
          initialization.
     </p>
    </li>
   </ul>
  </div>
  <p>
   The component functions only support the RSA encryption algorithm.
  </p>
  <p>
   For additional examples and discussion, see
   <a class="xref" href="enterprise-encryption-usage.html" title="8.6.3 MySQL Enterprise Encryption Usage and Examples">
    Section 8.6.3, “MySQL Enterprise Encryption Usage and Examples”
   </a>
   .
  </p>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <a name="function_asymmetric-decrypt">
     </a>
     <p>
      <a class="link" href="enterprise-encryption-functions.html#function_asymmetric-decrypt">
       <code class="literal">
        asymmetric_decrypt(
        <em class="replaceable">
         <code>
          algorithm
         </code>
        </em>
        ,
        <em class="replaceable">
         <code>
          data_str
         </code>
        </em>
        ,
        <em class="replaceable">
         <code>
          priv_key_str
         </code>
        </em>
        )
       </code>
      </a>
     </p>
     <a class="indexterm" name="idm46045231840608">
     </a>
     <p>
      Decrypts an encrypted string using the given algorithm and key
          string, and returns the resulting plaintext as a binary
          string. If decryption fails, the result is
      <code class="literal">
       NULL
      </code>
      .
     </p>
     <p>
      For the legacy version of this function in use before MySQL
          8.0.29, see
      <a class="ulink" href="/doc/refman/8.0/en/enterprise-encryption-functions-legacy.html" target="_top">
       MySQL Enterprise Encryption Legacy Function Descriptions
      </a>
      .
     </p>
     <p>
      By default, the
      <code class="literal">
       component_enterprise_encryption
      </code>
      function
          assumes that encrypted text uses the RSAES-OAEP padding
          scheme. The function supports decryption for content encrypted
          by the old
      <code class="literal">
       openssl_udf
      </code>
      shared library
          functions if the system variable
      <a class="link" href="server-system-variables.html#sysvar_enterprise_encryption.rsa_support_legacy_padding">
       <code class="literal">
        enterprise_encryption.rsa_support_legacy_padding
       </code>
      </a>
      is set to
      <code class="literal">
       ON
      </code>
      (the default is
      <code class="literal">
       OFF
      </code>
      ). When this is
      <code class="literal">
       ON
      </code>
      ,
          the function also supports the RSAES-PKCS1-v1_5 padding
          scheme, as used by the old
      <code class="literal">
       openssl_udf
      </code>
      shared library functions. When the variable is set to
      <code class="literal">
       OFF
      </code>
      , content encrypted by the legacy
          functions cannot be decrypted, and the function returns null
          output for such content.
     </p>
     <p>
      <em class="replaceable">
       <code>
        algorithm
       </code>
      </em>
      is the encryption
          algorithm used to create the key. The supported algorithm
          value is
      <code class="literal">
       'RSA'
      </code>
      .
     </p>
     <p>
      <em class="replaceable">
       <code>
        data_str
       </code>
      </em>
      is the encrypted string to
          decrypt, which was encrypted with
      <a class="link" href="enterprise-encryption-functions.html#function_asymmetric-encrypt">
       <code class="literal">
        asymmetric_encrypt()
       </code>
      </a>
      .
     </p>
     <p>
      <em class="replaceable">
       <code>
        priv_key_str
       </code>
      </em>
      is a valid PEM encoded
          RSA private key. For successful decryption, the key string
          must correspond to the public key string used with
      <a class="link" href="enterprise-encryption-functions.html#function_asymmetric-encrypt">
       <code class="literal">
        asymmetric_encrypt()
       </code>
      </a>
      to produce
          the encrypted string. The
      <a class="link" href="enterprise-encryption-functions.html#function_asymmetric-encrypt">
       <code class="literal">
        asymmetric_encrypt()
       </code>
      </a>
      component
          function only supports encryption using a public key, so
          decryption takes place with the corresponding private key.
     </p>
     <p>
      For a usage example, see the description of
      <a class="link" href="enterprise-encryption-functions.html#function_asymmetric-encrypt">
       <code class="literal">
        asymmetric_encrypt()
       </code>
      </a>
      .
     </p>
    </li>
    <li class="listitem">
     <a name="function_asymmetric-encrypt">
     </a>
     <p>
      <a class="link" href="enterprise-encryption-functions.html#function_asymmetric-encrypt">
       <code class="literal">
        asymmetric_encrypt(
        <em class="replaceable">
         <code>
          algorithm
         </code>
        </em>
        ,
        <em class="replaceable">
         <code>
          data_str
         </code>
        </em>
        ,
        <em class="replaceable">
         <code>
          pub_key_str
         </code>
        </em>
        )
       </code>
      </a>
     </p>
     <a class="indexterm" name="idm46045231811952">
     </a>
     <p>
      Encrypts a string using the given algorithm and key string,
          and returns the resulting ciphertext as a binary string. If
          encryption fails, the result is
      <code class="literal">
       NULL
      </code>
      .
     </p>
     <p>
      For the legacy version of this function in use before MySQL
          8.0.29, see
      <a class="ulink" href="/doc/refman/8.0/en/enterprise-encryption-functions-legacy.html" target="_top">
       MySQL Enterprise Encryption Legacy Function Descriptions
      </a>
      .
     </p>
     <p>
      <em class="replaceable">
       <code>
        algorithm
       </code>
      </em>
      is the encryption
          algorithm used to create the key. The supported algorithm
          value is
      <code class="literal">
       'RSA'
      </code>
      .
     </p>
     <p>
      <em class="replaceable">
       <code>
        data_str
       </code>
      </em>
      is the string to encrypt.
          The length of this string cannot be greater than the key
          string length in bytes, minus 42 (to account for the padding).
     </p>
     <p>
      <em class="replaceable">
       <code>
        pub_key_str
       </code>
      </em>
      is a valid PEM encoded
          RSA public key. The
      <a class="link" href="enterprise-encryption-functions.html#function_asymmetric-encrypt">
       <code class="literal">
        asymmetric_encrypt()
       </code>
      </a>
      component
          function only supports encryption using a public key.
     </p>
     <p>
      To recover the original unencrypted string, pass the encrypted
          string to
      <a class="link" href="enterprise-encryption-functions.html#function_asymmetric-decrypt">
       <code class="literal">
        asymmetric_decrypt()
       </code>
      </a>
      ,
          along with the other part of the key pair used for encryption,
          as in the following example:
     </p>
     <div class="copytoclipboard-wrapper">
      <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa97418736"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token comment" spellcheck="true">-- Generate private/public key pair</span>
<span class="token keyword">SET</span> <span class="token variable">@priv</span> <span class="token operator">=</span> <span class="token function">create_asymmetric_priv_key</span><span class="token punctuation">(</span><span class="token string">'RSA'</span><span class="token punctuation">,</span> <span class="token number">2048</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token keyword">SET</span> <span class="token variable">@pub</span> <span class="token operator">=</span> <span class="token function">create_asymmetric_pub_key</span><span class="token punctuation">(</span><span class="token string">'RSA'</span><span class="token punctuation">,</span> <span class="token variable">@priv</span><span class="token punctuation">)</span><span class="token punctuation">;</span>

<span class="token comment" spellcheck="true">-- Encrypt using public key, decrypt using private key</span>
<span class="token keyword">SET</span> <span class="token variable">@ciphertext</span> <span class="token operator">=</span> <span class="token function">asymmetric_encrypt</span><span class="token punctuation">(</span><span class="token string">'RSA'</span><span class="token punctuation">,</span> <span class="token string">'The quick brown fox'</span><span class="token punctuation">,</span> <span class="token variable">@pub</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token keyword">SET</span> <span class="token variable">@plaintext</span> <span class="token operator">=</span> <span class="token function">asymmetric_decrypt</span><span class="token punctuation">(</span><span class="token string">'RSA'</span><span class="token punctuation">,</span> <span class="token variable">@ciphertext</span><span class="token punctuation">,</span> <span class="token variable">@priv</span><span class="token punctuation">)</span><span class="token punctuation">;</span></code></pre>
     </div>
     <p>
      Suppose that:
     </p>
     <div class="copytoclipboard-wrapper">
      <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa65360178"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">SET</span> <span class="token variable">@s</span> <span class="token operator">=</span> a <span class="token keyword">string</span> <span class="token keyword">to</span> be encrypted
<span class="token keyword">SET</span> <span class="token variable">@priv</span> <span class="token operator">=</span> a valid private RSA <span class="token keyword">key</span> <span class="token keyword">string</span> <span class="token keyword">in</span> PEM <span class="token keyword">format</span>
<span class="token keyword">SET</span> <span class="token variable">@pub</span> <span class="token operator">=</span> the corresponding public RSA <span class="token keyword">key</span> <span class="token keyword">string</span> <span class="token keyword">in</span> PEM <span class="token keyword">format</span></code></pre>
     </div>
     <p>
      Then these identity relationships hold:
     </p>
     <div class="copytoclipboard-wrapper">
      <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa77791079"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token function">asymmetric_decrypt</span><span class="token punctuation">(</span><span class="token string">'RSA'</span><span class="token punctuation">,</span> <span class="token function">asymmetric_encrypt</span><span class="token punctuation">(</span><span class="token string">'RSA'</span><span class="token punctuation">,</span> <span class="token variable">@s</span><span class="token punctuation">,</span> <span class="token variable">@pub</span><span class="token punctuation">)</span><span class="token punctuation">,</span> <span class="token variable">@priv</span><span class="token punctuation">)</span> <span class="token operator">=</span> <span class="token variable">@s</span></code></pre>
     </div>
    </li>
    <li class="listitem">
     <a name="function_asymmetric-sign">
     </a>
     <p>
      <a class="link" href="enterprise-encryption-functions.html#function_asymmetric-sign">
       <code class="literal">
        asymmetric_sign(
        <em class="replaceable">
         <code>
          algorithm
         </code>
        </em>
        ,
        <em class="replaceable">
         <code>
          text
         </code>
        </em>
        ,
        <em class="replaceable">
         <code>
          priv_key_str
         </code>
        </em>
        ,
        <em class="replaceable">
         <code>
          digest_type
         </code>
        </em>
        )
       </code>
      </a>
     </p>
     <a class="indexterm" name="idm46045231788960">
     </a>
     <p>
      Signs a digest string or data string using a private key, and
          returns the signature as a binary string. If signing fails,
          the result is
      <code class="literal">
       NULL
      </code>
      .
     </p>
     <p>
      For the legacy version of this function in use before MySQL
          8.0.29, see
      <a class="ulink" href="/doc/refman/8.0/en/enterprise-encryption-functions-legacy.html" target="_top">
       MySQL Enterprise Encryption Legacy Function Descriptions
      </a>
      .
     </p>
     <p>
      <em class="replaceable">
       <code>
        algorithm
       </code>
      </em>
      is the encryption
          algorithm used to create the key. The supported algorithm
          value is
      <code class="literal">
       'RSA'
      </code>
      .
     </p>
     <p>
      <em class="replaceable">
       <code>
        text
       </code>
      </em>
      is a data string or digest
          string. The function accepts digests but does not require
          them, as it is also capable of handling data strings of an
          arbitrary length. A digest string can be generated by calling
      <a class="link" href="enterprise-encryption-functions.html#function_create-digest">
       <code class="literal">
        create_digest()
       </code>
      </a>
      .
     </p>
     <p>
      <em class="replaceable">
       <code>
        priv_key_str
       </code>
      </em>
      is the private key
          string to use for signing the digest string. It must be a
          valid PEM encoded RSA private key.
     </p>
     <p>
      <em class="replaceable">
       <code>
        digest_type
       </code>
      </em>
      is the algorithm to be
          used to sign the data. The supported
      <em class="replaceable">
       <code>
        digest_type
       </code>
      </em>
      values are
      <code class="literal">
       'SHA224'
      </code>
      ,
      <code class="literal">
       'SHA256'
      </code>
      ,
      <code class="literal">
       'SHA384'
      </code>
      , and
      <code class="literal">
       'SHA512'
      </code>
      when OpenSSL 1.0.1 is in use. If OpenSSL 1.1.1 is in use, the
          additional
      <em class="replaceable">
       <code>
        digest_type
       </code>
      </em>
      values
      <code class="literal">
       'SHA3-224'
      </code>
      ,
      <code class="literal">
       'SHA3-256'
      </code>
      ,
      <code class="literal">
       'SHA3-384'
      </code>
      , and
      <code class="literal">
       'SHA3-512'
      </code>
      are available.
     </p>
     <p>
      For a usage example, see the description of
      <a class="link" href="enterprise-encryption-functions.html#function_asymmetric-verify">
       <code class="literal">
        asymmetric_verify()
       </code>
      </a>
      .
     </p>
    </li>
    <li class="listitem">
     <a name="function_asymmetric-verify">
     </a>
     <p>
      <a class="link" href="enterprise-encryption-functions.html#function_asymmetric-verify">
       <code class="literal">
        asymmetric_verify(
        <em class="replaceable">
         <code>
          algorithm
         </code>
        </em>
        ,
        <em class="replaceable">
         <code>
          text
         </code>
        </em>
        ,
        <em class="replaceable">
         <code>
          sig_str
         </code>
        </em>
        ,
        <em class="replaceable">
         <code>
          pub_key_str
         </code>
        </em>
        ,
        <em class="replaceable">
         <code>
          digest_type
         </code>
        </em>
        )
       </code>
      </a>
     </p>
     <a class="indexterm" name="idm46045231762848">
     </a>
     <p>
      Verifies whether the signature string matches the digest
          string, and returns 1 or 0 to indicate whether verification
          succeeded or failed. If verification fails, the result is
      <code class="literal">
       NULL
      </code>
      .
     </p>
     <p>
      By default, the
      <code class="literal">
       component_enterprise_encryption
      </code>
      function
          assumes that signatures use the RSASSA-PSS signature scheme.
          The function supports verification for signatures produced by
          the old
      <code class="literal">
       openssl_udf
      </code>
      shared library
          functions if the system variable
      <a class="link" href="server-system-variables.html#sysvar_enterprise_encryption.rsa_support_legacy_padding">
       <code class="literal">
        enterprise_encryption.rsa_support_legacy_padding
       </code>
      </a>
      is set to
      <code class="literal">
       ON
      </code>
      (the default is
      <code class="literal">
       OFF
      </code>
      ). When this is
      <code class="literal">
       ON
      </code>
      ,
          the function also supports the RSASSA-PKCS1-v1_5 signature
          scheme, as used by the old
      <code class="literal">
       openssl_udf
      </code>
      shared library functions; when it is
      <code class="literal">
       OFF
      </code>
      ,
          signatures produced by the legacy functions cannot be
          verified, and the function returns null output for such
          content.
     </p>
     <p>
      <em class="replaceable">
       <code>
        algorithm
       </code>
      </em>
      is the encryption
          algorithm used to create the key. The supported algorithm
          value is
      <code class="literal">
       'RSA'
      </code>
      .
     </p>
     <p>
      <em class="replaceable">
       <code>
        text
       </code>
      </em>
      is a data string or digest
          string. The component function accepts digests but does not
          require them, as it is also capable of handling data strings
          of an arbitrary length. A digest string can be generated by
          calling
      <a class="link" href="enterprise-encryption-functions.html#function_create-digest">
       <code class="literal">
        create_digest()
       </code>
      </a>
      .
     </p>
     <p>
      <em class="replaceable">
       <code>
        sig_str
       </code>
      </em>
      is the signature string to
          be verified. A signature string can be generated by calling
      <a class="link" href="enterprise-encryption-functions.html#function_asymmetric-sign">
       <code class="literal">
        asymmetric_sign()
       </code>
      </a>
      .
     </p>
     <p>
      <em class="replaceable">
       <code>
        pub_key_str
       </code>
      </em>
      is the public key
          string of the signer. It corresponds to the private key passed
          to
      <a class="link" href="enterprise-encryption-functions.html#function_asymmetric-sign">
       <code class="literal">
        asymmetric_sign()
       </code>
      </a>
      to
          generate the signature string. It must be a valid PEM encoded
          RSA public key.
     </p>
     <p>
      <em class="replaceable">
       <code>
        digest_type
       </code>
      </em>
      is the algorithm that
          was used to sign the data. The supported
      <em class="replaceable">
       <code>
        digest_type
       </code>
      </em>
      values are
      <code class="literal">
       'SHA224'
      </code>
      ,
      <code class="literal">
       'SHA256'
      </code>
      ,
      <code class="literal">
       'SHA384'
      </code>
      , and
      <code class="literal">
       'SHA512'
      </code>
      when OpenSSL 1.0.1 is in use. If OpenSSL 1.1.1 is in use, the
          additional
      <em class="replaceable">
       <code>
        digest_type
       </code>
      </em>
      values
      <code class="literal">
       'SHA3-224'
      </code>
      ,
      <code class="literal">
       'SHA3-256'
      </code>
      ,
      <code class="literal">
       'SHA3-384'
      </code>
      , and
      <code class="literal">
       'SHA3-512'
      </code>
      are available.
     </p>
     <div class="copytoclipboard-wrapper">
      <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa8873469"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token comment" spellcheck="true">-- Set the encryption algorithm and digest type</span>
<span class="token keyword">SET</span> <span class="token variable">@algo</span> <span class="token operator">=</span> <span class="token string">'RSA'</span><span class="token punctuation">;</span>
<span class="token keyword">SET</span> <span class="token variable">@dig_type</span> <span class="token operator">=</span> <span class="token string">'SHA512'</span><span class="token punctuation">;</span>

<span class="token comment" spellcheck="true">-- Create private/public key pair</span>
<span class="token keyword">SET</span> <span class="token variable">@priv</span> <span class="token operator">=</span> <span class="token function">create_asymmetric_priv_key</span><span class="token punctuation">(</span><span class="token variable">@algo</span><span class="token punctuation">,</span> <span class="token number">2048</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token keyword">SET</span> <span class="token variable">@pub</span> <span class="token operator">=</span> <span class="token function">create_asymmetric_pub_key</span><span class="token punctuation">(</span><span class="token variable">@algo</span><span class="token punctuation">,</span> <span class="token variable">@priv</span><span class="token punctuation">)</span><span class="token punctuation">;</span>

<span class="token comment" spellcheck="true">-- Generate digest from string</span>
<span class="token keyword">SET</span> <span class="token variable">@dig</span> <span class="token operator">=</span> <span class="token function">create_digest</span><span class="token punctuation">(</span><span class="token variable">@dig_type</span><span class="token punctuation">,</span> <span class="token string">'The quick brown fox'</span><span class="token punctuation">)</span><span class="token punctuation">;</span>

<span class="token comment" spellcheck="true">-- Generate signature for digest and verify signature against digest</span>
<span class="token keyword">SET</span> <span class="token variable">@sig</span> <span class="token operator">=</span> <span class="token function">asymmetric_sign</span><span class="token punctuation">(</span><span class="token variable">@algo</span><span class="token punctuation">,</span> <span class="token variable">@dig</span><span class="token punctuation">,</span> <span class="token variable">@priv</span><span class="token punctuation">,</span> <span class="token variable">@dig_type</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token keyword">SET</span> <span class="token variable">@verf</span> <span class="token operator">=</span> <span class="token function">asymmetric_verify</span><span class="token punctuation">(</span><span class="token variable">@algo</span><span class="token punctuation">,</span> <span class="token variable">@dig</span><span class="token punctuation">,</span> <span class="token variable">@sig</span><span class="token punctuation">,</span> <span class="token variable">@pub</span><span class="token punctuation">,</span> <span class="token variable">@dig_type</span><span class="token punctuation">)</span><span class="token punctuation">;</span></code></pre>
     </div>
    </li>
    <li class="listitem">
     <a name="function_create-asymmetric-priv-key">
     </a>
     <p>
      <a class="link" href="enterprise-encryption-functions.html#function_create-asymmetric-priv-key">
       <code class="literal">
        create_asymmetric_priv_key(
        <em class="replaceable">
         <code>
          algorithm
         </code>
        </em>
        ,
        <em class="replaceable">
         <code>
          key_length
         </code>
        </em>
        )
       </code>
      </a>
     </p>
     <a class="indexterm" name="idm46045231728320">
     </a>
     <p>
      Creates a private key using the given algorithm and key
          length, and returns the key as a binary string in PEM format.
          The key is in PKCS #8 format. If key generation fails, the
          result is
      <code class="literal">
       NULL
      </code>
      .
     </p>
     <p>
      For the legacy version of this function in use before MySQL
          8.0.29, see
      <a class="ulink" href="/doc/refman/8.0/en/enterprise-encryption-functions-legacy.html" target="_top">
       MySQL Enterprise Encryption Legacy Function Descriptions
      </a>
      .
     </p>
     <p>
      <em class="replaceable">
       <code>
        algorithm
       </code>
      </em>
      is the encryption
          algorithm used to create the key. The supported algorithm
          value is
      <code class="literal">
       'RSA'
      </code>
      .
     </p>
     <p>
      <em class="replaceable">
       <code>
        key_length
       </code>
      </em>
      is the key length in
          bits. If you exceed the maximum allowed key length or specify
          less than the minimum, key generation fails and the result is
          null output. The minimum allowed key length in bits is 2048.
          The maximum allowed key length is the value of the
      <a class="link" href="server-system-variables.html#sysvar_enterprise_encryption.maximum_rsa_key_size">
       <code class="literal">
        enterprise_encryption.maximum_rsa_key_size
       </code>
      </a>
      system variable, which defaults to 4096. It has a maximum
          setting of 16384, which is the maximum key length allowed for
          the RSA algorithm. See
      <a class="xref" href="enterprise-encryption-configuring.html" title="8.6.2 Configuring MySQL Enterprise Encryption">
       Section 8.6.2, “Configuring MySQL Enterprise Encryption”
      </a>
      .
     </p>
     <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
      <div class="admon-title">
       Note
      </div>
      <p>
       Generating longer keys can consume significant CPU
            resources. Limiting the key length using the
       <a class="link" href="server-system-variables.html#sysvar_enterprise_encryption.maximum_rsa_key_size">
        <code class="literal">
         enterprise_encryption.maximum_rsa_key_size
        </code>
       </a>
       system variable lets you provide adequate security for your
            requirements while balancing this with resource usage.
      </p>
     </div>
     <p>
      This example creates a 2048-bit RSA private key, then derives
          a public key from the private key:
     </p>
     <div class="copytoclipboard-wrapper">
      <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa1301430"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">SET</span> <span class="token variable">@priv</span> <span class="token operator">=</span> <span class="token function">create_asymmetric_priv_key</span><span class="token punctuation">(</span><span class="token string">'RSA'</span><span class="token punctuation">,</span> <span class="token number">2048</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token keyword">SET</span> <span class="token variable">@pub</span> <span class="token operator">=</span> <span class="token function">create_asymmetric_pub_key</span><span class="token punctuation">(</span><span class="token string">'RSA'</span><span class="token punctuation">,</span> <span class="token variable">@priv</span><span class="token punctuation">)</span><span class="token punctuation">;</span></code></pre>
     </div>
    </li>
    <li class="listitem">
     <a name="function_create-asymmetric-pub-key">
     </a>
     <p>
      <a class="link" href="enterprise-encryption-functions.html#function_create-asymmetric-pub-key">
       <code class="literal">
        create_asymmetric_pub_key(
        <em class="replaceable">
         <code>
          algorithm
         </code>
        </em>
        ,
        <em class="replaceable">
         <code>
          priv_key_str
         </code>
        </em>
        )
       </code>
      </a>
     </p>
     <a class="indexterm" name="idm46045231707616">
     </a>
     <p>
      Derives a public key from the given private key using the
          given algorithm, and returns the key as a binary string in PEM
          format. The key is in PKCS #8 format. If key derivation fails,
          the result is
      <code class="literal">
       NULL
      </code>
      .
     </p>
     <p>
      For the legacy version of this function in use before MySQL
          8.0.29, see
      <a class="ulink" href="/doc/refman/8.0/en/enterprise-encryption-functions-legacy.html" target="_top">
       MySQL Enterprise Encryption Legacy Function Descriptions
      </a>
      .
     </p>
     <p>
      <em class="replaceable">
       <code>
        algorithm
       </code>
      </em>
      is the encryption
          algorithm used to create the key. The supported algorithm
          value is
      <code class="literal">
       'RSA'
      </code>
      .
     </p>
     <p>
      <em class="replaceable">
       <code>
        priv_key_str
       </code>
      </em>
      is a valid PEM encoded
          RSA private key.
     </p>
     <p>
      For a usage example, see the description of
      <a class="link" href="enterprise-encryption-functions.html#function_create-asymmetric-priv-key">
       <code class="literal">
        create_asymmetric_priv_key()
       </code>
      </a>
      .
     </p>
    </li>
    <li class="listitem">
     <a name="function_create-digest">
     </a>
     <p>
      <a class="link" href="enterprise-encryption-functions.html#function_create-digest">
       <code class="literal">
        create_digest(
        <em class="replaceable">
         <code>
          digest_type
         </code>
        </em>
        ,
        <em class="replaceable">
         <code>
          str
         </code>
        </em>
        )
       </code>
      </a>
     </p>
     <a class="indexterm" name="idm46045231692720">
     </a>
     <p>
      Creates a digest from the given string using the given digest
          type, and returns the digest as a binary string. If digest
          generation fails, the result is
      <code class="literal">
       NULL
      </code>
      .
     </p>
     <p>
      For the legacy version of this function in use before MySQL
          8.0.29, see
      <a class="ulink" href="/doc/refman/8.0/en/enterprise-encryption-functions-legacy.html" target="_top">
       MySQL Enterprise Encryption Legacy Function Descriptions
      </a>
      .
     </p>
     <p>
      The resulting digest string is suitable for use with
      <a class="link" href="enterprise-encryption-functions.html#function_asymmetric-sign">
       <code class="literal">
        asymmetric_sign()
       </code>
      </a>
      and
      <a class="link" href="enterprise-encryption-functions.html#function_asymmetric-verify">
       <code class="literal">
        asymmetric_verify()
       </code>
      </a>
      . The
          component versions of these functions accept digests but do
          not require them, as they are capable of handling data of an
          arbitrary length.
     </p>
     <p>
      <em class="replaceable">
       <code>
        digest_type
       </code>
      </em>
      is the digest algorithm
          to be used to generate the digest string. The supported
      <em class="replaceable">
       <code>
        digest_type
       </code>
      </em>
      values are
      <code class="literal">
       'SHA224'
      </code>
      ,
      <code class="literal">
       'SHA256'
      </code>
      ,
      <code class="literal">
       'SHA384'
      </code>
      , and
      <code class="literal">
       'SHA512'
      </code>
      when OpenSSL 1.0.1 is in use. If OpenSSL 1.1.1 is in use, the
          additional
      <em class="replaceable">
       <code>
        digest_type
       </code>
      </em>
      values
      <code class="literal">
       'SHA3-224'
      </code>
      ,
      <code class="literal">
       'SHA3-256'
      </code>
      ,
      <code class="literal">
       'SHA3-384'
      </code>
      , and
      <code class="literal">
       'SHA3-512'
      </code>
      are available.
     </p>
     <p>
      <em class="replaceable">
       <code>
        str
       </code>
      </em>
      is the non-null data string for
          which the digest is to be generated.
     </p>
     <div class="copytoclipboard-wrapper">
      <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa15793625"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">SET</span> <span class="token variable">@dig</span> <span class="token operator">=</span> <span class="token function">create_digest</span><span class="token punctuation">(</span><span class="token string">'SHA512'</span><span class="token punctuation">,</span> <span class="token string">'The quick brown fox'</span><span class="token punctuation">)</span><span class="token punctuation">;</span></code></pre>
     </div>
    </li>
   </ul>
  </div>
 </div>
 <br/>
</div>
