You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/data-loading.md
+1-1Lines changed: 1 addition & 1 deletion
Original file line number
Diff line number
Diff line change
@@ -121,7 +121,7 @@ need to truncate the table and loading data again.
121
121
122
122
!!! warning
123
123
124
-
If you are loading large data without enabling [rocksdb_bulk_load](variables.md#rocksdb_bulk_load) or [rocksdb_commit_in_the_middle](variables.md#rocksdb-commit-in-the-middle), please make sure transaction size is small enough. All modifications of the ongoing transactions are kept in memory.
124
+
If you are loading large data without enabling [rocksdb_bulk_load](variables.md#rocksdb_bulk_load) or [rocksdb_commit_in_the_middle](variables.md#rocksdb_commit_in_the_middle), please make sure transaction size is small enough. All modifications of the ongoing transactions are kept in memory.
|[`dictionaries_flush_interval_seconds (integer, unsigned)`](#dictionaries_flush_interval_secondsinteger-unsigned)| The number of seconds between updates to the internal dictionary cache to match changes in the dictionaries table.|
966
-
|[`masking_database(str)`](#masking_databasestr)| Set a different database name to use for the dictionaries table. |
966
+
|[`masking_database(string)`](#masking_databasestring)| Set a different database name to use for the dictionaries table. |
Copy file name to clipboardExpand all lines: docs/data-masking-overview.md
+1-1Lines changed: 1 addition & 1 deletion
Original file line number
Diff line number
Diff line change
@@ -39,7 +39,7 @@ To fix this, you can use the new [`masking_dictionaries_flush()`](data-masking-f
39
39
40
40
The changes also affect how row-based replication works. When dictionary changes happen on the source server, they travel through the binary log to the replica server. While the replica applies these changes to its table correctly, the dictionary term cache doesn't update right away.
41
41
42
-
To handle this, there's a new system setting called [`component_masking_functions.dictionaries_flush_interval_seconds()`](data-masking-function-list.html#dictionaries_flush_interval_secondsinteger-unsigned)
42
+
To handle this, there's a new system setting called [`component_masking_functions.dictionaries_flush_interval_seconds()`](data-masking-function-list.md#dictionaries_flush_interval_secondsinteger-unsigned)
43
43
44
44
By default, it's set to 0. When you set it higher, the system starts a background process that refreshes the cache at your specified interval. This helps replicas stay in sync after receiving binary log updates. The value specifies the number of seconds between each sync.
Copy file name to clipboardExpand all lines: docs/encrypting-doublewrite-buffers.md
+2-2Lines changed: 2 additions & 2 deletions
Original file line number
Diff line number
Diff line change
@@ -5,8 +5,8 @@ A summary of Doublewrite buffer and Doublewrite buffer encryption changes:
5
5
|_Percona Server for MySQL_ Versions| Doublewrite Buffer and Doublewrite Buffer Encryption Implementation|
6
6
|---|---|
7
7
|Percona Server from Percona-Server-8.0.23-14|_MySQL_ 8.0.23 implemented its own version of [parallel doublewrite encryption](https://dev.mysql.com/doc/refman/8.0/en/innodb-data-encryption.html#innodb-doublewrite-file-encryption). Pages that belong to encrypted tablespaces are also written into the doublewrite buffer in an encrypted form. The Percona implementation was reverted and the[innodb_parallel_dblwr_encrypt](#innodb_parallel_dblwr_encrypt) is deprecated and may be removed in later releases.
8
-
|Percona Server from Percona-Server-8.0.20-11 to Percona-Server-8.0.22-13 inclusive|_MySQL_ 8.0.20 implemented its own [parallel doublewrite buffer](https://dev.mysql.com/doc/refman/8.0/en/innodb-doublewrite-buffer.html), which is stored in external files (#ib\_16384\_xxx.dblwr) and not stored in the system tablespace. Percona’s implementation was reverted. As a result, [innodb\_parallel\_doublewrite\_path](xtradb-performance-improvements-io-bound-highly-concurrent-workloads.md#innodb-parallel-doublewrite-path) was deprecated. <br> However, _MySQL_ did not implement parallel doublewrite buffer encryption at this time, so Percona reimplemented parallel doublewrite buffer encryption on top of the _MySQL_ parallel doublewrite buffer implementation. Percona preserved the meaning and functionality of the [innodb\_parallel\_dblwr\_encrypt](#innodb_parallel_dblwr_encrypt) variable. |
9
-
|Percona-Server-8.0.12-1.alpha to Percona-Server-8.0.19-10 inclusive|_Percona Server for MySQL_ had its own implementation of the parallel doublewrite buffer which was enabled by setting the [innodb\_parallel\_doublewrite\_path](xtradb-performance-improvements-io-bound-highly-concurrent-workloads.md#innodb-parallel-doublewrite-path) variable. <br> Enabling the [innodb\_parallel\_dblwr\_encrypt](#innodbparalleldblwrencrypt) controlled whether the parallel doublewrite pages were encrypted or not. In case the parallel doublewrite buffer was disabled ([innodb\_parallel\_doublewrite\_path](xtradb-performance-improvements-io-bound-highly-concurrent-workloads.md#innodb-parallel-doublewrite-path) was set to empty string),the doublewrite buffer pages were located in the system tablespace (ibdata1). The system tablespace itself could be encrypted by setting [innodb\_sys\_tablespace\_encrypt](encrypting-system-tablespace.md#innodb-sys-tablespace-encrypt), which also encrypted the doublewrite buffer pages.|
8
+
|Percona Server from Percona-Server-8.0.20-11 to Percona-Server-8.0.22-13 inclusive|_MySQL_ 8.0.20 implemented its own [parallel doublewrite buffer](https://dev.mysql.com/doc/refman/8.0/en/innodb-doublewrite-buffer.html), which is stored in external files (#ib\_16384\_xxx.dblwr) and not stored in the system tablespace. Percona’s implementation was reverted. As a result, [innodb\_parallel\_doublewrite\_path](xtradb-performance-improvements-io-bound-highly-concurrent-workloads.md#innodb_parallel_doublewrite_path) was deprecated. <br> However, _MySQL_ did not implement parallel doublewrite buffer encryption at this time, so Percona reimplemented parallel doublewrite buffer encryption on top of the _MySQL_ parallel doublewrite buffer implementation. Percona preserved the meaning and functionality of the [innodb\_parallel\_dblwr\_encrypt](#innodb_parallel_dblwr_encrypt) variable. |
9
+
|Percona-Server-8.0.12-1.alpha to Percona-Server-8.0.19-10 inclusive|_Percona Server for MySQL_ had its own implementation of the parallel doublewrite buffer which was enabled by setting the [innodb\_parallel\_doublewrite\_path](xtradb-performance-improvements-io-bound-highly-concurrent-workloads.md#innodb_parallel_doublewrite_path) variable. <br> Enabling the [innodb\_parallel\_dblwr\_encrypt](#innodb_parallel_dblwr_encrypt) controlled whether the parallel doublewrite pages were encrypted or not. In case the parallel doublewrite buffer was disabled ([innodb\_parallel\_doublewrite\_path](xtradb-performance-improvements-io-bound-highly-concurrent-workloads.md#innodb_parallel_doublewrite_path) was set to empty string),the doublewrite buffer pages were located in the system tablespace (ibdata1). The system tablespace itself could be encrypted by setting [innodb\_sys\_tablespace\_encrypt](encrypting-system-tablespace.md#innodb_sys_tablespace_encrypt), which also encrypted the doublewrite buffer pages.|
10
10
11
11
For *Percona Server for MySQL* versions below *Percona Server for MySQL* version 8.0.23-14, *Percona* encrypts the `doublewrite buffer` using [innodb_parallel_dblwr_encrypt](#innodb_parallel_dblwr_encrypt).
Copy file name to clipboardExpand all lines: docs/encryption-functions-overview.md
+2-8Lines changed: 2 additions & 8 deletions
Original file line number
Diff line number
Diff line change
@@ -1,9 +1,7 @@
1
-
##Encryption functions overview
1
+
# Encryption functions overview
2
2
3
3
This document provides comprehensive information about encryption functions that transform plaintext data into encrypted ciphertext. These functions provide robust security measures that require proper documentation to implement and maintain effectively. This guide offers the necessary information for successful implementation.
4
4
5
-
6
-
7
5
## Overview of capabilities
8
6
9
7
This documentation will guide you through:
@@ -16,12 +14,8 @@ This documentation will guide you through:
16
14
17
15
* Avoiding common implementation pitfalls
18
16
19
-
20
-
21
-
22
17
First, let's review some key terms you'll encounter throughout this guide.
23
18
24
-
25
19
## Glossary of terms
26
20
27
21
Here's a quick reference guide to the cryptographic terms used in this document:
@@ -122,7 +116,7 @@ Percona Server for MySQL 8.0.41 introduces several important new features that e
122
116
123
117
### Other new features
124
118
125
-
*[`encryption_udf.legacy_padding_scheme`](#encryption_udflegacy_padding_scheme) system variable - provides compatibility with legacy systems and previous implementations
119
+
*[`encryption_udf.legacy_padding_scheme`](encryption-functions.md#encryption_udflegacy_padding_scheme) system variable - provides compatibility with legacy systems and previous implementations
126
120
127
121
* Character set awareness - ensures proper handling of different character encodings during encryption operations
| **Encryption** | [asymmetric_encrypt()](#asymmetric_encryptalgorithm-str-key_str) | Puts your data in a math lockbox | Protecting sensitive data |
36
+
| | [asymmetric_decrypt()](#asymmetric_decryptalgorithm-crypt_str-key_str) | Opens the lockbox and gets your data back | Retrieving protected data |
37
+
| **Key Management** | [create_asymmetric_priv_key()](#create_asymmetric_priv_keyalgorithm-key_len) | Makes your secret key | Creating your private key |
38
+
| | [create_asymmetric_pub_key()](#create_asymmetric_pub_keyalgorithm-priv_key_str) | Creates a shareable public key | Generating keys to distribute |
39
+
| **Digital Signatures** | [asymmetric_sign()](#asymmetric_signalgorithm-digest_str-priv_key_str-digest_type-padding) | Stamps your message with your secret key | Proving a message is from you |
40
+
| | [asymmetric_verify()](#asymmetric_verifyalgorithm-digest_str-sig_str-pub_key_str-digest_type-padding) | Checks if a signature is real or fake | Verifying message authenticity |
41
+
74
42
75
43
### Asymmetric encryption functions
76
44
77
45
These functions implement public key cryptography utilizing key pairs. The encryption and decryption operations require different keys from the same key pair.
78
46
79
47
| Function Name | Purpose |
80
48
| --- | --- |
81
-
| [asymmetric_encrypt](#asymmetric_encrypt) | Encrypts plaintext data using asymmetric cryptography. Only the corresponding key can decrypt. |
82
-
| [asymmetric_decrypt](#asymmetric_decrypt) | Decrypts ciphertext that was encrypted with the corresponding asymmetric key. |
49
+
| [asymmetric_encrypt](#asymmetric_encryptalgorithm-str-key_str) | Encrypts plaintext data using asymmetric cryptography. Only the corresponding key can decrypt. |
50
+
| [asymmetric_decrypt](#asymmetric_decryptalgorithm-crypt_str-key_str) | Decrypts ciphertext that was encrypted with the corresponding asymmetric key. |
83
51
84
52
85
53
### Asymmetric key management functions
@@ -88,8 +56,8 @@ These functions facilitate the generation and management of asymmetric cryptogra
88
56
89
57
| Function Name | Description |
90
58
| --- | --- |
91
-
| [create_asymmetric_priv_key](#create_asymmetric_priv_key) | Generates a private key with specified algorithm and security parameters |
92
-
| [create_asymmetric_pub_key](#create_asymmetric_pub_key) | Derives the corresponding public key from a private key for distribution |
59
+
| [create_asymmetric_priv_key](#create_asymmetric_priv_keyalgorithm-key_len) | Generates a private key with specified algorithm and security parameters |
60
+
| [create_asymmetric_pub_key](#create_asymmetric_pub_keyalgorithm-priv_key_str) | Derives the corresponding public key from a private key for distribution |
93
61
94
62
95
63
### Digital Signature functions
@@ -98,8 +66,8 @@ These functions implement digital signature operations for message authenticatio
98
66
99
67
| Function Name | Description |
100
68
| --- | --- |
101
-
| [asymmetric_sign](#asymmetric_sign) | Applies a cryptographic signature to a message digest using a private key |
102
-
| [asymmetric_verify](#asymmetric_verify) | Validates the authenticity of a digital signature using the corresponding public key |
69
+
| [asymmetric_sign](#asymmetric_signalgorithm-digest_str-priv_key_str-digest_type-padding) | Applies a cryptographic signature to a message digest using a private key |
70
+
| [asymmetric_verify](#asymmetric_verifyalgorithm-digest_str-sig_str-pub_key_str-digest_type-padding) | Validates the authenticity of a digital signature using the corresponding public key |
103
71
104
72
### Diffie-Hellman functions
105
73
@@ -109,8 +77,8 @@ These functions implement digital signature operations for message authenticatio
109
77
110
78
| Function Name | Description | Application |
111
79
| --- | --- | --- |
112
-
| [asymmetric_derive](#asymmetric_derive) | Generates a shared cryptographic secret through asymmetric key combination | When implementing secure communication channels between parties |
113
-
| [create_dh_parameters](#create_dh_parameters) | Generates the prime numbers and parameters required for Diffie-Hellman key exchange | As a prerequisite for Diffie-Hellman key generation |
80
+
| [asymmetric_derive](#asymmetric_derivepub_key_str-priv_key_str) | Generates a shared cryptographic secret through asymmetric key combination | When implementing secure communication channels between parties |
81
+
| [create_dh_parameters](#create_dh_parameterskey_len) | Generates the prime numbers and parameters required for Diffie-Hellman key exchange | As a prerequisite for Diffie-Hellman key generation |
114
82
115
83
116
84
### Encryption threshold variables
@@ -121,43 +89,13 @@ These functions implement digital signature operations for message authenticatio
121
89
122
90
Keys that are too strong might slow down your system. It's like having a super-heavy padlock that takes forever to open.
| [encryption_udf.dh_bits_threshold](#encryption_udfdh_bits_threshold) | Sets how strong Diffie-Hellman keys can be | 10000 | 1024-10000 | Higher values significantly increase key generation time |
95
+
| [encryption_udf.dsa_bits_threshold](#encryption_udfdsa_bits_threshold) | Sets how strong DSA keys can be | 9984 | 1024-9984 | Higher values increase key generation time |
96
+
| [encryption_udf.rsa_bits_threshold](#encryption_udfrsa_bits_threshold) | Sets how strong RSA keys can be | 16384 | 1024-16384 | Higher values increase key generation and encryption/decryption time |
97
+
| [encryption_udf.legacy_padding](#encryption_udflegacy_padding_scheme) | Turns old-style padding on or off | OFF | ON/OFF | Minor impact on encryption speed, major impact on security |
98
+
161
99
---
162
100
163
101
@@ -193,7 +131,7 @@ SELECT * FROM mysql.component;
@@ -338,10 +276,11 @@ The function returns the encrypted ciphertext as binary data.
338
276
</details>
339
277
340
278
⚠️ **Size Limits**: Remember that your message size is limited by your key size and padding method. For a 2048-bit key with OAEP padding, your message must be smaller than (2048/8)-42 = 214 bytes.
This function creates the special math values for Diffie-Hellman keys. It's like creating a recipe that two people will follow to create identical secret sauces without ever sharing their individual ingredients.
573
512
574
513
### Warning: Patience required!
575
514
This can take a LONG time - much longer than making regular keys. Cancel with:
515
+
576
516
```
577
517
KILL [QUERY|CONNECTION] <id>
578
518
```
@@ -590,7 +530,8 @@ A block of special values in PEM format. You'll use these later when creating DH
590
530
* Choose between 1,024 and 10,000 bits
591
531
* Default is 10,000 (strongest but slowest)
592
532
* Admins can adjust the maximum with encryption_udf.dh_bits_threshold
0 commit comments