keyring_file keyring plugin stores
keyring data in a file local to the server host.
For encryption key management, the
keyring_file plugin is not intended as a
regulatory compliance solution. Security standards such as
PCI, FIPS, and others require use of key management systems to
secure, manage, and protect encryption keys in key vaults or
hardware security modules (HSMs).
keyring_file, use the general
instructions found in
Section 6.4.1, “Keyring Plugin Installation”, together with the
configuration information specific to
keyring_file found here.
To be usable during the server startup process,
keyring_file must be loaded using the
--early-plugin-load option. The
variable optionally configures the location of the file used by
keyring_file plugin for data storage. The
default value is platform specific. To configure the file
location explicitly, set the variable value at startup. For
example, use these lines in the server
my.cnf file, adjusting the
.so suffix and file location for your
platform as necessary:
[mysqld] early-plugin-load=keyring_file.so keyring_file_data=/usr/local/mysql/mysql-keyring/keyring
Keyring operations are transactional: The
keyring_file plugin uses a backup file during
write operations to ensure that it can roll back to the original
file if an operation fails. The backup file has the same name as
the value of the
variable with a suffix of
For additional information about
Section 6.4.12, “Keyring System Variables”.
As of MySQL 5.7.17, to ensure that keys are flushed only when
the correct keyring storage file exists,
keyring_file stores a SHA-256 checksum of the
keyring in the file. Before updating the file, the plugin
verifies that it contains the expected checksum.
keyring_file plugin supports the
functions that comprise the standard MySQL Keyring service
interface. Keyring operations performed by those functions are
accessible at two levels:
SQL interface: In SQL statements, call the functions described in Section 6.4.8, “General-Purpose Keyring Key-Management Functions”.
C interface: In C-language code, call the keyring service functions described in The Keyring Service.
Example (using the SQL interface):
SELECT keyring_key_generate('MyKey', 'AES', 32); SELECT keyring_key_remove('MyKey');
For information about the characteristics of key values
Section 6.4.6, “Supported Keyring Key Types and Lengths”.