MySQL 8.4 Release Notes
MySQL 企业加密允许您将密钥长度限制在一个既能满足安全要求又能平衡资源使用的范围内。您还可以配置 component_enterprise_encryption 组件提供的函数，以支持对旧的 openssl_udf 共享库函数生成的内容进行解密和验证。MySQL Enterprise Encryption lets you limit keys to a length that provides adequate
security for your requirements while balancing this with resource
usage. You can also configure the functions provided by the
component_enterprise_encryption component to
support decryption and verification for content produced by the
old openssl_udf shared library functions.
默认情况下，component_enterprise_encryption 组件提供的函数不会解密由早期版本中 openssl_udf 共享库提供的旧版函数生成的加密文本，也不会验证签名。该组件函数假设加密文本使用 RSAES-OAEP 填充方案，签名使用 RSASSA-PSS 签名方案。然而，旧版函数生成的加密文本使用 RSAES-PKCS1-v1_5 填充方案，旧版函数生成的签名使用 RSASSA-PKCS1-v1_5 签名方案。By default, the functions provided by the
component_enterprise_encryption component do
not decrypt encrypted text, or verify signatures, that were
produced by the legacy functions provided in earlier releases by
the openssl_udf shared library. The component
functions assume that encrypted text uses the RSAES-OAEP padding
scheme, and signatures use the RSASSA-PSS signature scheme.
However, encrypted text produced by the legacy functions uses
the RSAES-PKCS1-v1_5 padding scheme, and signatures produced by
the legacy functions use the RSASSA-PKCS1-v1_5 signature scheme.
如果您希望组件函数支持由旧版函数生成的内容，请将 enterprise_encryption.rsa_support_legacy_padding 系统变量设置为 ON。当组件安装时，此变量可用。当您将其设置为 ON 时，组件函数首先尝试按其正常方案解密或验证内容。如果不起作用，它们还会尝试按旧函数使用的方案解密或验证内容。此行为不是默认设置，因为它会增加处理无法解密或验证内容的时间。如果您不处理由旧函数生成的内容，请保持系统变量为默认的 OFF。If you want the component functions to support content produced
by the legacy functions, set the
enterprise_encryption.rsa_support_legacy_padding
system variable to ON. This variable is
available when the component is installed. When you set it to
ON, the component functions first attempt to
decrypt or verify content assuming it has their normal schemes.
If that does not work, they also attempt to decrypt or verify
the content assuming it has the schemes used by the old
functions. This behavior is not the default because it increases
the time taken to process content that cannot be decrypted or
verified at all. If you are not handling content produced by the
old functions, let the system variable default to
OFF.
MySQL Enterprise Encryption 的密钥生成函数所需的 CPU 资源随着密钥长度的增加而增加。对于某些安装，如果应用程序频繁生成过长的密钥，这可能导致无法接受的 CPU 使用率。The amount of CPU resources required by MySQL Enterprise Encryption's key generation functions increases as the key length increases. For some installations, this might result in unacceptable CPU usage if applications frequently generate excessively long keys.
component_enterprise_encryption 组件提供的功能对 RSA 密钥的最小密钥长度为 2048 位，这符合当前最低密钥长度的最佳实践。enterprise_encryption.maximum_rsa_key_size 系统变量指定了最大密钥大小。The functions provided by the
component_enterprise_encryption component
have a minimum key length of 2048 bits for RSA keys, which is in
line with current best practice for minimum key lengths. The
enterprise_encryption.maximum_rsa_key_size
system variable specifies the maximum key size.