对于类型错误的参数或参数数量不正确的情况，每个函数都会返回错误。For arguments of the wrong type or an incorrect number of arguments, each function returns an error.

如果参数不适合让函数执行请求的操作，它将返回NULL或 0，视情况而定。例如，如果函数不支持指定的算法、密钥长度过短或过长，或预期为 PEM 格式密钥字符串的字符串不是有效密钥，就会发生这种情况。If the arguments are not suitable to permit a function to perform the requested operation, it returns NULL or 0 as appropriate. This occurs, for example, if a function does not support a specified algorithm, a key length is too short or long, or a string expected to be a key string in PEM format is not a valid key.

底层的 SSL 库负责随机性初始化。The underlying SSL library takes care of randomness initialization.

asymmetric_decrypt(algorithm, data_str, priv_key_str)

使用给定的算法和密钥字符串解密加密的字符串，并以二进制字符串形式返回结果明文。如果解密失败，结果为 NULL。Decrypts an encrypted string using the given algorithm and key string, and returns the resulting plaintext as a binary string. If decryption fails, the result is NULL.

对于在 MySQL 8.0.29 之前使用的该函数的旧版本，请参见 MySQL 企业加密旧版函数说明。For the legacy version of this function in use before MySQL 8.0.29, see MySQL Enterprise Encryption Legacy Function Descriptions.

默认情况下，component_enterprise_encryption 函数假定加密文本使用 RSAES-OAEP 填充方案。如果系统变量 enterprise_encryption.rsa_support_legacy_padding 设置为 ON（默认值为 OFF），该函数支持解密由旧的 openssl_udf 共享库函数加密的内容。当该变量为 ON 时，函数还支持 RSAES-PKCS1-v1_5 填充方案，该方案用于旧的 openssl_udf 共享库函数。当该变量设置为 OFF 时，由旧函数加密的内容无法解密，函数对该类内容返回 null 输出。By default, the component_enterprise_encryption function assumes that encrypted text uses the RSAES-OAEP padding scheme. The function supports decryption for content encrypted by the old openssl_udf shared library functions if the system variable enterprise_encryption.rsa_support_legacy_padding is set to ON (the default is OFF). When this is ON, the function also supports the RSAES-PKCS1-v1_5 padding scheme, as used by the old openssl_udf shared library functions. When the variable is set to OFF, content encrypted by the legacy functions cannot be decrypted, and the function returns null output for such content.

algorithm 是用于创建密钥的加密算法。支持的算法值为 'RSA'。algorithm is the encryption algorithm used to create the key. The supported algorithm value is 'RSA'.

data_str 是要解密的加密字符串，该字符串是使用 asymmetric_encrypt() 加密的。data_str is the encrypted string to decrypt, which was encrypted with asymmetric_encrypt().

priv_key_str 是一个有效的 PEM 编码的 RSA 私钥。为了成功解密，密钥字符串必须与用于 asymmetric_encrypt() 生成加密字符串的公钥字符串相对应。asymmetric_encrypt() 组件函数仅支持使用公钥进行加密，因此解密需要使用对应的私钥进行。priv_key_str is a valid PEM encoded RSA private key. For successful decryption, the key string must correspond to the public key string used with asymmetric_encrypt() to produce the encrypted string. The asymmetric_encrypt() component function only supports encryption using a public key, so decryption takes place with the corresponding private key.

有关使用示例，请参见 asymmetric_encrypt() 的说明。For a usage example, see the description of asymmetric_encrypt().

asymmetric_encrypt(algorithm, data_str, pub_key_str)

使用指定的算法和密钥字符串加密一个字符串，并返回生成的密文（二进制字符串）。如果加密失败，结果为NULL。Encrypts a string using the given algorithm and key string, and returns the resulting ciphertext as a binary string. If encryption fails, the result is NULL.

对于在 MySQL 8.0.29 之前使用的该函数的旧版本，请参见 MySQL 企业加密旧版函数说明。For the legacy version of this function in use before MySQL 8.0.29, see MySQL Enterprise Encryption Legacy Function Descriptions.

algorithm 是用于创建密钥的加密算法。支持的算法值为 'RSA'。algorithm is the encryption algorithm used to create the key. The supported algorithm value is 'RSA'.

data_str是要加密的字符串。该字符串的长度不能大于密钥字符串长度（以字节为单位）减去 42（用于填充）。data_str is the string to encrypt. The length of this string cannot be greater than the key string length in bytes, minus 42 (to account for the padding).

pub_key_str 是一个有效的 PEM 编码的 RSA 公钥。asymmetric_encrypt() 组件函数仅支持使用公钥进行加密。pub_key_str is a valid PEM encoded RSA public key. The asymmetric_encrypt() component function only supports encryption using a public key.

要恢复原始的未加密字符串，请将加密后的字符串传递给 asymmetric_decrypt()，以及用于加密的密钥对的另一部分，如下例所示：To recover the original unencrypted string, pass the encrypted string to asymmetric_decrypt(), along with the other part of the key pair used for encryption, as in the following example:

-- Generate private/public key pair
SET @priv = create_asymmetric_priv_key('RSA', 2048);
SET @pub = create_asymmetric_pub_key('RSA', @priv);

-- Encrypt using public key, decrypt using private key
SET @ciphertext = asymmetric_encrypt('RSA', 'The quick brown fox', @pub);
SET @plaintext = asymmetric_decrypt('RSA', @ciphertext, @priv);

假设：Suppose that:

SET @s = a string to be encrypted
SET @priv = a valid private RSA key string in PEM format
SET @pub = the corresponding public RSA key string in PEM format

那么这些恒等关系成立：Then these identity relationships hold:

asymmetric_decrypt('RSA', asymmetric_encrypt('RSA', @s, @pub), @priv) = @s

asymmetric_sign(algorithm, text, priv_key_str, digest_type)

使用私钥对摘要字符串或数据字符串进行签名，并返回二进制字符串形式的签名。如果签名失败，结果为 NULL。Signs a digest string or data string using a private key, and returns the signature as a binary string. If signing fails, the result is NULL.

对于在 MySQL 8.0.29 之前使用的该函数的旧版本，请参见 MySQL 企业加密旧版函数说明。For the legacy version of this function in use before MySQL 8.0.29, see MySQL Enterprise Encryption Legacy Function Descriptions.

algorithm 是用于创建密钥的加密算法。支持的算法值为 'RSA'。algorithm is the encryption algorithm used to create the key. The supported algorithm value is 'RSA'.

text 是数据字符串或摘要字符串。该函数接受摘要，但不要求必须使用摘要，因为它也能够处理任意长度的数据字符串。摘要字符串可以通过调用 create_digest() 生成。text is a data string or digest string. The function accepts digests but does not require them, as it is also capable of handling data strings of an arbitrary length. A digest string can be generated by calling create_digest().

priv_key_str 是用于签名摘要字符串的私钥字符串。它必须是有效的 PEM 编码的 RSA 私钥。priv_key_str is the private key string to use for signing the digest string. It must be a valid PEM encoded RSA private key.

digest_type 是用于签名数据的算法。当使用 OpenSSL 1.0.1 时，支持的 digest_type 值有 'SHA224'、'SHA256'、'SHA384' 和 'SHA512'。如果使用的是 OpenSSL 1.1.1，则额外支持 digest_type 值 'SHA3-224'、'SHA3-256'、'SHA3-384' 和 'SHA3-512'。digest_type is the algorithm to be used to sign the data. The supported digest_type values are 'SHA224', 'SHA256', 'SHA384', and 'SHA512' when OpenSSL 1.0.1 is in use. If OpenSSL 1.1.1 is in use, the additional digest_type values 'SHA3-224', 'SHA3-256', 'SHA3-384', and 'SHA3-512' are available.

有关使用示例，请参阅 asymmetric_verify() 的描述。For a usage example, see the description of asymmetric_verify().

asymmetric_verify(algorithm, text, sig_str, pub_key_str, digest_type)

验证签名字符串是否与摘要字符串匹配，并返回 1 或 0 以指示验证是否成功。如果验证失败，结果为 NULL。Verifies whether the signature string matches the digest string, and returns 1 or 0 to indicate whether verification succeeded or failed. If verification fails, the result is NULL.

默认情况下，component_enterprise_encryption 函数假定签名使用 RSASSA-PSS 签名方案。如果系统变量 enterprise_encryption.rsa_support_legacy_padding 设置为 ON（默认值为 OFF），该函数支持验证由旧的 openssl_udf 共享库函数生成的签名。当该选项为 ON 时，函数还支持 RSASSA-PKCS1-v1_5 签名方案，该方案由旧的 openssl_udf 共享库函数使用；当其为 OFF 时，无法验证由旧函数生成的签名，并且函数会对这些内容返回空输出。By default, the component_enterprise_encryption function assumes that signatures use the RSASSA-PSS signature scheme. The function supports verification for signatures produced by the old openssl_udf shared library functions if the system variable enterprise_encryption.rsa_support_legacy_padding is set to ON (the default is OFF). When this is ON, the function also supports the RSASSA-PKCS1-v1_5 signature scheme, as used by the old openssl_udf shared library functions; when it is OFF, signatures produced by the legacy functions cannot be verified, and the function returns null output for such content.

algorithm 是用于创建密钥的加密算法。支持的算法值为 'RSA'。algorithm is the encryption algorithm used to create the key. The supported algorithm value is 'RSA'.

text 是一个数据字符串或摘要字符串。组件函数接受摘要字符串，但不要求必须提供，因为它也能够处理任意长度的数据字符串。可以通过调用 create_digest() 生成摘要字符串。text is a data string or digest string. The component function accepts digests but does not require them, as it is also capable of handling data strings of an arbitrary length. A digest string can be generated by calling create_digest().

sig_str 是要验证的签名字符串。可以通过调用 asymmetric_sign() 生成签名字符串。sig_str is the signature string to be verified. A signature string can be generated by calling asymmetric_sign().

pub_key_str 是签名者的公钥字符串。它对应于传递给 asymmetric_sign() 用于生成签名字符串的私钥。它必须是有效的 PEM 编码的 RSA 公钥。pub_key_str is the public key string of the signer. It corresponds to the private key passed to asymmetric_sign() to generate the signature string. It must be a valid PEM encoded RSA public key.

digest_type 是用于签名数据的算法。支持的 digest_type 值为 'SHA224'、'SHA256'、'SHA384' 和 'SHA512'，当使用 OpenSSL 1.0.1 时。如果使用 OpenSSL 1.1.1，则还可以使用额外的 digest_type 值 'SHA3-224'、'SHA3-256'、'SHA3-384' 和 'SHA3-512'。digest_type is the algorithm that was used to sign the data. The supported digest_type values are 'SHA224', 'SHA256', 'SHA384', and 'SHA512' when OpenSSL 1.0.1 is in use. If OpenSSL 1.1.1 is in use, the additional digest_type values 'SHA3-224', 'SHA3-256', 'SHA3-384', and 'SHA3-512' are available.

-- Set the encryption algorithm and digest type
SET @algo = 'RSA';
SET @dig_type = 'SHA512';

-- Create private/public key pair
SET @priv = create_asymmetric_priv_key(@algo, 2048);
SET @pub = create_asymmetric_pub_key(@algo, @priv);

-- Generate digest from string
SET @dig = create_digest(@dig_type, 'The quick brown fox');

-- Generate signature for digest and verify signature against digest
SET @sig = asymmetric_sign(@algo, @dig, @priv, @dig_type);
SET @verf = asymmetric_verify(@algo, @dig, @sig, @pub, @dig_type);

create_asymmetric_priv_key(algorithm, key_length)

使用给定的算法和密钥长度创建一个私钥，并以 PEM 格式的二进制字符串返回该密钥。该密钥采用 PKCS #8 格式。如果密钥生成失败，结果为 NULL。Creates a private key using the given algorithm and key length, and returns the key as a binary string in PEM format. The key is in PKCS #8 format. If key generation fails, the result is NULL.

对于在 MySQL 8.0.29 之前使用的该函数的旧版本，请参见 MySQL 企业加密旧版函数说明。For the legacy version of this function in use before MySQL 8.0.29, see MySQL Enterprise Encryption Legacy Function Descriptions.

algorithm 是用于创建密钥的加密算法。支持的算法值为 'RSA'。algorithm is the encryption algorithm used to create the key. The supported algorithm value is 'RSA'.

key_length 是以比特为单位的密钥长度。如果超过允许的最大密钥长度或指定的长度小于最小值，则密钥生成失败，结果为 null 输出。允许的最小密钥长度为 2048 位。允许的最大密钥长度是 enterprise_encryption.maximum_rsa_key_size 系统变量的值，默认值为 4096。其最大设置为 16384，这是 RSA 算法允许的最大密钥长度。参见 第 8.6.2 节，“配置 MySQL 企业版加密”。key_length is the key length in bits. If you exceed the maximum allowed key length or specify less than the minimum, key generation fails and the result is null output. The minimum allowed key length in bits is 2048. The maximum allowed key length is the value of the enterprise_encryption.maximum_rsa_key_size system variable, which defaults to 4096. It has a maximum setting of 16384, which is the maximum key length allowed for the RSA algorithm. See Section 8.6.2, “Configuring MySQL Enterprise Encryption”.

这个例子创建了一个 2048 位的 RSA 私钥，然后从私钥派生公钥：This example creates a 2048-bit RSA private key, then derives a public key from the private key:

SET @priv = create_asymmetric_priv_key('RSA', 2048);
SET @pub = create_asymmetric_pub_key('RSA', @priv);

create_asymmetric_pub_key(algorithm, priv_key_str)

使用给定的算法从指定的私钥派生公钥，并以 PEM 格式的二进制字符串返回该密钥。该密钥为 PKCS #8 格式。如密钥派生失败，结果为 NULL。Derives a public key from the given private key using the given algorithm, and returns the key as a binary string in PEM format. The key is in PKCS #8 format. If key derivation fails, the result is NULL.

对于在 MySQL 8.0.29 之前使用的该函数的旧版本，请参见 MySQL 企业加密旧版函数说明。For the legacy version of this function in use before MySQL 8.0.29, see MySQL Enterprise Encryption Legacy Function Descriptions.

algorithm 是用于创建密钥的加密算法。支持的算法值为 'RSA'。algorithm is the encryption algorithm used to create the key. The supported algorithm value is 'RSA'.

priv_key_str 是一个有效的 PEM 编码的 RSA 私钥。priv_key_str is a valid PEM encoded RSA private key.

有关使用示例，请参见 create_asymmetric_priv_key() 的描述。For a usage example, see the description of create_asymmetric_priv_key().

create_digest(digest_type, str)

使用给定的摘要类型从指定字符串创建摘要，并返回二进制字符串形式的摘要。如果摘要生成失败，结果为NULL。Creates a digest from the given string using the given digest type, and returns the digest as a binary string. If digest generation fails, the result is NULL.

对于在 MySQL 8.0.29 之前使用的该函数的旧版本，请参见 MySQL 企业加密旧版函数说明。For the legacy version of this function in use before MySQL 8.0.29, see MySQL Enterprise Encryption Legacy Function Descriptions.

生成的摘要字符串适用于asymmetric_sign()和asymmetric_verify()。这些函数的组件版本可以接受摘要，但并非必须，因为它们能够处理任意长度的数据。The resulting digest string is suitable for use with asymmetric_sign() and asymmetric_verify(). The component versions of these functions accept digests but do not require them, as they are capable of handling data of an arbitrary length.

digest_type 是用来生成摘要字符串的摘要算法。当使用 OpenSSL 1.0.1 时，支持的 digest_type 值为 'SHA224'、'SHA256'、'SHA384' 和 'SHA512'。如果使用 OpenSSL 1.1.1，则还可以使用额外的 digest_type 值 'SHA3-224'、'SHA3-256'、'SHA3-384' 和 'SHA3-512'。digest_type is the digest algorithm to be used to generate the digest string. The supported digest_type values are 'SHA224', 'SHA256', 'SHA384', and 'SHA512' when OpenSSL 1.0.1 is in use. If OpenSSL 1.1.1 is in use, the additional digest_type values 'SHA3-224', 'SHA3-256', 'SHA3-384', and 'SHA3-512' are available.

str 是要生成摘要的非空数据字符串。str is the non-null data string for which the digest is to be generated.

SET @dig = create_digest('SHA512', 'The quick brown fox');