MySQL 8.4 Release Notes
要在应用程序中使用 MySQL 企业加密，请调用适合您希望执行的操作的函数。本节演示如何执行一些代表性的任务。To use MySQL Enterprise Encryption in applications, invoke the functions that are appropriate for the operations you wish to perform. This section demonstrates how to carry out some representative tasks.
MySQL 企业加密函数由 MySQL 组件 component_enterprise_encryption 提供。有关这些函数的信息，请参见 第 8.6.4 节，“MySQL 企业加密函数参考”。MySQL Enterprise Encryption functions are provided by a MySQL component
component_enterprise_encryption. For
information about these functions, see
Section 8.6.4, “MySQL Enterprise Encryption Function Reference”.
在选择密钥长度和加密算法时，需要考虑以下一般事项：The following general considerations apply when choosing key lengths and encryption algorithms:
私钥和公钥的加密强度随着密钥大小的增加而增加，但密钥生成的时间也会增加。The strength of encryption for private and public keys increases with the key size, but the time for key generation increases as well.
组件函数仅支持 RSA 密钥。Component functions support RSA keys only.
与对称加密函数相比，非对称加密函数消耗更多资源。它们适用于加密少量数据以及创建和验证签名。对于加密大量数据，对称加密函数速度更快。MySQL 服务器提供了用于对称加密的
AES_ENCRYPT()和AES_DECRYPT()函数。Asymmetric encryption functions consume more resources compared to symmetric functions. They are good for encrypting small amounts of data and creating and verifying signatures. For encrypting large amounts of data, symmetric encryption functions are faster. MySQL Server provides theAES_ENCRYPT()andAES_DECRYPT()functions for symmetric encryption.
关键字符串值可以在运行时创建，并使用SET、SELECT或INSERT存储到变量或表中，如下所示：Key string values can be created at runtime and stored into a
variable or table using
SET,
SELECT, or
INSERT, as shown here:
SET @priv1 = create_asymmetric_priv_key('RSA', 2048);
SELECT create_asymmetric_priv_key('RSA', 2048) INTO @priv2;
INSERT INTO t (key_col) VALUES(create_asymmetric_priv_key('RSA', 1024));
存储在文件中的关键字符串值可以使用LOAD_FILE()函数读取，条件是用户拥有FILE权限。摘要和签名字符串也可以类似处理。Key string values stored in files can be read using the
LOAD_FILE() function by users who
have the FILE privilege. Digest and
signature strings can be handled similarly.
这个示例适用于组件函数和旧版函数：This example works with both the component functions and the legacy functions:
-- Encryption algorithm SET @algo = 'RSA'; -- Key length in bits; make larger for stronger keys SET @key_len = 2048; -- Create private key SET @priv = create_asymmetric_priv_key(@algo, @key_len); -- Derive corresponding public key from private key, using same algorithm SET @pub = create_asymmetric_pub_key(@algo, @priv);
您可以使用密钥对来加密和解密数据，或用于签名和验证数据。You can use the key pair to encrypt and decrypt data or to sign and verify data.
这个示例适用于组件函数和传统函数。在这两种情况下，密钥对的成员必须是 RSA 密钥：This example works with both the component functions and the legacy functions. In both cases, the members of the key pair must be RSA keys:
SET @ciphertext = asymmetric_encrypt(@algo, 'My secret text', @pub); SET @plaintext = asymmetric_decrypt(@algo, @ciphertext, @priv);
这个示例适用于组件函数和旧版函数：This example works with both the component functions and the legacy functions:
-- Digest type SET @dig_type = 'SHA512'; -- Generate digest string SET @dig = create_digest(@dig_type, 'My text to digest');
密钥对可以用于对数据进行签名，然后验证签名是否与摘要匹配。此示例适用于组件函数和传统函数：The key pair can be used to sign data, then verify that the signature matches the digest. This example works with both the component functions and the legacy functions:
-- Encryption algorithm; keys must -- have been created using same algorithm SET @algo = 'RSA'; –- Digest algorithm to sign the data SET @dig_type = 'SHA512'; -- Generate signature for digest and verify signature against digest SET @sig = asymmetric_sign(@algo, @dig, @priv, @dig_type); -- Verify signature against digest SET @verf = asymmetric_verify(@algo, @dig, @sig, @pub, @dig_type);
对于传统函数，签名需要摘要。对于组件函数，签名不需要摘要，可以使用任何数据字符串。这些函数中的摘要类型指的是用于签名数据的算法，而不是用于创建签名原始输入的算法。此示例适用于组件函数：For the legacy functions, signatures require a digest. For the component functions, signatures do not require a digest, and can use any data string. The digest type in these functions refers to the algorithm that is used to sign the data, not the algorithm that was used to create the original input for the signature. This example is for the component functions:
-- Encryption algorithm; keys must
-- have been created using same algorithm
SET @algo = 'RSA';
–- Arbitrary text string for signature
SET @text = repeat('j', 256);
–- Digest algorithm to sign the data
SET @dig_type = 'SHA512';
-- Generate signature for digest and verify signature against digest
SET @sig = asymmetric_sign(@algo, @text, @priv, @dig_type);
-- Verify signature against digest
SET @verf = asymmetric_verify(@algo, @text, @sig, @pub, @dig_type);