Transparent data encryption in MariaDB is done with keys saved in a file.
I couldn't find any ready solution that works with an HSM like we have in MsSQL.
So the only available option is to secret keys saved in a file.
First, enable the plugin:
[mariadb]
...
plugin_load_add = file_key_management
Next, create a key file, which is a list of string pairs seperated by ';'.
[keyId];[keyValue]
The keyId is a number, while the keyValue is a 32 byte hex string;
1;06f4cf74b0498aea687b4c2abfe2d83ab1a4f5e551bcb3d9523ed266cfe8f960
2;7f983d01b2211467ac1e364882d91778fca53413ea0bb84e57b4f06c56a9f736
3;ed44fdc83f970abcbff0654128d2dbd095bc1b73ddbc3d16ffb9cab568d03bc9
4;be90b72c18d90b7210fd0c624bd329d80533ea31d704c801f715f06ed78aeba4
5;0bc2bf932ccd806b8dccd9afb1a9b157ee2009674389780873b29e45484c3187
Add the path to the keys file
[mariadb]
...
loose_file_key_management_filename = ../encryption/keyfile
To create a table that is encrypted with a specific key use:
CREATE TABLE tbl (
id int PRIMARY KEY,
str varchar(50)
)
ENCRYPTED=YES ENCRYPTION_KEY_ID=2;