Add encryption-at-rest document #3928

TomShawn · 2020-07-09T09:09:33Z

What is changed, added or deleted? (Required)

Which TiDB version(s) do your changes apply to? (Required)

What is the related PR or file link(s)?

This PR is translated from: reference/security: add encryption-at-rest doc docs#2410
Other reference link(s):

encryption-at-rest.md

yiwu-arbug · 2020-07-09T19:24:42Z

@TomShawn @ran-huang great thanks for helping!

encryption-at-rest.md

yiwu-arbug · 2020-07-09T21:52:52Z

encryption-at-rest.md

+
+数据密钥由 TiKV 生成并传递给底层存储引擎（即 RocksDB）。RocksDB 写入的所有文件，包括 SST 文件，WAL 文件和 MANIFEST 文件，均由当前数据密钥加密。TiKV 使用的其他临时文件（可能包括用户数据）也由相同的数据密钥加密。默认情况下，TiKV 每周自动轮换数据密钥，但是该时间段是可配置的。密钥轮换时，TiKV 不会重写全部现有文件来替换密钥，但如果集群的写入量恒定，则 RocksDB 压缩会将带有最新数据密钥的旧数据重写进新数据文件。TiKV 跟踪密钥和加密方法，并使用密钥信息对读取的内容进行解密。
+
+无论采用哪种数据加密方法，数据密钥都使用 AES256 在 GCM 模式下进行加密，以进行其他身份验证。所以使用文件而不是 KMS 传递密钥时，主密钥必须为 256位（32字节）。


Suggested change

无论采用哪种数据加密方法，数据密钥都使用 AES256 在 GCM 模式下进行加密，以进行其他身份验证。所以使用文件而不是 KMS 传递密钥时，主密钥必须为 256位（32字节）。

无论用户配置了哪种数据加密方法，数据密钥都使用 AES256-GCM 算法进行加密，以方便对主密钥进行验证。所以当使用文件而不是 KMS 方式指定主密钥时，主密钥必须为 256位（32字节）。

yiwu-arbug · 2020-07-09T21:54:09Z

encryption-at-rest.md

+data-key-rotation-period = 7d
+```
+
+`data-encryption-method` 的可选值为 `aes128-ctr`、`aes192-ctr`、`aes256-ctr` 和 `plaintext`。默认值为 `plaintext`，即默认不开启加密功能。`data-key-rotation-period` 指定 TiKV 轮换密钥的频率。可以为新 TiKV 群集或现有 TiKV 群集开启加密，尽管只保证启用后写入的数据才能被加密。要禁用加密，请在配置文件中删除 `data-encryption-method`，或将该参数值为 `plaintext`，然后重启 TiKV。


Suggested change

`data-encryption-method` 的可选值为 `aes128-ctr`、`aes192-ctr`、`aes256-ctr` 和 `plaintext`。默认值为 `plaintext`，即默认不开启加密功能。`data-key-rotation-period` 指定 TiKV 轮换密钥的频率。可以为新 TiKV 群集或现有 TiKV 群集开启加密，尽管只保证启用后写入的数据才能被加密。要禁用加密，请在配置文件中删除 `data-encryption-method`，或将该参数值为 `plaintext`，然后重启 TiKV。

`data-encryption-method` 的可选值为 `aes128-ctr`、`aes192-ctr`、`aes256-ctr` 和 `plaintext`。默认值为 `plaintext`，即默认不开启加密功能。`data-key-rotation-period` 指定 TiKV 轮换密钥的频率。可以为新 TiKV 群集或现有 TiKV 群集开启加密，但只有启用后写入的数据才保证被加密。要禁用加密，请在配置文件中删除 `data-encryption-method`，或将该参数值为 `plaintext`，然后重启 TiKV。

encryption-at-rest.md

yiwu-arbug · 2020-07-09T21:57:45Z

encryption-at-rest.md

+
+`data-encryption-method` 的可选值为 `aes128-ctr`、`aes192-ctr`、`aes256-ctr` 和 `plaintext`。默认值为 `plaintext`，即默认不开启加密功能。`data-key-rotation-period` 指定 TiKV 轮换密钥的频率。可以为新 TiKV 群集或现有 TiKV 群集开启加密，尽管只保证启用后写入的数据才能被加密。要禁用加密，请在配置文件中删除 `data-encryption-method`，或将该参数值为 `plaintext`，然后重启 TiKV。
+
+如果启用了加密（即 `data-encryption-method` 的值不是 `plaintext`），则必须指定主密钥。要将 AWS KMS CMK 指定为主密钥，请在`[security.encryption]` 部分之后添加 `[security.encryption.master-key]` 部分：


Suggested change

如果启用了加密（即 `data-encryption-method` 的值不是 `plaintext`），则必须指定主密钥。要将 AWS KMS CMK 指定为主密钥，请在`[security.encryption]` 部分之后添加 `[security.encryption.master-key]` 部分：

如果启用了加密（即 `data-encryption-method` 的值不是 `plaintext`），则必须指定主密钥。要使用 AWS KMS 方式指定为主密钥，请在`[security.encryption]` 部分之后添加 `[security.encryption.master-key]` 部分：

encryption-at-rest.md

ran-huang · 2020-07-10T10:12:13Z

可以把这个地方的链接补回去：https://github.com/pingcap/docs-cn/blame/master/whats-new-in-tidb-4.0.md#L84

@yiwu-arbug Do you mean adding a link to encryption-at-rest.md in what's new in 4.0 L84?

yiwu-arbug · 2020-07-10T18:53:32Z

可以把这个地方的链接补回去：https://github.com/pingcap/docs-cn/blame/master/whats-new-in-tidb-4.0.md#L84

@yiwu-arbug Do you mean adding a link to encryption-at-rest.md in what's new in 4.0 L84?

yes. I deleted it in #3622. Let's add it back now.

ti-srebot · 2020-07-12T19:30:54Z

@ran-huang, @yiwu-arbug, PTAL.

TomShawn · 2020-07-13T03:32:11Z

@yiwu-arbug All comments are addressed. PTAL again, thanks!

yiwu-arbug · 2020-07-13T05:58:54Z

可以把这个地方的链接补回去：https://github.com/pingcap/docs-cn/blame/master/whats-new-in-tidb-4.0.md#L84

@yiwu-arbug Do you mean adding a link to encryption-at-rest.md in what's new in 4.0 L84?

yes. I deleted it in #3622. Let's add it back now.

@TomShawn

TomShawn · 2020-07-13T06:47:11Z

@yiwu-arbug PTAL

yiwu-arbug

LGTM. Thanks!

ti-srebot · 2020-07-14T06:29:54Z

@yiwu-arbug,Thanks for your review. However, LGTM is restricted to Reviewers or higher roles.See the corresponding SIG page for more information. Related SIGs: docs(slack).

encryption-at-rest.md

ti-srebot · 2020-07-14T07:30:38Z

@TomShawn Oops! This PR requires at least 2 LGTMs to merge. The current number of LGTM is 1.

ti-srebot · 2020-07-14T07:34:38Z

/run-all-tests

Signed-off-by: ti-srebot <[email protected]>

ti-srebot · 2020-07-14T07:37:23Z

cherry pick to release-4.0 in PR #3964

Signed-off-by: ti-srebot <[email protected]> Co-authored-by: TomShawn <[email protected]>

Kennedy1991

No

Add encryption-at-rest document

81c454f

TomShawn added translation/from-docs This PR is translated from a PR in pingcap/docs. status/PTAL This PR is ready for reviewing. needs-cherry-pick-4.0 labels Jul 9, 2020

TomShawn requested review from yiwu-arbug and yikeke July 9, 2020 09:09

yikeke requested review from ran-huang and removed request for yikeke July 9, 2020 10:11

yikeke and others added 2 commits July 9, 2020 18:11

Merge branch 'master' into encyption-at-rest-ch

355e749

Update encryption-at-rest.md

7435efe

ran-huang reviewed Jul 9, 2020

View reviewed changes

yiwu-arbug reviewed Jul 9, 2020

View reviewed changes

encryption-at-rest.md Outdated Show resolved Hide resolved

yiwu-arbug reviewed Jul 9, 2020

View reviewed changes

encryption-at-rest.md Outdated Show resolved Hide resolved

yiwu-arbug reviewed Jul 9, 2020

View reviewed changes

encryption-at-rest.md Outdated Show resolved Hide resolved

yiwu-arbug reviewed Jul 9, 2020

View reviewed changes

encryption-at-rest.md Outdated Show resolved Hide resolved

yiwu-arbug reviewed Jul 9, 2020

View reviewed changes

encryption-at-rest.md Outdated Show resolved Hide resolved

yiwu-arbug reviewed Jul 9, 2020

View reviewed changes

encryption-at-rest.md Outdated Show resolved Hide resolved

yiwu-arbug reviewed Jul 9, 2020

View reviewed changes

encryption-at-rest.md Outdated Show resolved Hide resolved

yiwu-arbug reviewed Jul 9, 2020

View reviewed changes

encryption-at-rest.md Outdated Show resolved Hide resolved

yiwu-arbug reviewed Jul 9, 2020

View reviewed changes

encryption-at-rest.md Outdated Show resolved Hide resolved

yiwu-arbug reviewed Jul 9, 2020

View reviewed changes

encryption-at-rest.md Outdated Show resolved Hide resolved

yiwu-arbug reviewed Jul 9, 2020

View reviewed changes

encryption-at-rest.md Outdated Show resolved Hide resolved

yiwu-arbug reviewed Jul 9, 2020

View reviewed changes

encryption-at-rest.md Outdated Show resolved Hide resolved

yiwu-arbug reviewed Jul 9, 2020

View reviewed changes

encryption-at-rest.md Outdated Show resolved Hide resolved

yiwu-arbug reviewed Jul 9, 2020

View reviewed changes

encryption-at-rest.md Outdated Show resolved Hide resolved

yiwu-arbug reviewed Jul 9, 2020

View reviewed changes

encryption-at-rest.md Outdated Show resolved Hide resolved

Address comments

e1dec6f

Update whats-new-in-tidb-4.0.md

02d624b

Update whats-new-in-tidb-4.0.md

de38497

ran-huang approved these changes Jul 13, 2020

View reviewed changes

ti-srebot added the status/LGT1 Indicates that a PR has LGTM 1. label Jul 13, 2020

ti-srebot approved these changes Jul 13, 2020

View reviewed changes

yiwu-arbug approved these changes Jul 14, 2020

View reviewed changes

TomShawn commented Jul 14, 2020

View reviewed changes

encryption-at-rest.md Outdated Show resolved Hide resolved

Update encryption-at-rest.md

cd241ed

TomShawn added the status/can-merge Indicates a PR has been approved by a committer. label Jul 14, 2020

TomShawn added require-LGT1 Indicates that the PR requires an LGTM. status/can-merge Indicates a PR has been approved by a committer. and removed status/can-merge Indicates a PR has been approved by a committer. labels Jul 14, 2020

Merge branch 'master' into encyption-at-rest-ch

0d35c3e

ti-srebot merged commit 15a74ee into pingcap:master Jul 14, 2020

ti-srebot pushed a commit to ti-srebot/docs-cn that referenced this pull request Jul 14, 2020

cherry pick pingcap#3928 to release-4.0

ea41cf9

Signed-off-by: ti-srebot <[email protected]>

ti-srebot mentioned this pull request Jul 14, 2020

Add encryption-at-rest document (#3928) #3964

Merged

5 tasks

TomShawn deleted the encyption-at-rest-ch branch July 14, 2020 07:38

TomShawn added a commit that referenced this pull request Jul 14, 2020

cherry pick #3928 to release-4.0 (#3964)

89a82b8

Signed-off-by: ti-srebot <[email protected]> Co-authored-by: TomShawn <[email protected]>

Kennedy1991 reviewed Feb 11, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add encryption-at-rest document #3928

Add encryption-at-rest document #3928

TomShawn commented Jul 9, 2020 •

edited

Loading

yiwu-arbug commented Jul 9, 2020

yiwu-arbug Jul 9, 2020 •

edited

Loading

yiwu-arbug Jul 10, 2020

yiwu-arbug Jul 9, 2020 •

edited

Loading

yiwu-arbug Jul 10, 2020

yiwu-arbug Jul 9, 2020

yiwu-arbug Jul 10, 2020

ran-huang commented Jul 10, 2020

yiwu-arbug commented Jul 10, 2020

ti-srebot commented Jul 12, 2020

TomShawn commented Jul 13, 2020

yiwu-arbug commented Jul 13, 2020

TomShawn commented Jul 13, 2020 •

edited

Loading

yiwu-arbug left a comment

ti-srebot commented Jul 14, 2020

ti-srebot commented Jul 14, 2020

ti-srebot commented Jul 14, 2020

ti-srebot commented Jul 14, 2020

Kennedy1991 left a comment


		数据密钥由 TiKV 生成并传递给底层存储引擎（即 RocksDB）。RocksDB 写入的所有文件，包括 SST 文件，WAL 文件和 MANIFEST 文件，均由当前数据密钥加密。TiKV 使用的其他临时文件（可能包括用户数据）也由相同的数据密钥加密。默认情况下，TiKV 每周自动轮换数据密钥，但是该时间段是可配置的。密钥轮换时，TiKV 不会重写全部现有文件来替换密钥，但如果集群的写入量恒定，则 RocksDB 压缩会将带有最新数据密钥的旧数据重写进新数据文件。TiKV 跟踪密钥和加密方法，并使用密钥信息对读取的内容进行解密。

		无论采用哪种数据加密方法，数据密钥都使用 AES256 在 GCM 模式下进行加密，以进行其他身份验证。所以使用文件而不是 KMS 传递密钥时，主密钥必须为 256位（32字节）。

	无论采用哪种数据加密方法，数据密钥都使用 AES256 在 GCM 模式下进行加密，以进行其他身份验证。所以使用文件而不是 KMS 传递密钥时，主密钥必须为 256位（32字节）。
	无论用户配置了哪种数据加密方法，数据密钥都使用 AES256-GCM 算法进行加密，以方便对主密钥进行验证。所以当使用文件而不是 KMS 方式指定主密钥时，主密钥必须为 256位（32字节）。


		`data-encryption-method` 的可选值为 `aes128-ctr`、`aes192-ctr`、`aes256-ctr` 和 `plaintext`。默认值为 `plaintext`，即默认不开启加密功能。`data-key-rotation-period` 指定 TiKV 轮换密钥的频率。可以为新 TiKV 群集或现有 TiKV 群集开启加密，尽管只保证启用后写入的数据才能被加密。要禁用加密，请在配置文件中删除 `data-encryption-method`，或将该参数值为 `plaintext`，然后重启 TiKV。

		如果启用了加密（即 `data-encryption-method` 的值不是 `plaintext`），则必须指定主密钥。要将 AWS KMS CMK 指定为主密钥，请在`[security.encryption]` 部分之后添加 `[security.encryption.master-key]` 部分：

Add encryption-at-rest document #3928

Add encryption-at-rest document #3928

Conversation

TomShawn commented Jul 9, 2020 • edited Loading

What is changed, added or deleted? (Required)

Which TiDB version(s) do your changes apply to? (Required)

What is the related PR or file link(s)?

yiwu-arbug commented Jul 9, 2020

yiwu-arbug Jul 9, 2020 • edited Loading

Choose a reason for hiding this comment

yiwu-arbug Jul 10, 2020

Choose a reason for hiding this comment

yiwu-arbug Jul 9, 2020 • edited Loading

Choose a reason for hiding this comment

yiwu-arbug Jul 10, 2020

Choose a reason for hiding this comment

yiwu-arbug Jul 9, 2020

Choose a reason for hiding this comment

yiwu-arbug Jul 10, 2020

Choose a reason for hiding this comment

ran-huang commented Jul 10, 2020

yiwu-arbug commented Jul 10, 2020

ti-srebot commented Jul 12, 2020

TomShawn commented Jul 13, 2020

yiwu-arbug commented Jul 13, 2020

TomShawn commented Jul 13, 2020 • edited Loading

yiwu-arbug left a comment

Choose a reason for hiding this comment

ti-srebot commented Jul 14, 2020

ti-srebot commented Jul 14, 2020

ti-srebot commented Jul 14, 2020

ti-srebot commented Jul 14, 2020

Kennedy1991 left a comment

Choose a reason for hiding this comment

TomShawn commented Jul 9, 2020 •

edited

Loading

yiwu-arbug Jul 9, 2020 •

edited

Loading

yiwu-arbug Jul 9, 2020 •

edited

Loading

TomShawn commented Jul 13, 2020 •

edited

Loading