Add encryption-at-rest document by TomShawn · Pull Request #3928 · pingcap/docs-cn

TomShawn · 2020-07-09T09:09:33Z

What is changed, added or deleted? (Required)

Which TiDB version(s) do your changes apply to? (Required)

What is the related PR or file link(s)?

This PR is translated from: reference/security: add encryption-at-rest doc docs#2410
Other reference link(s):

yiwu-arbug · 2020-07-09T19:24:42Z

@TomShawn @ran-huang great thanks for helping!

yiwu-arbug · 2020-07-09T21:52:52Z

+
+数据密钥由 TiKV 生成并传递给底层存储引擎（即 RocksDB）。RocksDB 写入的所有文件，包括 SST 文件，WAL 文件和 MANIFEST 文件，均由当前数据密钥加密。TiKV 使用的其他临时文件（可能包括用户数据）也由相同的数据密钥加密。默认情况下，TiKV 每周自动轮换数据密钥，但是该时间段是可配置的。密钥轮换时，TiKV 不会重写全部现有文件来替换密钥，但如果集群的写入量恒定，则 RocksDB 压缩会将带有最新数据密钥的旧数据重写进新数据文件。TiKV 跟踪密钥和加密方法，并使用密钥信息对读取的内容进行解密。
+
+无论采用哪种数据加密方法，数据密钥都使用 AES256 在 GCM 模式下进行加密，以进行其他身份验证。所以使用文件而不是 KMS 传递密钥时，主密钥必须为 256位（32字节）。


Suggested change

无论采用哪种数据加密方法，数据密钥都使用 AES256 在 GCM 模式下进行加密，以进行其他身份验证。所以使用文件而不是 KMS 传递密钥时，主密钥必须为 256位（32字节）。

无论用户配置了哪种数据加密方法，数据密钥都使用 AES256-GCM 算法进行加密，以方便对主密钥进行验证。所以当使用文件而不是 KMS 方式指定主密钥时，主密钥必须为 256位（32字节）。

yiwu-arbug · 2020-07-09T21:54:09Z

+data-key-rotation-period = 7d
+```
+
+`data-encryption-method` 的可选值为 `aes128-ctr`、`aes192-ctr`、`aes256-ctr` 和 `plaintext`。默认值为 `plaintext`，即默认不开启加密功能。`data-key-rotation-period` 指定 TiKV 轮换密钥的频率。可以为新 TiKV 群集或现有 TiKV 群集开启加密，尽管只保证启用后写入的数据才能被加密。要禁用加密，请在配置文件中删除 `data-encryption-method`，或将该参数值为 `plaintext`，然后重启 TiKV。


Suggested change

`data-encryption-method` 的可选值为 `aes128-ctr`、`aes192-ctr`、`aes256-ctr` 和 `plaintext`。默认值为 `plaintext`，即默认不开启加密功能。`data-key-rotation-period` 指定 TiKV 轮换密钥的频率。可以为新 TiKV 群集或现有 TiKV 群集开启加密，尽管只保证启用后写入的数据才能被加密。要禁用加密，请在配置文件中删除 `data-encryption-method`，或将该参数值为 `plaintext`，然后重启 TiKV。

`data-encryption-method` 的可选值为 `aes128-ctr`、`aes192-ctr`、`aes256-ctr` 和 `plaintext`。默认值为 `plaintext`，即默认不开启加密功能。`data-key-rotation-period` 指定 TiKV 轮换密钥的频率。可以为新 TiKV 群集或现有 TiKV 群集开启加密，但只有启用后写入的数据才保证被加密。要禁用加密，请在配置文件中删除 `data-encryption-method`，或将该参数值为 `plaintext`，然后重启 TiKV。

yiwu-arbug · 2020-07-09T21:57:45Z

+
+`data-encryption-method` 的可选值为 `aes128-ctr`、`aes192-ctr`、`aes256-ctr` 和 `plaintext`。默认值为 `plaintext`，即默认不开启加密功能。`data-key-rotation-period` 指定 TiKV 轮换密钥的频率。可以为新 TiKV 群集或现有 TiKV 群集开启加密，尽管只保证启用后写入的数据才能被加密。要禁用加密，请在配置文件中删除 `data-encryption-method`，或将该参数值为 `plaintext`，然后重启 TiKV。
+
+如果启用了加密（即 `data-encryption-method` 的值不是 `plaintext`），则必须指定主密钥。要将 AWS KMS CMK 指定为主密钥，请在`[security.encryption]` 部分之后添加 `[security.encryption.master-key]` 部分：


Suggested change

如果启用了加密（即 `data-encryption-method` 的值不是 `plaintext`），则必须指定主密钥。要将 AWS KMS CMK 指定为主密钥，请在`[security.encryption]` 部分之后添加 `[security.encryption.master-key]` 部分：

如果启用了加密（即 `data-encryption-method` 的值不是 `plaintext`），则必须指定主密钥。要使用 AWS KMS 方式指定为主密钥，请在`[security.encryption]` 部分之后添加 `[security.encryption.master-key]` 部分：

ran-huang · 2020-07-10T10:12:13Z

可以把这个地方的链接补回去：https://github.com/pingcap/docs-cn/blame/master/whats-new-in-tidb-4.0.md#L84

@yiwu-arbug Do you mean adding a link to encryption-at-rest.md in what's new in 4.0 L84?

yiwu-arbug · 2020-07-10T18:53:32Z

可以把这个地方的链接补回去：https://github.com/pingcap/docs-cn/blame/master/whats-new-in-tidb-4.0.md#L84

@yiwu-arbug Do you mean adding a link to encryption-at-rest.md in what's new in 4.0 L84?

yes. I deleted it in #3622. Let's add it back now.

ti-srebot · 2020-07-12T19:30:54Z

@ran-huang, @yiwu-arbug, PTAL.

TomShawn · 2020-07-13T03:32:11Z

@yiwu-arbug All comments are addressed. PTAL again, thanks!

yiwu-arbug · 2020-07-13T05:58:54Z

可以把这个地方的链接补回去：https://github.com/pingcap/docs-cn/blame/master/whats-new-in-tidb-4.0.md#L84

@yiwu-arbug Do you mean adding a link to encryption-at-rest.md in what's new in 4.0 L84?

yes. I deleted it in #3622. Let's add it back now.

@TomShawn

TomShawn · 2020-07-13T06:47:11Z

@yiwu-arbug PTAL

yiwu-arbug

LGTM. Thanks!

ti-srebot · 2020-07-14T06:29:54Z

@yiwu-arbug,Thanks for your review. However, LGTM is restricted to Reviewers or higher roles.See the corresponding SIG page for more information. Related SIGs: docs(slack).

ti-srebot · 2020-07-14T07:30:38Z

@TomShawn Oops! This PR requires at least 2 LGTMs to merge. The current number of LGTM is 1.

ti-srebot · 2020-07-14T07:34:38Z

/run-all-tests

Signed-off-by: ti-srebot <ti-srebot@pingcap.com>

ti-srebot · 2020-07-14T07:37:23Z

cherry pick to release-4.0 in PR #3964

Signed-off-by: ti-srebot <ti-srebot@pingcap.com> Co-authored-by: TomShawn <41534398+TomShawn@users.noreply.github.com>

Kennedy1991

No

Add encryption-at-rest document

81c454f

TomShawn added translation/from-docs This PR is translated from a PR in pingcap/docs. status/PTAL This PR is ready for reviewing. needs-cherry-pick-4.0 labels Jul 9, 2020

TomShawn requested review from yikeke and yiwu-arbug July 9, 2020 09:09

yikeke requested review from ran-huang and removed request for yikeke July 9, 2020 10:11

yikeke and others added 2 commits July 9, 2020 18:11

Merge branch 'master' into encyption-at-rest-ch

355e749

Update encryption-at-rest.md

7435efe

ran-huang reviewed Jul 9, 2020

View reviewed changes

yiwu-arbug reviewed Jul 9, 2020

View reviewed changes

Comment thread encryption-at-rest.md Outdated

yiwu-arbug reviewed Jul 9, 2020

View reviewed changes

Comment thread encryption-at-rest.md Outdated

yiwu-arbug reviewed Jul 9, 2020

View reviewed changes

Comment thread encryption-at-rest.md Outdated

yiwu-arbug reviewed Jul 9, 2020

View reviewed changes

Comment thread encryption-at-rest.md Outdated

yiwu-arbug reviewed Jul 9, 2020

View reviewed changes

Comment thread encryption-at-rest.md Outdated

yiwu-arbug reviewed Jul 9, 2020

View reviewed changes

Comment thread encryption-at-rest.md Outdated

yiwu-arbug reviewed Jul 9, 2020

View reviewed changes

Comment thread encryption-at-rest.md Outdated

yiwu-arbug reviewed Jul 9, 2020

View reviewed changes

Comment thread encryption-at-rest.md Outdated

yiwu-arbug reviewed Jul 9, 2020

View reviewed changes

Comment thread encryption-at-rest.md Outdated

yiwu-arbug reviewed Jul 9, 2020

View reviewed changes

Comment thread encryption-at-rest.md Outdated

yiwu-arbug reviewed Jul 9, 2020

View reviewed changes

Comment thread encryption-at-rest.md Outdated

yiwu-arbug reviewed Jul 9, 2020

View reviewed changes

Comment thread encryption-at-rest.md Outdated

yiwu-arbug reviewed Jul 9, 2020

View reviewed changes

Comment thread encryption-at-rest.md Outdated

yiwu-arbug reviewed Jul 9, 2020

View reviewed changes

Comment thread encryption-at-rest.md Outdated

yiwu-arbug reviewed Jul 9, 2020

View reviewed changes

Comment thread encryption-at-rest.md Outdated

Address comments

e1dec6f

Update whats-new-in-tidb-4.0.md

02d624b

Update whats-new-in-tidb-4.0.md

de38497

ran-huang approved these changes Jul 13, 2020

View reviewed changes

ti-srebot added the status/LGT1 Indicates that a PR has LGTM 1. label Jul 13, 2020

ti-srebot approved these changes Jul 13, 2020

View reviewed changes

yiwu-arbug approved these changes Jul 14, 2020

View reviewed changes

TomShawn commented Jul 14, 2020

View reviewed changes

Comment thread encryption-at-rest.md Outdated

Update encryption-at-rest.md

cd241ed

TomShawn added the status/can-merge Indicates a PR has been approved by a committer. label Jul 14, 2020

TomShawn added require-LGT1 Indicates that the PR requires an LGTM. status/can-merge Indicates a PR has been approved by a committer. and removed status/can-merge Indicates a PR has been approved by a committer. labels Jul 14, 2020

Merge branch 'master' into encyption-at-rest-ch

0d35c3e

ti-srebot merged commit 15a74ee into pingcap:master Jul 14, 2020

ti-srebot pushed a commit to ti-srebot/docs-cn that referenced this pull request Jul 14, 2020

cherry pick pingcap#3928 to release-4.0

ea41cf9

Signed-off-by: ti-srebot <ti-srebot@pingcap.com>

ti-srebot mentioned this pull request Jul 14, 2020

Add encryption-at-rest document (#3928) #3964

Merged

5 tasks

TomShawn deleted the encyption-at-rest-ch branch July 14, 2020 07:38

TomShawn added a commit that referenced this pull request Jul 14, 2020

cherry pick #3928 to release-4.0 (#3964)

89a82b8

Signed-off-by: ti-srebot <ti-srebot@pingcap.com> Co-authored-by: TomShawn <41534398+TomShawn@users.noreply.github.com>

Kennedy1991 reviewed Feb 11, 2024

View reviewed changes


		数据密钥由 TiKV 生成并传递给底层存储引擎（即 RocksDB）。RocksDB 写入的所有文件，包括 SST 文件，WAL 文件和 MANIFEST 文件，均由当前数据密钥加密。TiKV 使用的其他临时文件（可能包括用户数据）也由相同的数据密钥加密。默认情况下，TiKV 每周自动轮换数据密钥，但是该时间段是可配置的。密钥轮换时，TiKV 不会重写全部现有文件来替换密钥，但如果集群的写入量恒定，则 RocksDB 压缩会将带有最新数据密钥的旧数据重写进新数据文件。TiKV 跟踪密钥和加密方法，并使用密钥信息对读取的内容进行解密。

		无论采用哪种数据加密方法，数据密钥都使用 AES256 在 GCM 模式下进行加密，以进行其他身份验证。所以使用文件而不是 KMS 传递密钥时，主密钥必须为 256位（32字节）。

	无论采用哪种数据加密方法，数据密钥都使用 AES256 在 GCM 模式下进行加密，以进行其他身份验证。所以使用文件而不是 KMS 传递密钥时，主密钥必须为 256位（32字节）。
	无论用户配置了哪种数据加密方法，数据密钥都使用 AES256-GCM 算法进行加密，以方便对主密钥进行验证。所以当使用文件而不是 KMS 方式指定主密钥时，主密钥必须为 256位（32字节）。


		`data-encryption-method` 的可选值为 `aes128-ctr`、`aes192-ctr`、`aes256-ctr` 和 `plaintext`。默认值为 `plaintext`，即默认不开启加密功能。`data-key-rotation-period` 指定 TiKV 轮换密钥的频率。可以为新 TiKV 群集或现有 TiKV 群集开启加密，尽管只保证启用后写入的数据才能被加密。要禁用加密，请在配置文件中删除 `data-encryption-method`，或将该参数值为 `plaintext`，然后重启 TiKV。

		如果启用了加密（即 `data-encryption-method` 的值不是 `plaintext`），则必须指定主密钥。要将 AWS KMS CMK 指定为主密钥，请在`[security.encryption]` 部分之后添加 `[security.encryption.master-key]` 部分：

Conversation

TomShawn commented Jul 9, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What is changed, added or deleted? (Required)

Which TiDB version(s) do your changes apply to? (Required)

What is the related PR or file link(s)?

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

yiwu-arbug commented Jul 9, 2020

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

yiwu-arbug Jul 9, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

yiwu-arbug Jul 10, 2020

Choose a reason for hiding this comment

Uh oh!

yiwu-arbug Jul 9, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

yiwu-arbug Jul 10, 2020

Choose a reason for hiding this comment

Uh oh!

Uh oh!

yiwu-arbug Jul 9, 2020

Choose a reason for hiding this comment

Uh oh!

yiwu-arbug Jul 10, 2020

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ran-huang commented Jul 10, 2020

Uh oh!

yiwu-arbug commented Jul 10, 2020

Uh oh!

ti-srebot commented Jul 12, 2020

Uh oh!

TomShawn commented Jul 13, 2020

Uh oh!

yiwu-arbug commented Jul 13, 2020

Uh oh!

TomShawn commented Jul 13, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

yiwu-arbug left a comment

Choose a reason for hiding this comment

Uh oh!

ti-srebot commented Jul 14, 2020

Uh oh!

Uh oh!

ti-srebot commented Jul 14, 2020

Uh oh!

ti-srebot commented Jul 14, 2020

Uh oh!

ti-srebot commented Jul 14, 2020

Uh oh!

Kennedy1991 left a comment

Choose a reason for hiding this comment

Uh oh!

TomShawn commented Jul 9, 2020 •

edited

Loading

yiwu-arbug Jul 9, 2020 •

edited

Loading

yiwu-arbug Jul 9, 2020 •

edited

Loading

TomShawn commented Jul 13, 2020 •

edited

Loading