content_image/802438.jpg
VALUES (1,AES_ENCRYPT(’text’, UNHEX(SHA2(’My secret passphrase’,512)))); 

Do not pass a password or passphrase directly to crypt_str , hash it first. Previous versions of this documentation suggested the former approach, but it is no longer recommended as the examples shown here are more secure. 

If AES_DECRYPT()  detects invalid data or incorrect padding, it returns NULL . However, it is possible for AES_DECRYPT()  to return a non- NULL  value (possibly garbage) if the input data or the key is invalid. 

AES_ENCRYPT()  and AES_DECRYPT()  permit control of the block encryption mode and take an optional init_vector  initialization vector argument: 

•The block_encryption_mode  system variable controls the mode for block-based encryption algorithms. Its default value is aes-128-ecb , which signifies encryption using a key length of 128 bits and ECB mode. For a description of the permitted values of this variable, see Section 5.1.8, “Server System Variables” . 

•The optional init_vector  argument provides an initialization vector for block encryption modes that require it. 

For modes that require the optional init_vector  argument, it must be 16 bytes or longer (bytes in excess of 16 are ignored). An error occurs if init_vector  is missing. 

For modes that do not require init_vector , it is ignored and a warning is generated if it is specified. 

A random string of bytes to use for the initialization vector can be produced by calling RANDOM_BYTES(16) . For encryption modes that require an initialization vector, the same vector must be used for encryption and decryption. 

mysql> SET block_encryption_mode = ’aes-256-cbc’; mysql> SET @key_str = SHA2(’My secret passphrase’,512); mysql> SET @init_vector = RANDOM_BYTES(16); mysql> SET @crypt_str = AES_ENCRYPT(’text’,@key_str,@init_vector); mysql> SELECT AES_DECRYPT(@crypt_str,@key_str,@init_vector); +-----------------------------------------------+ | AES_DECRYPT(@crypt_str,@key_str,@init_vector) | +-----------------------------------------------+ | text | +-----------------------------------------------+ 

The following table lists each permitted block encryption mode and whether the initialization vector argument is required. 

<img src='content_image/802438.jpg'>

