TABLE_ENCRYPTION_ADMIN  privilege. See Defining an Encryption Default for Schemas and General Tablespaces. 

## General Tablespace Encryption 

As of MySQL 8.0.16, the default_table_encryption  variable determines the encryption of a newly created general tablespace unless an ENCRYPTION  clause is specified explicitly in the CREATE TABLESPACE  statement. Prior to MySQL 8.0.16, an ENCRYPTION  clause must be specified to enable encryption. 

mysql> CREATE TABLESPACE ‘ts1‘ ADD DATAFILE ’ts1.ibd’ ENCRYPTION = ’Y’ Engine=InnoDB; 

To alter the encryption of an existing general tablespace, an ENCRYPTION  clause must be specified. 

mysql> ALTER TABLESPACE ts1 ENCRYPTION = ’Y’; 

As of MySQL 8.0.16, if the table_encryption_privilege_check  variable is enabled, specifying an ENCRYPTION  clause with a setting that differs from the default_table_encryption  setting requires the TABLE_ENCRYPTION_ADMIN  privilege. See Defining an Encryption Default for Schemas and General Tablespaces. 

## Doublewrite File Encryption 

Encryption support for doublewrite files is available as of MySQL 8.0.23. InnoDB  automatically encrypts doublewrite file pages that belong to encrypted tablespaces. No action is required. Doublewrite file pages are encrypted using the encryption key of the associated tablespace. The same encrypted page written to a tablespace data file is also written to a doublewrite file. Doublewrite file pages that belong to an unencrypted tablespace remain unencrypted. 

During recovery, encrypted doublewrite file pages are unencrypted and checked for corruption. 

## mysql System Tablespace Encryption 

Encryption support for the mysql  system tablespace is available as of MySQL 8.0.16. 

The mysql  system tablespace contains the mysql  system database and MySQL data dictionary tables. It is unencrypted by default. To enable encryption for the mysql  system tablespace, specify the tablespace name and the ENCRYPTION  option in an ALTER TABLESPACE  statement. 

mysql> ALTER TABLESPACE mysql ENCRYPTION = ’Y’; 

To disable encryption for the mysql  system tablespace, set ENCRYPTION = ’N’  using an ALTER TABLESPACE  statement. 

mysql> ALTER TABLESPACE mysql ENCRYPTION = ’N’; 

Enabling or disabling encryption for the mysql  system tablespace requires the CREATE TABLESPACE privilege on all tables in the instance ( CREATE TABLESPACE on *.*) . 

## Redo Log Encryption 

Redo log data encryption is enabled using the innodb_redo_log_encrypt  configuration option. Redo log encryption is disabled by default. 

As with tablespace data, redo log data encryption occurs when redo log data is written to disk, and decryption occurs when redo log data is read from disk. Once redo log data is read into memory, it is in unencrypted form. Redo log data is encrypted and decrypted using the tablespace encryption key. 

