re-encrypting the tablespace is an ALGORITHM=COPY  operation that rebuilds the table. For general tablespaces and the mysql  system tablespace, it is an ALGORITHM=INPLACE  operation, which does not require rebuilding tables that reside in the tablespace. 

•If a table is created with both the COMPRESSION  and ENCRYPTION  options, compression is performed before tablespace data is encrypted. 

•If a keyring data file (the file named by keyring_file_data  or keyring_encrypted_file_data ) is empty or missing, the first execution of ALTER INSTANCE ROTATE INNODB MASTER KEY  creates a master encryption key. 

•Uninstalling the component_keyring_file  or component_keyring_encrypted_file component does not remove an existing keyring data file. Uninstalling the keyring_file  or keyring_encrypted_file  plugin does not remove an existing keyring data file. 

•It is recommended that you not place a keyring data file under the same directory as tablespace data files. 

•Modifying the keyring_file_data  or keyring_encrypted_file_data  setting at runtime or when restarting the server can cause previously encrypted tablespaces to become inaccessible, resulting in lost data. 

•Encryption is supported for the InnoDB FULLTEXT  index tables that are created implicitly when adding a FULLTEXT  index, but only if the FULLTEXT  index is created on a table that resides in an encrypted general tablespace. In this case, the FULLTEXT  index tables are created in the same encrypted general tablespace. For related information, see InnoDB Full-Text Index Tables. 

## Encryption Limitations 

•Advanced Encryption Standard (AES) is the only supported encryption algorithm. InnoDB  tablespace encryption uses Electronic Codebook (ECB) block encryption mode for tablespace key encryption and Cipher Block Chaining (CBC) block encryption mode for data encryption. Padding is not used with CBC block encryption mode. Instead, InnoDB  ensures that the text to be encrypted is a multiple of the block size. 

•Encryption is only supported for file-per-table tablespaces, general tablespaces, and the mysql  system tablespace. Encryption support for general tablespaces was introduced in MySQL 8.0.13. Encryption support for the mysql  system tablespace is available as of MySQL 8.0.16. Encryption is not supported for other tablespace types including the InnoDB  system tablespace. 

•You cannot move or copy a table from an encrypted file-per-table tablespace, general tablespace, or the mysql  system tablespace to a tablespace type that does not support encryption. 

•You cannot move or copy a table from an encrypted tablespace to an unencrypted tablespace. However, moving a table from an unencrypted tablespace to an encrypted one is permitted. For example, you can move or copy a table from a unencrypted file-per-table or general tablespace to an encrypted general tablespace. 

•By default, tablespace encryption only applies to data in the tablespace. Redo log and undo log data can be encrypted by enabling innodb_redo_log_encrypt  and innodb_undo_log_encrypt . See Redo Log Encryption, and Undo Log Encryption. For information about binary log file and relay log file encryption, see Section 17.3.2, “Encrypting Binary Log Files and Relay Log Files” . 

•It is not permitted to change the storage engine of a table that resides in, or previously resided in, an encrypted tablespace. 

## 15.14 InnoDB Startup Options and System Variables 

