Keyring functions treat key IDs, types, and values as binary strings, so comparisons are case-sensitive. For example, IDs of MyKey  and mykey  refer to different keys. 

To remove a key, pass the key ID to keyring_key_remove() : 

mysql> SELECT keyring_key_remove(’MyKey’); +-----------------------------+ | keyring_key_remove(’MyKey’) | +-----------------------------+ | 1 | +-----------------------------+ 

To obfuscate and store a key that you provide, pass the key ID, type, and value to keyring_key_store() : 

mysql> SELECT keyring_key_store(’AES_key’, ’AES’, ’Secret string’); +------------------------------------------------------+ | keyring_key_store(’AES_key’, ’AES’, ’Secret string’) | +------------------------------------------------------+ | 1 | +------------------------------------------------------+ 

As indicated previously, a user must have the global EXECUTE  privilege to call keyring functions, and the user who stores a key in the keyring initially must be the same user who performs subsequent operations on the key later, as determined from the CURRENT_USER()  value in effect for each function call. To permit key operations to users who do not have the global EXECUTE  privilege or who may not be the key “owner,” use this technique: 

1. Define “wrapper”  stored programs that encapsulate the required key operations and have a DEFINER value equal to the key owner. 

2. Grant the EXECUTE  privilege for specific stored programs to the individual users who should be able to invoke them. 

3. If the operations implemented by the wrapper stored programs do not include key creation, create any necessary keys in advance, using the account named as the DEFINER  in the stored program definitions. 

This technique enables keys to be shared among users and provides to DBAs more fine-grained control over who can do what with keys, without having to grant global privileges. 

The following example shows how to set up a shared key named SharedKey  that is owned by the DBA, and a get_shared_key()  stored function that provides access to the current key value. The value can be retrieved by any user with the EXECUTE  privilege for that function, which is created in the key_schema schema. 

From a MySQL administrative account ( ’root’@’localhost’  in this example), create the administrative schema and the stored function to access the key: 

mysql> CREATE SCHEMA key_schema; mysql> CREATE DEFINER = ’root’@’localhost’ FUNCTION key_schema.get_shared_key() RETURNS BLOB READS SQL DATA RETURN keyring_key_fetch(’SharedKey’); 

From the administrative account, ensure that the shared key exists: 

mysql> SELECT keyring_key_generate(’SharedKey’, ’DSA’, 8); +---------------------------------------------+ 

