content_image/801358.jpg content_image/801359.jpg
Keyring operations are transactional: component_keyring_file  uses a backup file during write operations to ensure that it can roll back to the original file if an operation fails. The backup file has the same name as the data file with a suffix of .backup . 

component_keyring_file  supports the functions that comprise the standard MySQL Keyring service interface. Keyring operations performed by those functions are accessible at two levels: 

•SQL interface: In SQL statements, call the functions described in Section 6.4.4.14, “General-Purpose Keyring Key-Management Functions” . 

•C interface: In C-language code, call the keyring service functions described in Section 5.6.9.2, “The Keyring Service” . 

Example (using the SQL interface): 

SELECT keyring_key_generate(’MyKey’, ’AES’, 32); SELECT keyring_key_remove(’MyKey’); 

For information about the characteristics of key values permitted by component_keyring_file , see Section 6.4.4.12, “Supported Keyring Key Types and Lengths” . 

## 6.4.4.5 Using the component_keyring_encrypted_file Encrypted File-Based Keyring Component 

<img src='content_image/801358.jpg'>

## Note 

component_keyring_encrypted_file  is an extension included in MySQL Enterprise Edition, a commercial product. To learn more about commercial products, see https://www.mysql.com/products/. 

The component_keyring_encrypted_file  keyring component stores keyring data in an encrypted, password-protected file local to the server host. 

<img src='content_image/801359.jpg'>

## Warning 

For encryption key management, the component_keyring_file  and component_keyring_encrypted_file  components, and the keyring_file and keyring_encrypted_file  plugins are not intended as a regulatory compliance solution. Security standards such as PCI, FIPS, and others require use of key management systems to secure, manage, and protect encryption keys in key vaults or hardware security modules (HSMs). 

To use component_keyring_encrypted_file  for keystore management, you must: 

1. Write a manifest that tells the server to load component_keyring_encrypted_file , as described in Section 6.4.4.2, “Keyring Component Installation” . 

2. Write a configuration file for component_keyring_encrypted_file , as described here. 

When it initializes, component_keyring_encrypted_file  reads either a global configuration file, or a global configuration file paired with a local configuration file: 

•The component attempts to read its global configuration file from the directory where the component library file is installed (that is, the server plugin directory). 

•If the global configuration file indicates use of a local configuration file, the component attempts to read its local configuration file from the data directory. 

