title: MariaDB/MySQL table encryption
body: <p><a href="https://mariadb.org/table-and-tablespace-encryption-on-mariadb-10-1-3/" rel="nofollow">This article</a> provides an extensive discussion on the subject of encrypting MariaDB database tables.  Another excellent resource is <a href="http://planet.mysql.com/entry/?id=5989105" rel="nofollow">this one</a>.  The one thing they do not mention is where to define the table level encryption configuration.  Am I right in assuming that this should be done by</p>
  
  <ul>
  <li>Placing the relevant directives, e.g. <code>plugin-load-add=file_key_management_plugin.so</code> in the <code>/etc/mysql/my.cnf</code> system</li>
  <li>creating the encryption keys</li>
  <li>restarting the MariaDB server and finally,</li>
  <li>issuing an <code>ALTER TABLE ENCRYPTED=YES ENCRYPTION_KEY_ID=NN;</code> on each of the tables to be encrypted</li>
  </ul>
  
  <p>Even if this is correct there is one question that springs to mind to me here - how would such encryption protect compromised data if the attacker gets access to the encrypted keys file at the same time?  Would a possible solution be to store the encrypted keys on an NFS shared folder that is configured to be only accessible from a specified IP address?</p>