Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Suppose if I am using the mysql database based encryption using AES_ENCRYPT function & insert records, is it possible to decode the row formatted binlogs generated by MySQL to obtain the actual statements consisting of AES_ENCRYPT?

share|improve this question
    
Function AES_ENCRYPT() in MySQL is insecure because it operates in ECB block mode. Furthermore, it doesn't assure authenticity. –  Matrix Mar 6 '13 at 10:36

1 Answer 1

There is a description of what MySQL does here. It takes the key almost as is and applies AES in ECB mode, which is weak since it leaks which blocks are identical to each other in data encrypted with a given key. You should not assume that data which was encrypted with MySQL's AES_ENCRYPT() is really "secure".

That being said, whether your key and data will make it to the binary log depends on how it was configured. If using statement-based formatting, then the binary log will contain the SQL statements which were issued (at least those which entail modifications), and your data and key may be revealed that way. If you use row-based formatting, then the log contains the results (alterations to actual rows), and your cleartext data and key won't appear in the log. See this question for pointers.

share|improve this answer
    
I too agree its not secure & I know about row-based formatting. My question is can we reverse engineer the row-formatted binary logs to extract the data out. for e.g. as mentioned in mysqlperformanceblog.com/2010/05/06/… –  Deepesh M Mar 6 '13 at 16:41

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.