Suppose if I am using the mysql database based encryption using AES_ENCRYPT function & insert records, is it possible to decode the row formatted binlogs generated by MySQL to obtain the actual statements consisting of AES_ENCRYPT?

  • Function AES_ENCRYPT() in MySQL is insecure because it operates in ECB block mode. Furthermore, it doesn't assure authenticity.
    – Matrix
    Mar 6, 2013 at 10:36

1 Answer 1


There is a description of what MySQL does here. It takes the key almost as is and applies AES in ECB mode, which is weak since it leaks which blocks are identical to each other in data encrypted with a given key. You should not assume that data which was encrypted with MySQL's AES_ENCRYPT() is really "secure".

That being said, whether your key and data will make it to the binary log depends on how it was configured. If using statement-based formatting, then the binary log will contain the SQL statements which were issued (at least those which entail modifications), and your data and key may be revealed that way. If you use row-based formatting, then the log contains the results (alterations to actual rows), and your cleartext data and key won't appear in the log. See this question for pointers.

  • I too agree its not secure & I know about row-based formatting. My question is can we reverse engineer the row-formatted binary logs to extract the data out. for e.g. as mentioned in mysqlperformanceblog.com/2010/05/06/…
    – Deepesh M
    Mar 6, 2013 at 16:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .