Encryption and Compression Functions VALUES (1,AES_ENCRYPT(’text’, UNHEX(SHA2(’My secret passphrase’,512)))); mysql>  SET block_encryption_mode = ’aes-256-cbc’; mysql>  SET @key_str = SHA2(’My secret passphrase’,512); mysql>  SET @init_vector = RANDOM_BYTES(16); mysql>  SET @crypt_str = AES_ENCRYPT(’text’,@key_str,@init_vector); mysql>  SELECT AES_DECRYPT(@crypt_str,@key_str,@init_vector); +-----------------------------------------------+ | AES_DECRYPT(@crypt_str,@key_str,@init_vector) | +-----------------------------------------------+ | text | +-----------------------------------------------+ 2273 Block Encryption Mode Initialization Vector Required ECB No CBC Yes CFB1 Yes CFB8 Yes CFB128 Yes The following table lists each permitted block encryption mode and whether the initialization vector argument is required. A random string of bytes to use for the initialization vector can be produced by calling RANDOM_BYTES(16) . For encryption modes that require an initialization vector, the same vector must be used for encryption and decryption. For modes that do not require  init_vector , it is ignored and a warning is generated if it is specified. For modes that require the optional  init_vector  argument, it must be 16 bytes or longer (bytes in excess of 16 are ignored). An error occurs if  init_vector  is missing. AES_ENCRYPT()  and  AES_DECRYPT()  permit control of the block encryption mode and take an optional  init_vector  initialization vector argument: If  AES_DECRYPT()  detects invalid data or incorrect padding, it returns  NULL . However, it is possible for AES_DECRYPT()  to return a non- NULL  value (possibly garbage) if the input data or the key is invalid. Do not pass a password or passphrase directly to  crypt_str , hash it first. Previous versions of this documentation suggested the former approach, but it is no longer recommended as the examples shown here are more secure. •The  block_encryption_mode  system variable controls the mode for block-based encryption algorithms. Its default value is  aes-128-ecb , which signifies encryption using a key length of 128 bits and ECB mode. For a description of the permitted values of this variable, see Section 5.1.8, “Server System Variables” . •The optional  init_vector  argument provides an initialization vector for block encryption modes that require it.