MySQL Enterprise Encryption Usage and Examples SET @algo = ’RSA’; -- Generate signature for digest and verify signature against digest SET @sig = asymmetric_sign(@algo, @dig, @priv, @dig_type); -- Verify signature against digest SET @verf = asymmetric_verify(@algo, @dig, @sig, @pub, @dig_type); -- Generate DH shared symmetric secret SET @dhp = create_dh_parameters(1024); -- Generate DH key pairs SET @algo = ’DH’; SET @priv1 = create_asymmetric_priv_key(@algo, @dhp); SET @pub1 = create_asymmetric_pub_key(@algo, @priv1); SET @priv2 = create_asymmetric_priv_key(@algo, @dhp); SET @pub2 = create_asymmetric_pub_key(@algo, @priv2); -- Generate symmetric key using public key of first party, -- private key of second party SET @sym1 = asymmetric_derive(@pub1, @priv2); -- Or use public key of second party, private key of first party SET @sym2 = asymmetric_derive(@pub2, @priv1); SET @priv1 = create_asymmetric_priv_key(’RSA’, 1024); SELECT create_asymmetric_priv_key(’RSA’, 1024) INTO @priv2; INSERT INTO t (key_col) VALUES(create_asymmetric_priv_key(’RSA’, 1024)); • MYSQL_OPENSSL_UDF_DSA_BITS_THRESHOLD : Maximum DSA key length in bits for create_asymmetric_priv_key() . The minimum and maximum values for this variable are 1,024 and 10,000. • MYSQL_OPENSSL_UDF_RSA_BITS_THRESHOLD : Maximum RSA key length in bits for create_asymmetric_priv_key() . The minimum and maximum values for this variable are 1,024 and 16,384. The  create_asymmetric_priv_key()  and  create_dh_parameters()  encryption functions take a key-length parameter, and the amount of CPU resources required by these functions increases as the key length increases. For some installations, this might result in unacceptable CPU usage if applications frequently generate excessively long keys. OpenSSL imposes a minimum key length of 1,024 bits for all keys. OpenSSL also imposes a maximum key length of 10,000 bits and 16,384 bits for DSA and RSA keys, respectively, for  create_asymmetric_priv_key() , and a maximum key length of 10,000 bits for create_dh_parameters() . If those maximum values are too high, three environment variables are available to enable MySQL server administrators to set lower maximum lengths for key generation, and thereby to limit CPU usage: Digest and signature strings can be handled similarly. Key string values stored in files can be read using the  LOAD_FILE()  function by users who have the  FILE privilege. Key string values can be created at runtime and stored into a variable or table using  SET ,  SELECT , or INSERT : This requires DH private/public keys as inputs, created using a shared symmetric secret. Create the secret by passing the key length to  create_dh_parameters() , then pass the secret as the “key length”  to create_asymmetric_priv_key() . Create a symmetric key Limit CPU usage by key-generation operations 1596