MySQL 8.0 FAQ: InnoDB Data-at-Rest Encryption modifies secondary index pages, or when there are lots of secondary indexes that are regularly changed by DML activity. You might consider disabling the change buffer if the entire data set fits within the  InnoDB  buffer pool, if you have relatively few secondary indexes, or if you are using solid-state storage, where random reads are about as fast as sequential reads. Before making configuration changes, it is recommended that you run tests using a representative workload to determine if disabling the change buffer provides any benefit. See Section 15.5.2, “Change Buffer” . Yes.  InnoDB  data-at-rest encryption is designed to transparently apply encryption within the database without impacting existing applications. Returning data in encrypted format would break most existing applications.  InnoDB  data-at-rest encryption provides the benefit of encryption without the overhead associated with traditional database encryption solutions, which would typically require expensive and substantial changes to applications, database triggers, and views. There is no additional storage overhead. According to internal benchmarks, performance overhead amounts to a single digit percentage difference. InnoDB  data-at-rest encryption supports the Advanced Encryption Standard (AES256) block-based encryption algorithm. It uses Electronic Codebook (ECB) block encryption mode for tablespace key encryption and Cipher Block Chaining (CBC) block encryption mode for data encryption. 5277 A.17.4. Is it possible to use 3rd party encryption algorithms in place of the one provided by the  InnoDB data-at-rest encryption feature? A.17.3. What are the encryption algorithms used with  InnoDB  data-at-rest encryption? A.17.2. What is the overhead associated with  InnoDB  data-at-rest encryption? A.17.1. Is data decrypted for users who are authorized to see it? A.17.15 How do I migrate data from a cleartext  InnoDB  tablespace to an encrypted  InnoDB tablespace? ........................................................................................................................ 5279 A.17.14 How do I change (rotate, re-key) the master encryption key? ............................................. 5279 A.17.13 Can I use  mysqlpump  or  mysqldump  with encrypted tables? ............................................ 5278 A.17.12 Does compression work with  InnoDB  data-at-rest encryption? ........................................... 5278 A.17.11 Does the transportable tablespaces feature work with  InnoDB  data-at-rest encryption? ........ 5278 A.17.10 How is  InnoDB  data-at-rest encryption different from encryption functions MySQL already provides? ............................................................................................................................ 5278 A.17.9 How do I know which data to encrypt? ............................................................................... 5278 A.17.8 Does database memory contain cleartext or encrypted data? ............................................... 5278 A.17.7 Does data remain encrypted on the network? ..................................................................... 5278 A.17.6 What data types and data lengths does  InnoDB  data-at-rest encryption support? .................. 5278 A.17.5 Can indexed columns be encrypted? .................................................................................. 5278 A.17.4 Is it possible to use 3rd party encryption algorithms in place of the one provided by the InnoDB  data-at-rest encryption feature? .............................................................................. 5277 A.17.3 What are the encryption algorithms used with  InnoDB  data-at-rest encryption? ..................... 5277 A.17.2 What is the overhead associated with  InnoDB  data-at-rest encryption? ................................ 5277 A.17.1 Is data decrypted for users who are authorized to see it? .................................................... 5277 A.16.10. Where can I find additional information about the change buffer? A.16.9. When should the change buffer not be used? A.17 MySQL 8.0 FAQ: InnoDB Data-at-Rest Encryption