General Tablespace Encryption TABLE_ENCRYPTION_ADMIN  privilege. See Defining an Encryption Default for Schemas and General Tablespaces. General Tablespace Encryption As of MySQL 8.0.16, the  default_table_encryption  variable determines the encryption of a newly created general tablespace unless an  ENCRYPTION  clause is specified explicitly in the  CREATE TABLESPACE  statement. Prior to MySQL 8.0.16, an  ENCRYPTION  clause must be specified to enable encryption. To alter the encryption of an existing general tablespace, an  ENCRYPTION  clause must be specified. mysql>  CREATE TABLESPACE ‘ts1‘ ADD DATAFILE ’ts1.ibd’ ENCRYPTION = ’Y’ Engine=InnoDB; mysql>  ALTER TABLESPACE ts1 ENCRYPTION = ’Y’; Doublewrite File Encryption mysql System Tablespace Encryption Redo Log Encryption 3200 As with tablespace data, redo log data encryption occurs when redo log data is written to disk, and decryption occurs when redo log data is read from disk. Once redo log data is read into memory, it is in unencrypted form. Redo log data is encrypted and decrypted using the tablespace encryption key. Redo log data encryption is enabled using the  innodb_redo_log_encrypt  configuration option. Redo log encryption is disabled by default. Enabling or disabling encryption for the  mysql  system tablespace requires the  CREATE TABLESPACE privilege on all tables in the instance ( CREATE TABLESPACE on *.*) . mysql> ALTER TABLESPACE mysql ENCRYPTION = ’N’; mysql> ALTER TABLESPACE mysql ENCRYPTION = ’Y’; Encryption support for the  mysql  system tablespace is available as of MySQL 8.0.16. The  mysql  system tablespace contains the  mysql  system database and MySQL data dictionary tables. It is unencrypted by default. To enable encryption for the  mysql  system tablespace, specify the tablespace name and the  ENCRYPTION  option in an  ALTER TABLESPACE  statement. To disable encryption for the  mysql  system tablespace, set  ENCRYPTION = ’N’  using an  ALTER TABLESPACE  statement. As of MySQL 8.0.16, if the  table_encryption_privilege_check  variable is enabled, specifying an ENCRYPTION  clause with a setting that differs from the  default_table_encryption  setting requires the  TABLE_ENCRYPTION_ADMIN  privilege. See Defining an Encryption Default for Schemas and General Tablespaces. Encryption support for doublewrite files is available as of MySQL 8.0.23.  InnoDB  automatically encrypts doublewrite file pages that belong to encrypted tablespaces. No action is required. Doublewrite file pages are encrypted using the encryption key of the associated tablespace. The same encrypted page written to a tablespace data file is also written to a doublewrite file. Doublewrite file pages that belong to an unencrypted tablespace remain unencrypted. During recovery, encrypted doublewrite file pages are unencrypted and checked for corruption.