PS-11106 [9.7] Component Percona keyring encrypted file [1, plugin]

- New PBKDF2-based encrypt/decrypt API (aes.cc): Added
aes_encrypt_pbkdf2 and aes_decrypt_pbkdf2 functions that derive a
256-bit AES key from a password using PKCS5_PBKDF2_HMAC (SHA-256).
Refactored the internal EVP encrypt/decrypt logic into private helpers
to avoid code duplication.
- Encrypted backend (backend.cc): Renamed Keyring_file_backend to
Keyring_encrypted_file_backend and wired in password-based encryption.
On write, generates a random salt, IV, and iteration count; on read,
parses v1 on-disk header ([version:1][salt:32][iterations:4
BE][iv:16][ciphertext]) and decrypts before JSON parsing.
- Password config options (config.cc): The component configuration now
requires exactly one of password (inline) or password_file (path to a
file containing the password). Validation errors are emitted for
missing, empty, or conflicting combinations. The
keyring_component_status table reports <SET> or <NONE> for the password
field.

Author: catalinbp

components/keyrings/CMakeLists.txt

@@ -27,6 +27,7 @@ ADD_SUBDIRECTORY(common)
 
 # Keyring_file component
 ADD_SUBDIRECTORY(keyring_file)
+ADD_SUBDIRECTORY(percona_keyring_encrypted_file)
 ADD_SUBDIRECTORY(keyring_kmip)
 ADD_SUBDIRECTORY(keyring_kms)
 ADD_SUBDIRECTORY(keyring_vault)

components/keyrings/common/encryption/aes.cc

@@ -29,7 +29,9 @@ Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301  USA */
 
 #include <openssl/aes.h>
 #include <openssl/bio.h>
+#include <openssl/crypto.h>
 #include <openssl/err.h>
+#include <openssl/evp.h>
 
 #include <openssl/sha.h>
 
@@ -134,13 +136,10 @@ size_t get_ciphertext_size(size_t input_size, const Keyring_aes_opmode mode) {
                         : input_size;
 }
 
-aes_return_status aes_encrypt(const unsigned char *source,
-                              unsigned int source_length, unsigned char *dest,
-                              const unsigned char *key, unsigned int key_length,
-                              Keyring_aes_opmode mode, const unsigned char *iv,
-                              bool padding, size_t *encrypted_length) {
-  if (encrypted_length == nullptr) return AES_OUTPUT_SIZE_NULL;
-
+static aes_return_status aes_evp_encrypt(
+    const unsigned char *source, unsigned int source_length,
+    unsigned char *dest, const EVP_CIPHER *cipher, const unsigned char *raw_key,
+    const unsigned char *iv, bool padding, size_t *encrypted_length) {
 #if OPENSSL_VERSION_NUMBER < 0x10100000L
   EVP_CIPHER_CTX stack_ctx;
   EVP_CIPHER_CTX *ctx = &stack_ctx;
@@ -159,21 +158,11 @@ aes_return_status aes_encrypt(const unsigned char *source,
 #endif /* OPENSSL_VERSION_NUMBER < 0x10100000L */
   });
 
-  const EVP_CIPHER *cipher = aes_evp_type(mode);
-  if (cipher == nullptr) return AES_INVALID_BLOCK_MODE;
-
-  /* The real key to be used for encryption */
-  std::unique_ptr<unsigned char[]> rkey;
-  size_t rkey_size;
-  if (!aes_create_key(key, key_length, rkey, &rkey_size, mode))
-    return AES_KEY_TRANSFORMATION_ERROR;
-
   if (EVP_CIPHER_iv_length(cipher) > 0 && !iv) return AES_IV_EMPTY;
 
   int u_len, f_len;
 
-  if (!EVP_EncryptInit(ctx, cipher, rkey.get(), iv))
-    return AES_ENCRYPTION_ERROR;
+  if (!EVP_EncryptInit(ctx, cipher, raw_key, iv)) return AES_ENCRYPTION_ERROR;
   if (!EVP_CIPHER_CTX_set_padding(ctx, padding)) return AES_ENCRYPTION_ERROR;
   if (!EVP_EncryptUpdate(ctx, dest, &u_len, source, source_length))
     return AES_ENCRYPTION_ERROR;
@@ -184,14 +173,10 @@ aes_return_status aes_encrypt(const unsigned char *source,
   return AES_OP_OK;
 }
 
-aes_return_status aes_decrypt(const unsigned char *source,
-                              unsigned int source_length, unsigned char *dest,
-                              const unsigned char *key, unsigned int key_length,
-                              enum Keyring_aes_opmode mode,
-                              const unsigned char *iv, bool padding,
-                              size_t *decrypted_length) {
-  if (decrypted_length == nullptr) return AES_OUTPUT_SIZE_NULL;
-
+static aes_return_status aes_evp_decrypt(
+    const unsigned char *source, unsigned int source_length,
+    unsigned char *dest, const EVP_CIPHER *cipher, const unsigned char *raw_key,
+    const unsigned char *iv, bool padding, size_t *decrypted_length) {
 #if OPENSSL_VERSION_NUMBER < 0x10100000L
   EVP_CIPHER_CTX stack_ctx;
   EVP_CIPHER_CTX *ctx = &stack_ctx;
@@ -210,21 +195,11 @@ aes_return_status aes_decrypt(const unsigned char *source,
 #endif /* OPENSSL_VERSION_NUMBER < 0x10100000L */
   });
 
-  const EVP_CIPHER *cipher = aes_evp_type(mode);
-  if (cipher == nullptr) return AES_INVALID_BLOCK_MODE;
-
-  /* The real key to be used for encryption */
-  std::unique_ptr<unsigned char[]> rkey;
-  size_t rkey_size;
-  if (!aes_create_key(key, key_length, rkey, &rkey_size, mode))
-    return AES_KEY_TRANSFORMATION_ERROR;
-
   if (EVP_CIPHER_iv_length(cipher) > 0 && !iv) return AES_IV_EMPTY;
 
   int u_len, f_len;
 
-  if (!EVP_DecryptInit(ctx, aes_evp_type(mode), rkey.get(), iv))
-    return AES_DECRYPTION_ERROR;
+  if (!EVP_DecryptInit(ctx, cipher, raw_key, iv)) return AES_DECRYPTION_ERROR;
   if (!EVP_CIPHER_CTX_set_padding(ctx, padding)) return AES_DECRYPTION_ERROR;
   if (!EVP_DecryptUpdate(ctx, dest, &u_len, source, source_length))
     return AES_DECRYPTION_ERROR;
@@ -236,4 +211,89 @@ aes_return_status aes_decrypt(const unsigned char *source,
   return AES_OP_OK;
 }
 
+aes_return_status aes_encrypt(const unsigned char *source,
+                              unsigned int source_length, unsigned char *dest,
+                              const unsigned char *key, unsigned int key_length,
+                              Keyring_aes_opmode mode, const unsigned char *iv,
+                              bool padding, size_t *encrypted_length) {
+  if (encrypted_length == nullptr) return AES_OUTPUT_SIZE_NULL;
+
+  const EVP_CIPHER *cipher = aes_evp_type(mode);
+  if (cipher == nullptr) return AES_INVALID_BLOCK_MODE;
+
+  /* The real key to be used for encryption */
+  std::unique_ptr<unsigned char[]> rkey;
+  size_t rkey_size;
+  if (!aes_create_key(key, key_length, rkey, &rkey_size, mode))
+    return AES_KEY_TRANSFORMATION_ERROR;
+
+  return aes_evp_encrypt(source, source_length, dest, cipher, rkey.get(), iv,
+                         padding, encrypted_length);
+}
+
+aes_return_status aes_decrypt(const unsigned char *source,
+                              unsigned int source_length, unsigned char *dest,
+                              const unsigned char *key, unsigned int key_length,
+                              enum Keyring_aes_opmode mode,
+                              const unsigned char *iv, bool padding,
+                              size_t *decrypted_length) {
+  if (decrypted_length == nullptr) return AES_OUTPUT_SIZE_NULL;
+
+  const EVP_CIPHER *cipher = aes_evp_type(mode);
+  if (cipher == nullptr) return AES_INVALID_BLOCK_MODE;
+
+  /* The real key to be used for encryption */
+  std::unique_ptr<unsigned char[]> rkey;
+  size_t rkey_size;
+  if (!aes_create_key(key, key_length, rkey, &rkey_size, mode))
+    return AES_KEY_TRANSFORMATION_ERROR;
+
+  return aes_evp_decrypt(source, source_length, dest, cipher, rkey.get(), iv,
+                         padding, decrypted_length);
+}
+
+aes_return_status aes_encrypt_pbkdf2(
+    const unsigned char *source, unsigned int source_length,
+    unsigned char *dest, const unsigned char *password, size_t password_len,
+    const unsigned char *salt, size_t salt_len, unsigned int iterations,
+    Keyring_aes_opmode mode, const unsigned char *iv, bool padding,
+    size_t *encrypted_length) {
+  if (encrypted_length == nullptr) return AES_OUTPUT_SIZE_NULL;
+  const EVP_CIPHER *cipher = aes_evp_type(mode);
+  if (cipher == nullptr) return AES_INVALID_BLOCK_MODE;
+  unsigned char raw_key[32];
+  auto zero_key =
+      create_scope_guard([&] { OPENSSL_cleanse(raw_key, sizeof(raw_key)); });
+  if (PKCS5_PBKDF2_HMAC(reinterpret_cast<const char *>(password),
+                        static_cast<int>(password_len), salt,
+                        static_cast<int>(salt_len),
+                        static_cast<int>(iterations), EVP_sha256(),
+                        static_cast<int>(sizeof(raw_key)), raw_key) != 1)
+    return AES_KEY_TRANSFORMATION_ERROR;
+  return aes_evp_encrypt(source, source_length, dest, cipher, raw_key, iv,
+                         padding, encrypted_length);
+}
+
+aes_return_status aes_decrypt_pbkdf2(
+    const unsigned char *source, unsigned int source_length,
+    unsigned char *dest, const unsigned char *password, size_t password_len,
+    const unsigned char *salt, size_t salt_len, unsigned int iterations,
+    Keyring_aes_opmode mode, const unsigned char *iv, bool padding,
+    size_t *decrypted_length) {
+  if (decrypted_length == nullptr) return AES_OUTPUT_SIZE_NULL;
+  const EVP_CIPHER *cipher = aes_evp_type(mode);
+  if (cipher == nullptr) return AES_INVALID_BLOCK_MODE;
+  unsigned char raw_key[32];
+  auto zero_key =
+      create_scope_guard([&] { OPENSSL_cleanse(raw_key, sizeof(raw_key)); });
+  if (PKCS5_PBKDF2_HMAC(reinterpret_cast<const char *>(password),
+                        static_cast<int>(password_len), salt,
+                        static_cast<int>(salt_len),
+                        static_cast<int>(iterations), EVP_sha256(),
+                        static_cast<int>(sizeof(raw_key)), raw_key) != 1)
+    return AES_KEY_TRANSFORMATION_ERROR;
+  return aes_evp_decrypt(source, source_length, dest, cipher, raw_key, iv,
+                         padding, decrypted_length);
+}
+
 }  // namespace keyring_common::aes_encryption

components/keyrings/common/encryption/aes.h

@@ -92,6 +92,28 @@ aes_return_status aes_decrypt(const unsigned char *source,
                               Keyring_aes_opmode mode, const unsigned char *iv,
                               bool padding, size_t *decrypted_length);
 
+/**
+  Encrypt using a password: derives a 256-bit AES key via PBKDF2-HMAC-SHA256
+  and then encrypts with the requested mode.
+*/
+aes_return_status aes_encrypt_pbkdf2(
+    const unsigned char *source, unsigned int source_length,
+    unsigned char *dest, const unsigned char *password, size_t password_len,
+    const unsigned char *salt, size_t salt_len, unsigned int iterations,
+    Keyring_aes_opmode mode, const unsigned char *iv, bool padding,
+    size_t *encrypted_length);
+
+/**
+  Decrypt using a password: derives a 256-bit AES key via PBKDF2-HMAC-SHA256
+  and then decrypts with the requested mode.
+*/
+aes_return_status aes_decrypt_pbkdf2(
+    const unsigned char *source, unsigned int source_length,
+    unsigned char *dest, const unsigned char *password, size_t password_len,
+    const unsigned char *salt, size_t salt_len, unsigned int iterations,
+    Keyring_aes_opmode mode, const unsigned char *iv, bool padding,
+    size_t *decrypted_length);
+
 }  // namespace keyring_common::aes_encryption
 
 #endif  // !AES_INCLUDED

components/keyrings/percona_keyring_encrypted_file/CMakeLists.txt

@@ -1,4 +1,5 @@
-# Copyright (c) 2021, 2025, Oracle and/or its affiliates.
+# Copyright (c) 2021, 2026, Oracle and/or its affiliates.
+# Copyright (c) 2026 Percona LLC and/or its affiliates. All rights reserved.
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License, version 2.0,
@@ -77,6 +78,7 @@ SET(PERCONA_KEYRING_ENCRYPTED_FILE_SOURCE
 SET(PERCONA_KEYRING_ENCRYPTED_FILE_LIBRARIES
   keyring_common
   OpenSSL::SSL OpenSSL::Crypto
+  library_mysys
 )
 
 MYSQL_ADD_COMPONENT(percona_keyring_encrypted_file
@@ -85,7 +87,7 @@ MYSQL_ADD_COMPONENT(percona_keyring_encrypted_file
   MODULE_ONLY
 )
 
-MY_TARGET_LINK_OPTIONS(component_percona_keyring_encrypted_file "${LINK_FLAG_NO_UNDEFINED}")
+TARGET_LINK_OPTIONS(component_percona_keyring_encrypted_file PRIVATE "${LINK_FLAG_NO_UNDEFINED}")
 
 IF(APPLE)
   SET_TARGET_PROPERTIES(component_percona_keyring_encrypted_file PROPERTIES