PS-11106 [8.4] Component Percona keyring encrypted file

- Created component_percona_keyring_encrypted_file based on
component_keyring_file.
- Added cmake flag: WITH_COMPONENT_PERCONA_KEYRING_ENCRYPTED_FILE
- New PBKDF2-based encrypt/decrypt API (aes.cc): Added
aes_encrypt_pbkdf2 and aes_decrypt_pbkdf2 functions that derive a
256-bit AES key from a password using PKCS5_PBKDF2_HMAC (SHA-256).
Refactored the internal EVP encrypt/decrypt logic into private helpers
to avoid code duplication.
- Encrypted backend (backend.cc): Renamed Keyring_file_backend to
Keyring_encrypted_file_backend and wired in password-based encryption.
On write, generates a random salt, IV, and iteration count; on read,
parses v1 on-disk header ([version:1][salt:32][iterations:4
BE][iv:16][ciphertext]) and decrypts before JSON parsing.
- Password config options (config.cc): The component configuration now
requires exactly one of password (inline) or password_file (path to a
file containing the password). Validation errors are emitted for
missing, empty, or conflicting combinations. The
keyring_component_status table reports <SET> or <NONE> for the password
field.

Author: catalinbp

components/keyrings/CMakeLists.txt

@@ -27,6 +27,7 @@ ADD_SUBDIRECTORY(common)
 
 # Keyring_file component
 ADD_SUBDIRECTORY(keyring_file)
+ADD_SUBDIRECTORY(percona_keyring_encrypted_file)
 ADD_SUBDIRECTORY(keyring_kmip)
 ADD_SUBDIRECTORY(keyring_kms)
 ADD_SUBDIRECTORY(keyring_vault)

components/keyrings/common/encryption/aes.cc

@@ -29,7 +29,9 @@ Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301  USA */
 
 #include <openssl/aes.h>
 #include <openssl/bio.h>
+#include <openssl/crypto.h>
 #include <openssl/err.h>
+#include <openssl/evp.h>
 
 #include <openssl/sha.h>
 
@@ -138,13 +140,14 @@ size_t get_ciphertext_size(size_t input_size, const Keyring_aes_opmode mode) {
                         : input_size;
 }
 
-aes_return_status aes_encrypt(const unsigned char *source,
-                              unsigned int source_length, unsigned char *dest,
-                              const unsigned char *key, unsigned int key_length,
-                              Keyring_aes_opmode mode, const unsigned char *iv,
-                              bool padding, size_t *encrypted_length) {
-  if (encrypted_length == nullptr) return AES_OUTPUT_SIZE_NULL;
+namespace {
 
+aes_return_status aes_evp_encrypt(const unsigned char *source,
+                                  unsigned int source_length,
+                                  unsigned char *dest, const EVP_CIPHER *cipher,
+                                  const unsigned char *raw_key,
+                                  const unsigned char *iv, bool padding,
+                                  size_t *encrypted_length) {
 #if OPENSSL_VERSION_NUMBER < 0x10100000L
   EVP_CIPHER_CTX stack_ctx;
   EVP_CIPHER_CTX *ctx = &stack_ctx;
@@ -163,39 +166,30 @@ aes_return_status aes_encrypt(const unsigned char *source,
 #endif /* OPENSSL_VERSION_NUMBER < 0x10100000L */
   });
 
-  const EVP_CIPHER *cipher = aes_evp_type(mode);
-  if (cipher == nullptr) return AES_INVALID_BLOCK_MODE;
-
-  /* The real key to be used for encryption */
-  std::unique_ptr<unsigned char[]> rkey;
-  size_t rkey_size;
-  if (aes_create_key(key, key_length, rkey, &rkey_size, mode) == false)
-    return AES_KEY_TRANSFORMATION_ERROR;
-
   if (EVP_CIPHER_iv_length(cipher) > 0 && !iv) return AES_IV_EMPTY;
 
   int u_len, f_len;
 
-  if (!EVP_EncryptInit(ctx, cipher, rkey.get(), iv))
+  if (EVP_EncryptInit(ctx, cipher, raw_key, iv) == 0)
+    return AES_ENCRYPTION_ERROR;
+  if (EVP_CIPHER_CTX_set_padding(ctx, padding) == 0)
+    return AES_ENCRYPTION_ERROR;
+  if (EVP_EncryptUpdate(ctx, dest, &u_len, source, source_length) == 0)
     return AES_ENCRYPTION_ERROR;
-  if (!EVP_CIPHER_CTX_set_padding(ctx, padding)) return AES_ENCRYPTION_ERROR;
-  if (!EVP_EncryptUpdate(ctx, dest, &u_len, source, source_length))
+  if (EVP_EncryptFinal(ctx, dest + u_len, &f_len) == 0)
     return AES_ENCRYPTION_ERROR;
-  if (!EVP_EncryptFinal(ctx, dest + u_len, &f_len)) return AES_ENCRYPTION_ERROR;
 
   /* All is well */
   *encrypted_length = static_cast<size_t>(u_len + f_len);
   return AES_OP_OK;
 }
 
-aes_return_status aes_decrypt(const unsigned char *source,
-                              unsigned int source_length, unsigned char *dest,
-                              const unsigned char *key, unsigned int key_length,
-                              enum Keyring_aes_opmode mode,
-                              const unsigned char *iv, bool padding,
-                              size_t *decrypted_length) {
-  if (decrypted_length == nullptr) return AES_OUTPUT_SIZE_NULL;
-
+aes_return_status aes_evp_decrypt(const unsigned char *source,
+                                  unsigned int source_length,
+                                  unsigned char *dest, const EVP_CIPHER *cipher,
+                                  const unsigned char *raw_key,
+                                  const unsigned char *iv, bool padding,
+                                  size_t *decrypted_length) {
 #if OPENSSL_VERSION_NUMBER < 0x10100000L
   EVP_CIPHER_CTX stack_ctx;
   EVP_CIPHER_CTX *ctx = &stack_ctx;
@@ -214,31 +208,110 @@ aes_return_status aes_decrypt(const unsigned char *source,
 #endif /* OPENSSL_VERSION_NUMBER < 0x10100000L */
   });
 
-  const EVP_CIPHER *cipher = aes_evp_type(mode);
-  if (cipher == nullptr) return AES_INVALID_BLOCK_MODE;
-
-  /* The real key to be used for encryption */
-  std::unique_ptr<unsigned char[]> rkey;
-  size_t rkey_size;
-  if (aes_create_key(key, key_length, rkey, &rkey_size, mode) == false)
-    return AES_KEY_TRANSFORMATION_ERROR;
-
   if (EVP_CIPHER_iv_length(cipher) > 0 && !iv) return AES_IV_EMPTY;
 
   int u_len, f_len;
 
-  if (!EVP_DecryptInit(ctx, aes_evp_type(mode), rkey.get(), iv))
+  if (EVP_DecryptInit(ctx, cipher, raw_key, iv) == 0)
     return AES_DECRYPTION_ERROR;
-  if (!EVP_CIPHER_CTX_set_padding(ctx, padding)) return AES_DECRYPTION_ERROR;
-  if (!EVP_DecryptUpdate(ctx, dest, &u_len, source, source_length))
+  if (EVP_CIPHER_CTX_set_padding(ctx, padding) == 0)
     return AES_DECRYPTION_ERROR;
-  if (!EVP_DecryptFinal_ex(ctx, dest + u_len, &f_len))
+  if (EVP_DecryptUpdate(ctx, dest, &u_len, source, source_length) == 0)
+    return AES_DECRYPTION_ERROR;
+  if (EVP_DecryptFinal_ex(ctx, dest + u_len, &f_len) == 0)
     return AES_DECRYPTION_ERROR;
 
   /* All is well */
   *decrypted_length = static_cast<size_t>(u_len + f_len);
   return AES_OP_OK;
 }
 
+}  // namespace
+
+aes_return_status aes_encrypt(const unsigned char *source,
+                              unsigned int source_length, unsigned char *dest,
+                              const unsigned char *key, unsigned int key_length,
+                              Keyring_aes_opmode mode, const unsigned char *iv,
+                              bool padding, size_t *encrypted_length) {
+  if (encrypted_length == nullptr) return AES_OUTPUT_SIZE_NULL;
+
+  const EVP_CIPHER *cipher = aes_evp_type(mode);
+  if (cipher == nullptr) return AES_INVALID_BLOCK_MODE;
+
+  /* The real key to be used for encryption */
+  std::unique_ptr<unsigned char[]> rkey;
+  size_t rkey_size = 0;
+  if (!aes_create_key(key, key_length, rkey, &rkey_size, mode))
+    return AES_KEY_TRANSFORMATION_ERROR;
+
+  return aes_evp_encrypt(source, source_length, dest, cipher, rkey.get(), iv,
+                         padding, encrypted_length);
+}
+
+aes_return_status aes_decrypt(const unsigned char *source,
+                              unsigned int source_length, unsigned char *dest,
+                              const unsigned char *key, unsigned int key_length,
+                              enum Keyring_aes_opmode mode,
+                              const unsigned char *iv, bool padding,
+                              size_t *decrypted_length) {
+  if (decrypted_length == nullptr) return AES_OUTPUT_SIZE_NULL;
+
+  const EVP_CIPHER *cipher = aes_evp_type(mode);
+  if (cipher == nullptr) return AES_INVALID_BLOCK_MODE;
+
+  /* The real key to be used for encryption */
+  std::unique_ptr<unsigned char[]> rkey;
+  size_t rkey_size = 0;
+  if (!aes_create_key(key, key_length, rkey, &rkey_size, mode))
+    return AES_KEY_TRANSFORMATION_ERROR;
+
+  return aes_evp_decrypt(source, source_length, dest, cipher, rkey.get(), iv,
+                         padding, decrypted_length);
+}
+
+aes_return_status aes_encrypt_pbkdf2(
+    const unsigned char *source, unsigned int source_length,
+    unsigned char *dest, const unsigned char *password, size_t password_len,
+    const unsigned char *salt, size_t salt_len, unsigned int iterations,
+    Keyring_aes_opmode mode, const unsigned char *iv, bool padding,
+    size_t *encrypted_length) {
+  if (encrypted_length == nullptr) return AES_OUTPUT_SIZE_NULL;
+  const EVP_CIPHER *cipher = aes_evp_type(mode);
+  if (cipher == nullptr) return AES_INVALID_BLOCK_MODE;
+  unsigned char raw_key[32];
+  auto zero_key =
+      create_scope_guard([&] { OPENSSL_cleanse(raw_key, sizeof(raw_key)); });
+  if (PKCS5_PBKDF2_HMAC(reinterpret_cast<const char *>(password),
+                        static_cast<int>(password_len), salt,
+                        static_cast<int>(salt_len),
+                        static_cast<int>(iterations), EVP_sha256(),
+                        static_cast<int>(sizeof(raw_key)), raw_key) != 1)
+    return AES_KEY_TRANSFORMATION_ERROR;
+  return aes_evp_encrypt(source, source_length, dest, cipher, raw_key, iv,
+                         padding, encrypted_length);
+}
+
+aes_return_status aes_decrypt_pbkdf2(
+    const unsigned char *source, unsigned int source_length,
+    unsigned char *dest, const unsigned char *password, size_t password_len,
+    const unsigned char *salt, size_t salt_len, unsigned int iterations,
+    Keyring_aes_opmode mode, const unsigned char *iv, bool padding,
+    size_t *decrypted_length) {
+  if (decrypted_length == nullptr) return AES_OUTPUT_SIZE_NULL;
+  const EVP_CIPHER *cipher = aes_evp_type(mode);
+  if (cipher == nullptr) return AES_INVALID_BLOCK_MODE;
+  unsigned char raw_key[32];
+  auto zero_key =
+      create_scope_guard([&] { OPENSSL_cleanse(raw_key, sizeof(raw_key)); });
+  if (PKCS5_PBKDF2_HMAC(reinterpret_cast<const char *>(password),
+                        static_cast<int>(password_len), salt,
+                        static_cast<int>(salt_len),
+                        static_cast<int>(iterations), EVP_sha256(),
+                        static_cast<int>(sizeof(raw_key)), raw_key) != 1)
+    return AES_KEY_TRANSFORMATION_ERROR;
+  return aes_evp_decrypt(source, source_length, dest, cipher, raw_key, iv,
+                         padding, decrypted_length);
+}
+
 }  // namespace aes_encryption
 }  // namespace keyring_common

components/keyrings/common/encryption/aes.h

@@ -94,6 +94,28 @@ aes_return_status aes_decrypt(const unsigned char *source,
                               Keyring_aes_opmode mode, const unsigned char *iv,
                               bool padding, size_t *decrypted_length);
 
+/**
+  Encrypt using a password: derives a 256-bit AES key via PBKDF2-HMAC-SHA256
+  and then encrypts with the requested mode.
+*/
+aes_return_status aes_encrypt_pbkdf2(
+    const unsigned char *source, unsigned int source_length,
+    unsigned char *dest, const unsigned char *password, size_t password_len,
+    const unsigned char *salt, size_t salt_len, unsigned int iterations,
+    Keyring_aes_opmode mode, const unsigned char *iv, bool padding,
+    size_t *encrypted_length);
+
+/**
+  Decrypt using a password: derives a 256-bit AES key via PBKDF2-HMAC-SHA256
+  and then decrypts with the requested mode.
+*/
+aes_return_status aes_decrypt_pbkdf2(
+    const unsigned char *source, unsigned int source_length,
+    unsigned char *dest, const unsigned char *password, size_t password_len,
+    const unsigned char *salt, size_t salt_len, unsigned int iterations,
+    Keyring_aes_opmode mode, const unsigned char *iv, bool padding,
+    size_t *decrypted_length);
+
 }  // namespace aes_encryption
 }  // namespace keyring_common
 

components/keyrings/percona_keyring_encrypted_file/CMakeLists.txt

@@ -0,0 +1,97 @@
+# Copyright (c) 2021, 2025, Oracle and/or its affiliates.
+# Copyright (c) 2026 Percona LLC and/or its affiliates. All rights reserved.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License, version 2.0,
+# as published by the Free Software Foundation.
+#
+# This program is designed to work with certain software (including
+# but not limited to OpenSSL) that is licensed under separate terms,
+# as designated in a particular file or component or in included license
+# documentation.  The authors of MySQL hereby grant you an additional
+# permission to link the program and your derivative works with the
+# separately licensed software that they have either included with
+# the program or referenced in the documentation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License, version 2.0, for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301  USA
+
+IF (NOT DEFINED WITH_COMPONENT_PERCONA_KEYRING_ENCRYPTED_FILE AND
+    NOT DEFINED WITHOUT_COMPONENT_PERCONA_KEYRING_ENCRYPTED_FILE)
+  SET(WITH_COMPONENT_PERCONA_KEYRING_ENCRYPTED_FILE 1)
+ENDIF()
+
+IF(NOT WITH_COMPONENT_PERCONA_KEYRING_ENCRYPTED_FILE)
+  RETURN()
+ENDIF()
+
+ADD_DEFINITIONS(-DLOG_COMPONENT_TAG="component_percona_keyring_encrypted_file")
+
+INCLUDE_DIRECTORIES(
+  ${CMAKE_CURRENT_SOURCE_DIR}
+  ${BOOST_PATCHES_DIR}
+  ${BOOST_INCLUDE_DIR}
+)
+
+
+SET(PERCONA_KEYRING_ENCRYPTED_FILE_SOURCE
+  # Encryption handling
+  service_implementation/keyring_encryption_service_definition.cc
+
+  # Generator handling
+  service_implementation/keyring_generator_service_definition.cc
+
+  # Keyring load handling
+  service_implementation/keyring_load_service_definition.cc
+
+  # Keys metadata iterator handling
+  service_implementation/keyring_keys_metadata_iterator_service_definition.cc
+
+  # Metadata query handling
+  service_implementation/keyring_metadata_query_service_definition.cc
+
+  # Reader handling
+  service_implementation/keyring_reader_service_definition.cc
+
+  # Writer handling
+  service_implementation/keyring_writer_service_definition.cc
+
+  # Backend handling
+  backend/backend.cc
+
+  # Config handling
+  config/config.cc
+
+  # Keyring file component handling
+  percona_keyring_encrypted_file.cc
+
+  # Component callbacks
+  component_callbacks.cc
+)
+
+SET(PERCONA_KEYRING_ENCRYPTED_FILE_LIBRARIES
+  keyring_common
+  OpenSSL::SSL OpenSSL::Crypto
+)
+
+MYSQL_ADD_COMPONENT(percona_keyring_encrypted_file
+  ${PERCONA_KEYRING_ENCRYPTED_FILE_SOURCE}
+  LINK_LIBRARIES ${PERCONA_KEYRING_ENCRYPTED_FILE_LIBRARIES}
+  MODULE_ONLY
+)
+
+add_dependencies(component_percona_keyring_encrypted_file GenError)
+
+MY_TARGET_LINK_OPTIONS(component_percona_keyring_encrypted_file "${LINK_FLAG_NO_UNDEFINED}")
+
+IF(APPLE)
+  SET_TARGET_PROPERTIES(component_percona_keyring_encrypted_file PROPERTIES
+    LINK_FLAGS "-undefined dynamic_lookup")
+ENDIF()
+