How Transparent Data Encryption is built in MySQL and Percona Server ?

Abstract

How Transparent Data Encryption is built in MySQL and Percona Server ? - keyrings – what are they used for ? What is the difference between using a server back-end (keyring_vault) versus file back-end (keyring_file). How it affects server startup and why? Why per server separation is needed in Vault Server?

• How Master Key encryption works ? How it is build on page level ? How do we know which key we should fetch to decrypt a table ? How do we know that used key is the correct one ? How do we make sure that we can decrypt a table when we need it ?
• What crypto algorithms are used ?
• How Master Key rotation works ? Why is it needed ?
• What is KEYRING encryption and what are encryption threads?
• How binlog encryption works in 5.7 and how it works in 8.0 ?
• How undo log/redo log encryption works ?