Skip to content

PBS-39 feature: Add binlog encryption config and keyring support (part 5) - #167

Merged
percona-ysorokin merged 1 commit into
Percona-Lab:0.4from
percona-ysorokin:encryption_opensslpp
Aug 5, 2026
Merged

PBS-39 feature: Add binlog encryption config and keyring support (part 5)#167
percona-ysorokin merged 1 commit into
Percona-Lab:0.4from
percona-ysorokin:encryption_opensslpp

Conversation

@percona-ysorokin

Copy link
Copy Markdown
Collaborator

https://perconadev.atlassian.net/browse/PBS-39

Added new static library 'opensslpp' which is intended to include c++ wrappers for OpenSSL cryptographic primitives.

The initial version includes:

  • 'opensslpp::crypto_rng' class that provides random cryptographically-strong byte sequences generation (based on 'RAND_butes()' API call).
  • 'opensslpp::cipher_context' class that provides a convenient way of encrypting / decrypting data with various algorithms (e.g. 'AES'), key lengths (e.g 128, / 192 / 256 bit), and in various modes (e.g. 'ECB', 'CBC', 'CTR', 'GCM'). It is based on 'EVP_CIPHER_CTX'.
  • 'opensslpp::core_error' exception class that automatically extracts error message from the OpenSSL subsystem (via the 'ERR_get_error()' call)

Currently we support only the following encryption modes:

  • 'ECB' - does not need IV, does not generate / verify tag, operates on blocks only (16 bytes)
  • 'CBC' - needs IV, does not generate / verify tag, operates on blocks only (16 bytes)
  • 'CTR' needs IV, does not generate / verify tag, operates on byte sequences of any size.
  • 'GCM' needs IV, generates / verifies tag, operates on byte sequences of any size.

For both 'ECB' and 'CBC' modes we deliberately disable padding.

Added tho new unit tests:

  • 'crypto_rnd_test.cpp' (BOOST_TEST_MODULE CryptoRndTests)
  • 'cipher_context_test.cpp' (BOOST_TEST_MODULE CipherContextTests)

…t 5)

https://perconadev.atlassian.net/browse/PBS-39

Added new static library 'opensslpp' which is intended to include c++ wrappers for
OpenSSL cryptographic primitives.

The initial version includes:
* 'opensslpp::crypto_rng' class that provides random cryptographically-strong byte
  sequences generation (based on 'RAND_butes()' API call).
* 'opensslpp::cipher_context' class that provides a convenient way of encrypting /
  decrypting data with various algorithms (e.g. 'AES'), key lengths (e.g 128, / 192 / 256
  bit), and in various modes (e.g. 'ECB', 'CBC', 'CTR', 'GCM'). It is based on
  'EVP_CIPHER_CTX'.
* 'opensslpp::core_error' exception class that automatically extracts error message from
  the OpenSSL subsystem (via the 'ERR_get_error()' call)

Currently we support only the following encryption modes:
* 'ECB' - does not need IV, does not generate / verify tag, operates on blocks only
  (16 bytes)
* 'CBC' - needs IV, does not generate / verify tag, operates on blocks only
  (16 bytes)
* 'CTR' needs IV, does not generate / verify tag, operates on byte sequences of any
  size.
* 'GCM' needs IV, generates / verifies tag, operates on byte sequences of any
  size.

For both 'ECB' and 'CBC' modes we deliberately disable padding.

Added tho new unit tests:
* 'crypto_rnd_test.cpp' (BOOST_TEST_MODULE CryptoRndTests)
* 'cipher_context_test.cpp' (BOOST_TEST_MODULE CipherContextTests)
@percona-ysorokin
percona-ysorokin merged commit 997b468 into Percona-Lab:0.4 Aug 5, 2026
8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant