# How does mysql keyring\_file fetch keys from the given list of user keys?

**URL:** <https://forums.percona.com/t/how-does-mysql-keyring-file-fetch-keys-from-the-given-list-of-user-keys/10594>\
**Category:** Other MySQL® Questions\
**Tags:** mysql\
**Created:** [May 25, 2021, 2:21pm UTC](https://forums.percona.com/t/how-does-mysql-keyring-file-fetch-keys-from-the-given-list-of-user-keys/10594 "2021-05-25T14:21:00Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![preethi\_subbu](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/preethi_subbu/32/3204_2.png) [@preethi\_subbu](https://forums.percona.com/u/preethi_subbu)\
**Post date:** [May 25, 2021, 2:21pm UTC](https://forums.percona.com/t/how-does-mysql-keyring-file-fetch-keys-from-the-given-list-of-user-keys/10594/1 "2021-05-25T14:21:00Z")

</div>

Consider root user with 2 application user having privileges to specific databases alone. If keyring keys were created for 2 application users(session users) by default keyring\_key\_generate. How do mysql internally fetch keys? is it based on logged-in users or mysql have the association somewhere?

So root user can decrypt all users data ?

Command used to create key

```auto
SELECT keyring_key_generate('MyKey', 'DSA', 256);

```

Basically how to assign a key for a user in mysql keyring\_file plugin

---

<div class="post-metadata">

**Author:** ![vadimtk](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/vadimtk/32/9528_2.png) [@vadimtk](https://forums.percona.com/u/vadimtk)\
**Post date:** [May 26, 2021, 12:12pm UTC](https://forums.percona.com/t/how-does-mysql-keyring-file-fetch-keys-from-the-given-list-of-user-keys/10594/2 "2021-05-26T12:12:21Z")

</div>

I’ve never used it before, but documentation says  
" A key stored in the keyring by a given user can be manipulated later only by the same user. That is, the value of the [`CURRENT_USER()`](https://docs.oracle.com/cd/E17952_01/mysql-8.0-en/information-functions.html#function_current-user) function at the time of key manipulation must have the same value as when the key was stored in the keyring. (This constraint rules out the use of the keyring functions for manipulation of instance-wide keys, such as those created by `InnoDB` to support tablespace encryption.)"

Link:  
[https://docs.oracle.com/cd/E17952\_01/mysql-8.0-en/keyring-functions-general-purpose.html](https://docs.oracle.com/cd/E17952_01/mysql-8.0-en/keyring-functions-general-purpose.html)