Data encryption at rest and in flight
Encryption is the process of encoding plain text into an alternative unreadable format known as ciphertext. Decryption is the process of decoding the ciphertext back into its original plain text readable format. It is important to encrypt stored data, as well as the data that's being transferred between the client and nodes. In this section, we will learn how to achieve this.
Encryption at rest
Data at rest indicates the data that is stored on a physical storage system, such as a disk. Encryption at rest is an Enterprise-only feature. This feature allows you to encrypt all the files on the physical storage using Advanced Encryption Standard (AES).
Two types of keys are involved:
- Store keys: These are provided by the user and are used to encrypt data keys.
- Data keys: These are generated by CockroachDB and are used to encrypt all the files on disk. They are persisted in a registry file and are encrypted using the store...
