ClickHouse Data Encryption (Configuration for Transport and Storage Encryption)

What is Data Encryption?

Data encryption refers to encrypting data during transmission or storage to prevent unauthorized access or modification of the data.

Data Encryption in clickhouse

clickhouse supports two types of data encryption: transmission encryption and storage encryption.

Transmission Encryption

Transmission encryption refers to encrypting data during the process from source to destination. clickhouse supports using the AES-128-CBC encryption algorithm for transmission encryption, requiring the specification of key_id to use an existing encryption key.

CREATE TABLE test (
    id Int64,
    name String
) ENGINE = LogFormat
DEFAULT CHARSET=utf8;

ALTER TABLE test ADD COLUMN data Varbinary(32);

INSERT INTO test (data) VALUES (unhex('...')); // unhex() converts hexadecimal string to binary string

-- Transmission encryption
SET global clickhouse.client.key_id = 1;

Storage Encryption

Storage encryption refers to encrypting data before it is stored on the hard drive. clickhouse supports using the AES-128-CBC encryption algorithm for storage encryption, requiring the specification of key_id to use an existing encryption key.

CREATE TABLE test (
    id Int64,
    name String
) ENGINE = LogFormat
DEFAULT CHARSET=utf8;

ALTER TABLE test ADD COLUMN data Varbinary(32);

INSERT INTO test (data) VALUES (unhex('...')); // unhex() converts hexadecimal string to binary string

-- Storage encryption
SET global clickhouse.server.key_id = 1;

Using Existing Encryption Keys

You need to specify key_id on the clickhouse server side to use an existing encryption key.

SET global clickhouse.server.key_id = 1;

Security of Encryption Keys

To ensure the security of encryption keys, use strong encryption algorithms and long-term valid keys. clickhouse provides a keyring component to manage encryption keys.

CREATE KEYRING IF NOT EXISTS 'default' ENCRYPTION BY DEFAULT;

Storage of Encryption Keys

Encryption keys can be stored in a database or in files within the system. clickhouse supports using the AES-256-CBC encryption algorithm to protect the keyring.

CREATE KEYRING IF NOT EXISTS 'default' ENCRYPTION BY DEFAULT;

Notes

  • clickhouse supports multiple encryption keys and does not support a single encryption key.
  • clickhouse does not support AES-256-CBC; use AES-128-CBC instead.
  • clickhouse supports both transmission encryption and storage encryption, but does not support both encryption methods simultaneously.

references