mariadb-encryption-functions

Pass an explicit IV and mode as the third and fourth arguments, for example AES_ENCRYPT(str, key, iv, 'aes-256-cbc'), available since MariaDB 11.2. Generate the IV with RANDOM_BYTES(16); without these arguments the function uses the block_encryption_mode variable, which defaults to deterministic aes-128-ecb.

Use SHA2() for one-way hashing or KDF() for a slow, brute-force-resistant key derivation. MD5() and SHA1() are checksums with known vulnerabilities, and PASSWORD() is meant only for server authentication strings in SET PASSWORD or CREATE USER statements.

AES_DECRYPT returns NULL only when it detects invalid data or incorrect padding. With a wrong key or a cipher mode mismatch, such as encrypting with CBC and decrypting with ECB, it can return a non-NULL garbage string silently.

DES_ENCRYPT and DES_DECRYPT were removed in MariaDB 13.0 along with the --des-key-file option, so migrate to AES_ENCRYPT and AES_DECRYPT. ENCODE and DECODE were not removed but are documented as not cryptographically secure.

SHA2 returns NULL for an invalid hash_len (must be 224, 256, 384, 512, or 0), a NULL input, or when the server was built without TLS/SSL support, since it relies on the SSL library's SHA implementation unlike MD5 and SHA1.

Store AES_ENCRYPT, COMPRESS, RANDOM_BYTES, and KDF output in VARBINARY or BLOB columns because all four return binary strings. Using CHAR, VARCHAR, or TEXT mangles the result through charset conversion and trailing-space trimming.