Golang driver

Background information

The column encryption feature allows you to encrypt specific columns in a database, thereby improving data security. Encrypted data is stored in ciphertext in databases. However, you can use an authorized client to decrypt ciphertext data and view plaintext data.

Alibaba Cloud provides the always-confidential client driver alibabacloud-encdb-mysql-go-client for the Go programming language. You need to only use the driver to connect to the database on the client side and specify the master encryption key (MEK) in the database connection URL to access the encrypted database. The driver automatically decrypts ciphertext data and returns plaintext data.

The MEK that you specify is transmitted from the client to the server by using a secure asymmetric encryption protocol. In this case, the client and the server use the same key, and the data can be transmitted between the client and the server by using symmetric encryption in a secure manner.

The value of the MEK is a 16-byte hexadecimal string that is 32 characters in length.

Prerequisites

• The column encryption feature is enabled for the required database, and the ciphertext permission (JDBC decryption) is granted to the database account. For more information, see Column encryption.

• The connection information about the encrypted database is obtained, including the endpoint, port number, database name, and database account.

• An MEK represented by a 32-bit hexadecimal string is generated. Example: 00112233445566778899aabbccddeeff.

  You can use a password generator or a random() function that is provided by a programming language to generate an MEK.

  Examples:

  • Linux: OpenSSL is pre-installed. You can run the openssl rand -hex 16 command to generate a key.

  • Windows: You must install the OpenSSL package.

Usage notes

• You must store the MEK and keep it confidential.

• The Go version must be 1.18 or later.

Procedure

go get github.com/aliyun/alibabacloud-encdb-mysql-go-client@latest

// Update the connection information such as the endpoint (hostname), port number (port), instance name (dbname), username (username), and password (password) based on the actual scenario. 
db, err := sql.Open("encmysql", "<username>:<password>@tcp(<hostname>:<port>)/<dbname>?MEK=00112233445566778899aabbccddeeff")
if err != nil {
    panic(err)
}

// Initiate a query.	
rows, err := db.Query("SELECT * FROM sddp_test_mask")
if err != nil {
    log.Fatalf("Failed to query data: %v", err)
}
// Make sure that the query result set is closed after it is used.
defer rows.Close() 

// Define variables to store data for each row.
var id int
var name string
var password string
var age int

// Traverse each row.
for rows.Next() {
    // Extract data from the current row and assign the data to the specified variables.
    err := rows.Scan(&id, &name, &password, &age)
    if err != nil {
        log.Fatalf("Failed to scan row: %v", err)
    }

    // Display the data of the current row.
    fmt.Printf("read data: id=%d, name=%s, password=%s, age=%d\n", id, name, password, age)
}

Complete sample code

For example, you use a database account that has the ciphertext permission (JDBC decryption) to view the plaintext data of the encrypted columns in a PolarDB for MySQL database.

For more information about the database configurations in the following sample code, see Column encryption in a PolarDB for MySQL database in the Verify column encryption results section.

package main

import (
    "database/sql"
    "fmt"
    "log"

    _ "github.com/aliyun/alibabacloud-encdb-mysql-go-client"
)

func main() {
    // Update the connection information such as the endpoint (hostname), port number (port), instance name (dbname), username (username), and password (password) based on the actual scenario.

    db, err := sql.Open("encmysql", "sddp_02:He******4@tcp(polar***.rwlb.rds.aliyuncs.com:3306)/sddp_test?MEK=00112233445566778899aabbccddeeff")
    if err != nil {
        panic(err)
    }

    rows, err := db.Query("SELECT * FROM user3 LIMIT 3")
    if err != nil {
        log.Fatalf("Failed to query data: %v", err)
    }
	
    // Make sure that the query result set is closed after it is used.
    defer rows.Close() 

    // Define variables to store data for each row.
    var id int
    var name string
    var password string
    var age int

    // Traverse each row.
    for rows.Next() {
        // Extract data from the current row and assign the data to the specified variables.
        err := rows.Scan(&id, &name, &password, &age)
        if err != nil {
            log.Fatalf("Failed to scan row: %v", err)
        }

        // Display the data of the current row.
        fmt.Printf("read data: id=%d, name=%s, password=%s, age=%d\n", id, name, password, age)
    }
}

After the preceding code is called, the decrypted result similar to the following information is returned.