MariaDB and File Key Management Encryption Plugin

Question

I am trying to work with MariaDB and the file key management encryption plugin. From the documentation at https://mariadb.com/kb/en/file-key-management-encryption-plugin/ it seems like the key file and the encryption key(for the key file) are stored locally on the PC. This is not working in my case since this is seen as a security risk. The system is quite limited (local PC with Win10 not connected to the internet). Having the keys on an USB stick is not an option. The keys have to be hidden to any user(including admins) so restricting the rights also is not an option. From what I've seen the only solution that I came up with is to create the key files, start the MariaDB server, and delete them. Is there a way to get the key information from in memory files? In case that this is not possible is the hashicorp plugin a good alternative to secure the encryption keys (kind of hard to find good documentation for it)

Thank you

Answer 1

Without a framework like SGX key information is available in memory. While SGX solutions exist like EdgelessDB or enclaive. SGX is unlikely to be available on a ordinary PC as its server grade Intel chips only.

Hashicorp is a network based encryption keystore.

As a stand alone solution maybe Windows built-in BitLocker is a decent disk based encryption technique that can be used and MariaDB can run on this.