Search code examples
mysqlreplication

Does AES_ENCRYPT cause problems with replication in Mysql?


I have a Mysql master-master replicated pair. (I keep the second one in read-only mode to avoid index conflicts.)

On my primary DB, I am getting this message in the error log:

Statement is unsafe because it uses a system function that may return a different value on the slave. Statement: INSERT INTO field_data (fields_id,records_id,enc_data,field_units_type_key) VALUES ('26','1753149',AES_ENCRYPT('COVID',UNHEX(SHA2('17531491796432333532720#',256))),'NULL')

Is AES_ENCRYPT or SHA2 somehow time dependent? Why wouldn't this insert on the replicated server save the exact same data?


Solution

  • This is the documented behaviour for AES_ENCRYPT since MySQL 5.6.17:

    As of MySQL 5.6.17, statements that use AES_ENCRYPT() or AES_DECRYPT() are unsafe for statement-based replication and cannot be stored in the query cache.

    This is not because of a time-dependency, but because the behaviour depends on the newly introduced system variable block_encryption_mode:

    This variable controls the block encryption mode for block-based algorithms such as AES. It affects encryption for AES_ENCRYPT() and AES_DECRYPT().

    If that setting differs on your servers, your query will insert different data. If it doesn't differ, you are fine though. But since that is your responsibility, you get the warning that the (statement-based) replication cannot ensure it.