secure_db_fields 0.1.1

data/lib/secure_db_fields/crypto.rb

@@ -0,0 +1,115 @@
+# frozen_string_literal: true
+
+module SecureDBFields
+  module Crypto
+    module_function
+
+    ENVELOPE_MAGIC = "MCEN".b
+    KEY_BYTES = 32
+    BIDX_BYTES = 32
+
+    def encrypt(value, key:, aad:, key_id: 1)
+      raise ArgumentError, "value must not be nil" if value.nil?
+      Native.encrypt(value.to_s, assert_key!(key), aad.to_s, Integer(key_id))
+    end
+
+    def decrypt(envelope, key:, aad:)
+      raise ArgumentError, "envelope must not be nil" if envelope.nil?
+      Native.decrypt(envelope.to_s, assert_key!(key), aad.to_s)
+    end
+
+    def key_id(envelope)
+      Native.key_id(envelope.to_s)
+    end
+
+    def valid_envelope?(envelope)
+      return false if envelope.nil?
+      Native.valid_envelope?(envelope.to_s)
+    end
+
+    def blind_index(value, key:)
+      raise ArgumentError, "value must not be nil" if value.nil?
+      Native.blind_index(value.to_s, assert_key!(key))
+    end
+
+    def phone_blind_index(e164, key:)
+      Native.phone_blind_index(e164.to_s, assert_key!(key))
+    end
+
+    def phone_prefix_blind_index(e164, prefix_digits:, key:)
+      Native.phone_prefix_blind_index(e164.to_s, Integer(prefix_digits), assert_key!(key))
+    end
+
+    def encrypt_raw(value, key, aad, key_id = 1)
+      Native.encrypt(value, key, aad, key_id)
+    end
+
+    def decrypt_raw(envelope, key, aad)
+      Native.decrypt(envelope, key, aad)
+    end
+
+    def blind_index_raw(value, key)
+      Native.blind_index(value, key)
+    end
+
+    def phone_blind_index_raw(e164, key)
+      Native.phone_blind_index(e164, key)
+    end
+
+    def phone_prefix_blind_index_raw(e164, prefix_digits, key)
+      Native.phone_prefix_blind_index(e164, prefix_digits, key)
+    end
+
+    def encrypt_many(values, key:, aads:, key_id: 1)
+      Native.encrypt_many(values, assert_key!(key), aads, Integer(key_id))
+    end
+
+    def decrypt_many(envelopes, key:, aads:)
+      Native.decrypt_many(envelopes, assert_key!(key), aads)
+    end
+
+    def blind_index_many(values, key:)
+      Native.blind_index_many(values, assert_key!(key))
+    end
+
+    def blind_index_many_packed(values, key:)
+      Native.blind_index_many_packed(values, assert_key!(key))
+    end
+
+    def phone_blind_index_many(e164_values, key:)
+      Native.phone_blind_index_many(e164_values, assert_key!(key))
+    end
+
+    def phone_blind_index_many_packed(e164_values, key:)
+      Native.phone_blind_index_many_packed(e164_values, assert_key!(key))
+    end
+
+    def phone_prefix_blind_index_many(e164_values, prefix_digits:, key:)
+      Native.phone_prefix_blind_index_many(e164_values, Integer(prefix_digits), assert_key!(key))
+    end
+
+    def phone_prefix_blind_index_many_packed(e164_values, prefix_digits:, key:)
+      Native.phone_prefix_blind_index_many_packed(e164_values, Integer(prefix_digits), assert_key!(key))
+    end
+
+    def hex_decode_key(hex)
+      Native.hex_decode_key(hex.to_s)
+    end
+
+    def assert_key!(key)
+      key = key.to_s
+      raise KeyError, "key must be exactly #{KEY_BYTES} bytes" unless key.bytesize == KEY_BYTES
+      key
+    end
+
+    def aad(table, column, secure_row_uid)
+      uid = secure_row_uid.to_s
+      raise ArgumentError, "secure_row_uid must be 16 bytes" unless uid.bytesize == 16
+      table = table.to_s.b
+      column = column.to_s.b
+      raise ArgumentError, "table name is too long" if table.bytesize > 0xffffffff
+      raise ArgumentError, "column name is too long" if column.bytesize > 0xffffffff
+      "SDF1".b + [table.bytesize].pack("N") + table + [column.bytesize].pack("N") + column + uid.b
+    end
+  end
+end

data/lib/secure_db_fields/db_deployment.rb

@@ -0,0 +1,285 @@
+# frozen_string_literal: true
+
+require "digest"
+require "fileutils"
+require "optparse"
+require "rubygems/package"
+require "securerandom"
+require "stringio"
+require "tmpdir"
+require "zlib"
+require_relative "version"
+
+module SecureDBFields
+  module DBDeployment
+    ROOT = File.expand_path("../..", __dir__)
+    BUNDLE_FORMAT_VERSION = 1
+    MYSQL_TARGET = "mysql"
+
+    class Error < StandardError; end
+
+    class CLI
+      def self.run(argv)
+        new.run(argv)
+      end
+
+      def run(argv)
+        command = argv.shift
+        case command
+        when "package"
+          PackageCommand.new.run(argv)
+        when "view"
+          ViewCommand.new.run(argv)
+        when "help", "--help", "-h", nil
+          puts help
+          0
+        else
+          raise OptionParser::InvalidOption, "unknown db command: #{command.inspect}"
+        end
+      rescue OptionParser::ParseError, Error => e
+        warn "secure_db_fields db: #{e.message}"
+        2
+      rescue SystemCallError, IOError => e
+        warn "secure_db_fields db: #{e.message}"
+        1
+      end
+
+      private
+
+      def help
+        <<~TEXT
+          Usage:
+            secure_db_fields db package mysql [--output PATH] [--force]
+
+            secure_db_fields db view mysql --table DB.TABLE --field NAME:ENC_COLUMN \\
+              --uid-column secure_row_uid --view DB.VIEW --columns ID,CREATED_AT \\
+              [--as NAME] [--output PATH]
+
+          `package` creates a self-contained source bundle for the DBA. The DBA
+          extracts it on the database host and runs `make doctor`, `sudo make
+          install`, `make enable`, then `make status`.
+
+          `view` emits an admin readable view. It is for projection/display only;
+          indexed search must use physical bidx columns and helper procedures or
+          query templates.
+        TEXT
+      end
+    end
+
+    class PackageCommand
+      def run(argv)
+        target = argv.shift
+        raise OptionParser::MissingArgument, "TARGET must be mysql" if target.nil?
+        raise OptionParser::InvalidArgument, "TARGET must be mysql" unless target == MYSQL_TARGET
+
+        options = { output: nil, force: false }
+        parser = OptionParser.new do |opts|
+          opts.banner = "Usage: secure_db_fields db package mysql [OPTIONS]"
+          opts.on("-o", "--output PATH", "write the deployment archive to PATH") { |value| options[:output] = value }
+          opts.on("-f", "--force", "overwrite an existing archive") { options[:force] = true }
+          opts.on("-h", "--help", "show this help") { puts opts; return 0 }
+        end
+        parser.parse!(argv)
+        raise OptionParser::InvalidOption, argv.join(" ") unless argv.empty?
+
+        output = options[:output] || "secure_db_fields-mysql-#{SecureDBFields::VERSION}.tar.gz"
+        DeploymentBundle.new(output, force: options[:force]).write!
+        puts File.expand_path(output)
+        0
+      end
+    end
+
+    class ViewCommand
+      IDENTIFIER = /\A[A-Za-z_][A-Za-z0-9_]*\z/.freeze
+      QUALIFIED_IDENTIFIER = /\A[A-Za-z_][A-Za-z0-9_]*(?:\.[A-Za-z_][A-Za-z0-9_]*)?\z/.freeze
+
+      def run(argv)
+        target = argv.shift
+        raise OptionParser::MissingArgument, "TARGET must be mysql" if target.nil?
+        raise OptionParser::InvalidArgument, "TARGET must be mysql" unless target == MYSQL_TARGET
+
+        options = { columns: [], output: nil, as: nil, uid_column: "secure_row_uid" }
+        parser = OptionParser.new do |opts|
+          opts.banner = "Usage: secure_db_fields db view mysql --table DB.TABLE --field NAME:ENC_COLUMN --view DB.VIEW [OPTIONS]"
+          opts.on("--table NAME", "source table, optionally database-qualified") { |value| options[:table] = value }
+          opts.on("--field SPEC", "plaintext:encrypted_column, e.g. phone:phone_enc") { |value| options[:field] = value }
+          opts.on("--uid-column NAME", "row UID column for AAD (default: secure_row_uid)") { |value| options[:uid_column] = value }
+          opts.on("--view NAME", "destination view, optionally database-qualified") { |value| options[:view] = value }
+          opts.on("--columns LIST", "comma-separated plain columns to expose") { |value| options[:columns] = value.split(",").map(&:strip).reject(&:empty?) }
+          opts.on("--as NAME", "decrypted column alias (default: plaintext field name)") { |value| options[:as] = value }
+          opts.on("-o", "--output PATH", "write SQL to PATH instead of stdout") { |value| options[:output] = value }
+          opts.on("-h", "--help", "show this help") { puts opts; return 0 }
+        end
+        parser.parse!(argv)
+        raise OptionParser::InvalidOption, argv.join(" ") unless argv.empty?
+
+        sql = ReadableView.new(options).to_sql
+        if options[:output]
+          write_text_atomically(options[:output], sql)
+          puts File.expand_path(options[:output])
+        else
+          $stdout.write(sql)
+        end
+        0
+      end
+
+      private
+
+      def write_text_atomically(path, contents)
+        directory = File.dirname(File.expand_path(path))
+        FileUtils.mkdir_p(directory)
+        temporary = File.join(directory, "secure-db-fields-view-#{Process.pid}-#{SecureRandom.hex(8)}.tmp")
+        File.open(temporary, "wb", 0o644) { |file| file.write(contents) }
+        File.rename(temporary, path)
+      ensure
+        File.delete(temporary) if defined?(temporary) && File.exist?(temporary)
+      end
+    end
+
+    class ReadableView
+      IDENTIFIER = ViewCommand::IDENTIFIER
+      QUALIFIED_IDENTIFIER = ViewCommand::QUALIFIED_IDENTIFIER
+
+      def initialize(options)
+        @table = qualified_identifier!(options.fetch(:table), "--table")
+        @view = qualified_identifier!(options.fetch(:view), "--view")
+        @uid_column = identifier!(options.fetch(:uid_column), "--uid-column")
+        field = options.fetch(:field)
+        @plain_field, @encrypted_column = parse_field(field)
+        @alias = identifier!(options[:as] || @plain_field, "--as")
+        @columns = Array(options.fetch(:columns)).map { |column| identifier!(column, "--columns") }
+        @aad_table = @table.split(".").last
+      rescue KeyError => e
+        raise OptionParser::MissingArgument, e.key.to_s
+      end
+
+      def to_sql
+        select_list = (@columns.map { |column| "  `#{column}`" } + [decrypt_expression]).join(",\n")
+        <<~SQL
+          CREATE OR REPLACE ALGORITHM=MERGE VIEW #{quote_qualified(@view)} AS
+          SELECT
+          #{select_list}
+          FROM #{quote_qualified(@table)};
+        SQL
+      end
+
+      private
+
+      def decrypt_expression
+        "  secure_db_fields_decrypt_field(`#{@encrypted_column}`, '#{sql_literal(@aad_table)}', '#{sql_literal(@plain_field)}', `#{@uid_column}`) AS `#{@alias}`"
+      end
+
+      def parse_field(field)
+        unless field && field.include?(":")
+          raise OptionParser::MissingArgument, "--field plaintext:encrypted_column"
+        end
+        plain, encrypted = field.split(":", 2)
+        [identifier!(plain, "--field plaintext"), identifier!(encrypted, "--field encrypted_column")]
+      end
+
+      def identifier!(value, flag)
+        text = value.to_s
+        raise OptionParser::InvalidArgument, "#{flag} must be a SQL identifier" unless IDENTIFIER.match?(text)
+        text
+      end
+
+      def qualified_identifier!(value, flag)
+        text = value.to_s
+        raise OptionParser::InvalidArgument, "#{flag} must be a SQL identifier or DB.TABLE" unless QUALIFIED_IDENTIFIER.match?(text)
+        text
+      end
+
+      def quote_qualified(name)
+        name.split(".").map { |part| "`#{part}`" }.join(".")
+      end
+
+      def sql_literal(value)
+        value.gsub("'", "''")
+      end
+    end
+
+    class DeploymentBundle
+      BUNDLE_FILES = [
+        ["db_deployment/mysql/Makefile", "Makefile"],
+        ["db_deployment/mysql/README.md", "README.md"],
+        ["db_deployment/mysql/bin/common", "bin/common", 0o755],
+        ["db_deployment/mysql/bin/doctor", "bin/doctor", 0o755],
+        ["db_deployment/mysql/bin/install", "bin/install", 0o755],
+        ["db_deployment/mysql/bin/enable", "bin/enable", 0o755],
+        ["db_deployment/mysql/bin/disable", "bin/disable", 0o755],
+        ["db_deployment/mysql/bin/status", "bin/status", 0o755],
+        ["db_deployment/mysql/bin/verify", "bin/verify", 0o755],
+        ["db_deployment/mysql/bin/uninstall", "bin/uninstall", 0o755],
+        ["db_deployment/mysql/sql/install.sql", "sql/install.sql"],
+        ["db_deployment/mysql/sql/uninstall.sql", "sql/uninstall.sql"],
+        ["db_deployment/mysql/sql/examples.sql", "sql/examples.sql"],
+        ["mysql_udf/src/secure_db_fields_mysql.c", "src/secure_db_fields_mysql.c"],
+        ["mysql_udf/src/mysql_udf_abi_57.h", "src/mysql_udf_abi_57.h"],
+        ["ext/secure_db_fields/secure_db_fields_core.c", "src/secure_db_fields_core.c"],
+        ["ext/secure_db_fields/secure_db_fields_core.h", "src/secure_db_fields_core.h"]
+      ].freeze
+
+      attr_reader :output
+
+      def initialize(output, force: false)
+        @output = output
+        @force = force
+      end
+
+      def write!
+        path = File.expand_path(output)
+        raise Error, "#{path} already exists (use --force)" if File.exist?(path) && !@force
+
+        FileUtils.mkdir_p(File.dirname(path))
+        tmp = File.join(File.dirname(path), "secure-db-fields-db-bundle-#{Process.pid}-#{SecureRandom.hex(8)}.tar.gz.tmp")
+        Zlib::GzipWriter.open(tmp) do |gz|
+          Gem::Package::TarWriter.new(gz) do |tar|
+            BUNDLE_FILES.each do |src, dst, mode|
+              add_file(tar, src, dst, mode || 0o644)
+            end
+            add_text(tar, "VERSION", SecureDBFields::VERSION + "\n")
+            add_text(tar, "BUNDLE_FORMAT", BUNDLE_FORMAT_VERSION.to_s + "\n")
+            add_text(tar, "SHA256SUMS", checksums)
+          end
+        end
+        File.rename(tmp, path)
+      ensure
+        File.delete(tmp) if defined?(tmp) && File.exist?(tmp)
+      end
+
+      def bundle_name
+        "secure_db_fields-mysql-#{SecureDBFields::VERSION}"
+      end
+
+      private
+
+      def add_file(tar, src, dst, mode)
+        full = File.join(ROOT, src)
+        raise Error, "missing bundle source: #{src}" unless File.file?(full)
+        data = File.binread(full)
+        add_bytes(tar, File.join(bundle_name, dst), data, mode)
+      end
+
+      def add_text(tar, dst, data)
+        add_bytes(tar, File.join(bundle_name, dst), data, 0o644)
+      end
+
+      def add_bytes(tar, name, data, mode)
+        entry = StringIO.new(data)
+        tar.add_file_simple(name, mode, data.bytesize) { |io| IO.copy_stream(entry, io) }
+      end
+
+      def checksums
+        entries = BUNDLE_FILES.map do |src, dst, _mode|
+          [dst, File.binread(File.join(ROOT, src))]
+        end
+        entries << ["VERSION", SecureDBFields::VERSION + "\n"]
+        entries << ["BUNDLE_FORMAT", BUNDLE_FORMAT_VERSION.to_s + "\n"]
+
+        entries.sort_by(&:first).map do |dst, data|
+          "#{Digest::SHA256.hexdigest(data)}  #{dst}"
+        end.join("\n") + "\n"
+      end
+    end
+  end
+end

data/lib/secure_db_fields/keys.rb

@@ -0,0 +1,69 @@
+# frozen_string_literal: true
+
+module SecureDBFields
+  class Keyring
+    DEFAULT_PATH = "/etc/secure_db_fields/keys.env"
+
+    attr_reader :path
+
+    def initialize(path = ENV.fetch("SECURE_DB_FIELDS_KEY_FILE", DEFAULT_PATH))
+      @path = path
+      @values = parse_file(path)
+    end
+
+    def encryption_key(key_id = 1)
+      fetch_hex_key("SDF_ENC_KEY_#{Integer(key_id)}_HEX") ||
+        (Integer(key_id) == 1 ? fetch_hex_key("SDF_ENC_KEY_HEX") : nil) ||
+        raise(KeyError, "missing encryption key for key_id=#{key_id}")
+    end
+
+    def blind_index_key(domain = nil)
+      if domain && !domain.to_s.empty?
+        name = "SDF_BIDX_#{normalize_domain(domain)}_KEY_HEX"
+        fetch_hex_key(name) || raise(KeyError, "missing blind-index key #{name}")
+      else
+        fetch_hex_key("SDF_BIDX_KEY_HEX") || raise(KeyError, "missing SDF_BIDX_KEY_HEX")
+      end
+    end
+
+    def active_key_id
+      value = @values["SDF_ACTIVE_KEY_ID"]
+      value ? Integer(value) : 1
+    end
+
+    private
+
+    def normalize_domain(domain)
+      domain.to_s.upcase.gsub(/[^A-Z0-9_]/, "_")
+    end
+
+    def fetch_hex_key(name)
+      @values[name]
+    end
+
+    def parse_file(path)
+      validate_file_permissions!(path)
+      values = {}
+      File.readlines(path, chomp: true).each do |line|
+        stripped = line.strip
+        next if stripped.empty? || stripped.start_with?("#")
+        key, value = stripped.split("=", 2)
+        next unless key && value
+        name = key.strip
+        text = value.strip
+        values[name] = name.end_with?("_HEX") ? Crypto.hex_decode_key(text) : text
+      end
+      values.freeze
+    rescue Errno::ENOENT
+      raise KeyError, "key file not found: #{path}"
+    end
+
+    def validate_file_permissions!(path)
+      info = File.lstat(path)
+      raise KeyError, "key file must not be a symlink: #{path}" if info.symlink?
+      stat = File.stat(path)
+      raise KeyError, "key file must be a regular file: #{path}" unless stat.file?
+      raise KeyError, "key file permissions are too open: #{path}" unless (stat.mode & 0o027).zero?
+    end
+  end
+end

data/lib/secure_db_fields/phone.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+module SecureDBFields
+  module Phone
+    module_function
+
+    def canonical_e164?(value)
+      Native.e164?(value.to_s)
+    end
+
+    def assert_canonical_e164!(value)
+      str = value.to_s
+      raise ArgumentError, "phone must be canonical E.164, e.g. +77771234567" unless canonical_e164?(str)
+      str
+    end
+  end
+end

data/lib/secure_db_fields/version.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+module SecureDBFields
+  VERSION = "0.1.1"
+end

data/lib/secure_db_fields.rb

@@ -0,0 +1,8 @@
+# frozen_string_literal: true
+
+require_relative "secure_db_fields/version"
+require_relative "secure_db_fields/secure_db_fields"
+require_relative "secure_db_fields/crypto"
+require_relative "secure_db_fields/keys"
+require_relative "secure_db_fields/phone"
+require_relative "secure_db_fields/active_record"

data/mysql_udf/Makefile

@@ -0,0 +1,25 @@
+CC ?= cc
+CFLAGS ?= -O2 -fPIC -Wall -Wextra -Wformat -Wformat-security -fstack-protector-strong -D_FORTIFY_SOURCE=2 -std=c99
+LDFLAGS ?= -shared
+LIBS ?= -lcrypto
+MYSQL_CFLAGS ?= $(shell mysql_config --cflags 2>/dev/null)
+MYSQL_LIBDIR ?= $(shell mysql_config --plugindir 2>/dev/null)
+
+SRC = src/secure_db_fields_mysql.c ../ext/secure_db_fields/secure_db_fields_core.c
+OUT = secure_db_fields_mysql.so
+
+all: $(OUT)
+
+$(OUT): $(SRC)
+	$(CC) $(CFLAGS) $(MYSQL_CFLAGS) -I../ext/secure_db_fields -Isrc $(LDFLAGS) -o $@ $(SRC) $(LIBS)
+
+abi57:
+	$(CC) $(CFLAGS) -DSDF_MYSQL_UDF_ABI_57 -I../ext/secure_db_fields -Isrc $(LDFLAGS) -o $(OUT) $(SRC) $(LIBS)
+
+install: $(OUT)
+	@if [ -z "$(MYSQL_LIBDIR)" ]; then echo "mysql_config --plugindir failed"; exit 1; fi
+	install -m 0755 $(OUT) $(MYSQL_LIBDIR)/$(OUT)
+
+clean:
+	rm -f $(OUT) *.o
+.PHONY: all abi57 install clean

data/mysql_udf/README.md

@@ -0,0 +1,51 @@
+# secure_db_fields MySQL UDF
+
+This UDF is the DB-side reader/search-token helper for MySQL 5.7. It is intentionally
+narrow: decrypt for admin projections and compute blind-index tokens for declared
+search modes. It does not normalize phone input; pass canonical E.164 values.
+
+## Compatibility
+
+Target: MySQL 5.7. The package ships a minimal 5.7 ABI shim for build environments where `mysql_config` or MySQL headers are unavailable. Do not use MySQL 8-only functional-index designs with this UDF; bidx values must be physical columns populated by Ruby/backfill.
+
+## Build
+
+```bash
+cd mysql_udf
+make
+sudo make install
+mysql < sql/install.sql
+```
+
+If `mysql_config` is not available, build with the minimal MySQL 5.7 ABI shim:
+
+```bash
+make abi57
+sudo install -m 0755 secure_db_fields_mysql.so /path/to/mysql/plugin_dir/
+```
+
+## Keys
+
+The UDF reads keys from `/etc/secure_db_fields/keys.env` or from
+`SECURE_DB_FIELDS_KEY_FILE` when that environment variable is visible to mysqld.
+Never pass keys as SQL arguments.
+
+Example:
+
+```env
+SDF_ACTIVE_KEY_ID=1
+SDF_ENC_KEY_1_HEX=0000000000000000000000000000000000000000000000000000000000000001
+SDF_BIDX_PHONE_KEY_HEX=0000000000000000000000000000000000000000000000000000000000000002
+SDF_BIDX_PHONE_P7_KEY_HEX=0000000000000000000000000000000000000000000000000000000000000003
+```
+
+## Functions
+
+- `secure_db_fields_version()`
+- `secure_db_fields_is_valid_envelope(blob)`
+- `secure_db_fields_envelope_key_id(blob)`
+- `secure_db_fields_decrypt(blob, aad)`
+- `secure_db_fields_decrypt_field(blob, table_name, column_name, row_uid)`
+- `secure_db_fields_bidx(value, domain)`
+- `secure_phone_bidx(e164)`
+- `secure_phone_prefix_bidx(e164, prefix_digits)`

data/mysql_udf/bin/install

@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+set -euo pipefail
+cd "$(dirname "$0")/.."
+make
+plugin_dir="${MYSQL_PLUGIN_DIR:-$(mysql_config --plugindir 2>/dev/null || true)}"
+if [[ -z "${plugin_dir}" ]]; then
+  echo "Set MYSQL_PLUGIN_DIR or install mysql_config" >&2
+  exit 1
+fi
+sudo install -m 0755 secure_db_fields_mysql.so "${plugin_dir}/secure_db_fields_mysql.so"
+mysql ${MYSQL_ARGS:-} < sql/install.sql

data/mysql_udf/bin/uninstall

@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+set -euo pipefail
+cd "$(dirname "$0")/.."
+mysql ${MYSQL_ARGS:-} < sql/uninstall.sql

data/mysql_udf/bin/verify

@@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+set -euo pipefail
+mysql ${MYSQL_ARGS:-} -e "SELECT secure_db_fields_version() AS version;"

data/mysql_udf/sql/examples.sql

@@ -0,0 +1,20 @@
+ALTER TABLE clients
+  ADD COLUMN secure_row_uid BINARY(16) NULL,
+  ADD COLUMN phone_enc VARBINARY(512) NULL,
+  ADD COLUMN phone_bidx BINARY(32) NULL,
+  ADD INDEX idx_clients_phone_bidx (phone_bidx);
+
+
+CREATE OR REPLACE VIEW admin_clients_readable AS
+SELECT
+  id,
+  secure_db_fields_decrypt_field(phone_enc, 'clients', 'phone', secure_row_uid) AS phone,
+  created_at
+FROM clients;
+
+SELECT
+  id,
+  secure_db_fields_decrypt_field(phone_enc, 'clients', 'phone', secure_row_uid) AS phone,
+  created_at
+FROM clients
+WHERE phone_bidx = secure_phone_bidx('+77771234567');

data/mysql_udf/sql/install.sql

@@ -0,0 +1,20 @@
+
+DROP FUNCTION IF EXISTS secure_db_fields_version;
+DROP FUNCTION IF EXISTS secure_db_fields_is_valid_envelope;
+DROP FUNCTION IF EXISTS secure_db_fields_envelope_key_id;
+DROP FUNCTION IF EXISTS secure_db_fields_decrypt;
+DROP FUNCTION IF EXISTS secure_db_fields_decrypt_field;
+DROP FUNCTION IF EXISTS secure_db_fields_bidx;
+DROP FUNCTION IF EXISTS secure_phone_bidx;
+DROP FUNCTION IF EXISTS secure_phone_prefix_bidx;
+
+CREATE FUNCTION secure_db_fields_version RETURNS STRING SONAME 'secure_db_fields_mysql.so';
+CREATE FUNCTION secure_db_fields_is_valid_envelope RETURNS INTEGER SONAME 'secure_db_fields_mysql.so';
+CREATE FUNCTION secure_db_fields_envelope_key_id RETURNS INTEGER SONAME 'secure_db_fields_mysql.so';
+CREATE FUNCTION secure_db_fields_decrypt RETURNS STRING SONAME 'secure_db_fields_mysql.so';
+CREATE FUNCTION secure_db_fields_decrypt_field RETURNS STRING SONAME 'secure_db_fields_mysql.so';
+CREATE FUNCTION secure_db_fields_bidx RETURNS STRING SONAME 'secure_db_fields_mysql.so';
+CREATE FUNCTION secure_phone_bidx RETURNS STRING SONAME 'secure_db_fields_mysql.so';
+CREATE FUNCTION secure_phone_prefix_bidx RETURNS STRING SONAME 'secure_db_fields_mysql.so';
+
+SELECT secure_db_fields_version();

data/mysql_udf/sql/uninstall.sql

@@ -0,0 +1,8 @@
+DROP FUNCTION IF EXISTS secure_phone_prefix_bidx;
+DROP FUNCTION IF EXISTS secure_phone_bidx;
+DROP FUNCTION IF EXISTS secure_db_fields_bidx;
+DROP FUNCTION IF EXISTS secure_db_fields_decrypt_field;
+DROP FUNCTION IF EXISTS secure_db_fields_decrypt;
+DROP FUNCTION IF EXISTS secure_db_fields_envelope_key_id;
+DROP FUNCTION IF EXISTS secure_db_fields_is_valid_envelope;
+DROP FUNCTION IF EXISTS secure_db_fields_version;