encryption key management plugin api

50 files changed, 696 insertions, 344 deletions

diff --git a/cmake/abi_check.cmake b/cmake/abi_check.cmake
index b6e630eeb37..aff6c437c3b 100644
--- a/cmake/abi_check.cmake
+++ b/cmake/abi_check.cmake
@@ -44,6 +44,7 @@ IF(CMAKE_COMPILER_IS_GNUCC AND RUN_ABI_CHECK)
     ${CMAKE_SOURCE_DIR}/include/mysql/client_plugin.h
     ${CMAKE_SOURCE_DIR}/include/mysql/plugin_auth.h
     ${CMAKE_SOURCE_DIR}/include/mysql/plugin_password_validation.h
+    ${CMAKE_SOURCE_DIR}/include/mysql/plugin_encryption_key_management.h
   )
 
   ADD_CUSTOM_TARGET(abi_check ALL
diff --git a/include/my_crypt_key_management.h b/include/my_crypt_key_management.h
index 3da0ab2b90e..1d144ced55c 100644
--- a/include/my_crypt_key_management.h
+++ b/include/my_crypt_key_management.h
@@ -1,6 +1,6 @@
 
-#ifndef MYSYS_MY_CRYPT_KEY_MANAGMENT_H_
-#define MYSYS_MY_CRYPT_KEY_MANAGMENT_H_
+#ifndef INCLUDE_MY_CRYPT_KEY_MANAGMENT_INCLUDED
+#define INCLUDE_MY_CRYPT_KEY_MANAGMENT_INCLUDED
 
 #include "my_global.h"
 #include "my_pthread.h"
@@ -18,63 +18,17 @@ extern uint opt_debug_encryption_key_version;
 #endif /* DBUG_OFF */
 
 C_MODE_START
-/**
- * function returning latest key version
- */
-typedef int (* GetLatestCryptoKeyVersionFunc_t)();
-
-/**
- * function returning if the key exists
- */
-typedef unsigned int (* HasKeyVersionFunc_t)(unsigned int version);
-
-/**
- * function returning the key size
- */
-typedef int (* GetKeySizeFunc_t)(unsigned int version);
-
-/**
- * function returning a key for a key version
- */
-typedef int (* GetCryptoKeyFunc_t)(unsigned int version,
-                                   unsigned char* key,
-                                   unsigned keybufsize);
-
-/**
- * function returning an iv for a key version
- */
-typedef int (* GetCryptoIVFunc_t)(unsigned int version,
-                                   unsigned char* iv,
-                                   unsigned ivbufsize);
-
-
-struct CryptoKeyFuncs_t
-{
-  GetLatestCryptoKeyVersionFunc_t getLatestCryptoKeyVersionFunc;
-  HasKeyVersionFunc_t hasCryptoKeyFunc;
-  GetKeySizeFunc_t getCryptoKeySize;
-  GetCryptoKeyFunc_t getCryptoKeyFunc;
-  GetCryptoIVFunc_t getCryptoIVFunc;
-};
-
-/**
- * Install functions to use for key management
- */
-void
-InstallCryptoKeyFunctions(const struct CryptoKeyFuncs_t* cryptoKeyFuncs);
 
 /**
  * Functions to interact with key management
  */
 
-int GetLatestCryptoKeyVersion();
-unsigned int HasCryptoKey(unsigned int version);
-int GetCryptoKeySize(unsigned int version);
-int GetCryptoKey(unsigned int version, unsigned char* key_buffer,
-                 unsigned int size);
-int GetCryptoIV(unsigned int version, unsigned char* key_buffer,
-                unsigned int size);
+uint get_latest_encryption_key_version();
+uint has_encryption_key(uint version);
+uint get_encryption_key_size(uint version);
+int get_encryption_key(uint version, uchar* key, uint size);
+int get_encryption_iv(uint version, uchar* iv, uint size);
 
 C_MODE_END
 
-#endif // MYSYS_MY_CRYPT_KEY_MANAGMENT_H_
+#endif // INCLUDE_MY_CRYPT_KEY_MANAGMENT_INCLUDED
diff --git a/include/mysql/plugin.h b/include/mysql/plugin.h
index df74be0209d..4a27527b565 100644
--- a/include/mysql/plugin.h
+++ b/include/mysql/plugin.h
@@ -88,11 +88,11 @@ typedef struct st_mysql_xid MYSQL_XID;
 #define MYSQL_AUDIT_PLUGIN           5
 #define MYSQL_REPLICATION_PLUGIN     6
 #define MYSQL_AUTHENTICATION_PLUGIN  7
-#define MYSQL_KEY_MANAGEMENT_PLUGIN  9
 #define MYSQL_MAX_PLUGIN_TYPE_NUM    10  /* The number of plugin types   */
 
 /* MariaDB plugin types */
-#define MariaDB_PASSWORD_VALIDATION_PLUGIN 8
+#define MariaDB_PASSWORD_VALIDATION_PLUGIN  8
+#define MariaDB_ENCRYPTION_KEY_MANAGEMENT_PLUGIN 9
 
 /* We use the following strings to define licenses for plugins */
 #define PLUGIN_LICENSE_PROPRIETARY 0
diff --git a/include/mysql/plugin_encryption_key_management.h b/include/mysql/plugin_encryption_key_management.h
new file mode 100644
index 00000000000..1ba4659196f
--- /dev/null
+++ b/include/mysql/plugin_encryption_key_management.h
@@ -0,0 +1,73 @@
+#ifndef MYSQL_PLUGIN_ENCRYPTION_KEY_MANAGEMENT_INCLUDED
+/* Copyright (C) 2014 Sergei Golubchik and MariaDB
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; version 2 of the License.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program; if not, write to the Free Software
+   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301  USA */
+
+/**
+  @file
+
+  Encryption key Management Plugin API.
+
+  This file defines the API for server plugins that manage encryption
+  keys for MariaDB on-disk data encryption.
+*/
+
+#define MYSQL_PLUGIN_ENCRYPTION_KEY_MANAGEMENT_INCLUDED
+
+#include <mysql/plugin.h>
+
+#define MariaDB_ENCRYPTION_KEY_MANAGEMENT_INTERFACE_VERSION 0x0100
+
+#define BAD_ENCRYPTION_KEY_VERSION (~0U)
+
+/**
+  Encryption key management plugin descriptor
+*/
+struct st_mariadb_encryption_key_management
+{
+  int interface_version;                        /**< version plugin uses */
+
+  /**
+    function returning latest key version.
+
+    @return a version or BAD_ENCRYPTION_KEY_VERSION to indicate an error.
+  */
+  unsigned int (*get_latest_key_version)();
+
+  /** function returning if a key of the given version exists */
+  unsigned int (*has_key_version)(unsigned int version);
+
+  /** function returning the key size in bytes */
+  unsigned int (*get_key_size)(unsigned int version);
+
+  /**
+    function returning a key for a key version
+
+    the key is put in 'key' buffer, that has size of 'keybufsize' bytes.
+
+    @return 0 on success, non-zero on failure
+  */
+  int (*get_key)(unsigned int version, unsigned char* key, unsigned int keybufsize);
+
+  /**
+    function returning an IV for a key version
+
+    the IV is put in 'iv' buffer, that has size of 'ivbufsize' bytes.
+
+    @return 0 on success, non-zero on failure
+  */
+  int (*get_iv)(unsigned int version, unsigned char* iv, unsigned int ivbufsize);
+};
+#endif
+
diff --git a/include/mysql/plugin_encryption_key_management.h.pp b/include/mysql/plugin_encryption_key_management.h.pp
new file mode 100644
index 00000000000..07f238d6c0d
--- /dev/null
+++ b/include/mysql/plugin_encryption_key_management.h.pp
@@ -0,0 +1,364 @@
+#include <mysql/plugin.h>
+typedef char my_bool;
+typedef void * MYSQL_PLUGIN;
+#include <mysql/services.h>
+#include <mysql/service_my_snprintf.h>
+extern struct my_snprintf_service_st {
+  size_t (*my_snprintf_type)(char*, size_t, const char*, ...);
+  size_t (*my_vsnprintf_type)(char *, size_t, const char*, va_list);
+} *my_snprintf_service;
+size_t my_snprintf(char* to, size_t n, const char* fmt, ...);
+size_t my_vsnprintf(char *to, size_t n, const char* fmt, va_list ap);
+#include <mysql/service_thd_alloc.h>
+struct st_mysql_lex_string
+{
+  char *str;
+  size_t length;
+};
+typedef struct st_mysql_lex_string MYSQL_LEX_STRING;
+extern struct thd_alloc_service_st {
+  void *(*thd_alloc_func)(void*, unsigned int);
+  void *(*thd_calloc_func)(void*, unsigned int);
+  char *(*thd_strdup_func)(void*, const char *);
+  char *(*thd_strmake_func)(void*, const char *, unsigned int);
+  void *(*thd_memdup_func)(void*, const void*, unsigned int);
+  MYSQL_LEX_STRING *(*thd_make_lex_string_func)(void*, MYSQL_LEX_STRING *,
+                                        const char *, unsigned int, int);
+} *thd_alloc_service;
+void *thd_alloc(void* thd, unsigned int size);
+void *thd_calloc(void* thd, unsigned int size);
+char *thd_strdup(void* thd, const char *str);
+char *thd_strmake(void* thd, const char *str, unsigned int size);
+void *thd_memdup(void* thd, const void* str, unsigned int size);
+MYSQL_LEX_STRING *thd_make_lex_string(void* thd, MYSQL_LEX_STRING *lex_str,
+                                      const char *str, unsigned int size,
+                                      int allocate_lex_string);
+#include <mysql/service_thd_wait.h>
+typedef enum _thd_wait_type_e {
+  THD_WAIT_SLEEP= 1,
+  THD_WAIT_DISKIO= 2,
+  THD_WAIT_ROW_LOCK= 3,
+  THD_WAIT_GLOBAL_LOCK= 4,
+  THD_WAIT_META_DATA_LOCK= 5,
+  THD_WAIT_TABLE_LOCK= 6,
+  THD_WAIT_USER_LOCK= 7,
+  THD_WAIT_BINLOG= 8,
+  THD_WAIT_GROUP_COMMIT= 9,
+  THD_WAIT_SYNC= 10,
+  THD_WAIT_NET= 11,
+  THD_WAIT_LAST= 12
+} thd_wait_type;
+extern struct thd_wait_service_st {
+  void (*thd_wait_begin_func)(void*, int);
+  void (*thd_wait_end_func)(void*);
+} *thd_wait_service;
+void thd_wait_begin(void* thd, int wait_type);
+void thd_wait_end(void* thd);
+#include <mysql/service_progress_report.h>
+extern struct progress_report_service_st {
+  void (*thd_progress_init_func)(void* thd, unsigned int max_stage);
+  void (*thd_progress_report_func)(void* thd,
+                                   unsigned long long progress,
+                                   unsigned long long max_progress);
+  void (*thd_progress_next_stage_func)(void* thd);
+  void (*thd_progress_end_func)(void* thd);
+  const char *(*set_thd_proc_info_func)(void*, const char *info,
+                                        const char *func,
+                                        const char *file,
+                                        unsigned int line);
+} *progress_report_service;
+void thd_progress_init(void* thd, unsigned int max_stage);
+void thd_progress_report(void* thd,
+                         unsigned long long progress,
+                         unsigned long long max_progress);
+void thd_progress_next_stage(void* thd);
+void thd_progress_end(void* thd);
+const char *set_thd_proc_info(void*, const char * info, const char *func,
+                              const char *file, unsigned int line);
+#include <mysql/service_debug_sync.h>
+extern void (*debug_sync_C_callback_ptr)(void*, const char *, size_t);
+#include <mysql/service_kill_statement.h>
+enum thd_kill_levels {
+  THD_IS_NOT_KILLED=0,
+  THD_ABORT_SOFTLY=50,
+  THD_ABORT_ASAP=100,
+};
+extern struct kill_statement_service_st {
+  enum thd_kill_levels (*thd_kill_level_func)(const void*);
+} *thd_kill_statement_service;
+enum thd_kill_levels thd_kill_level(const void*);
+#include <mysql/service_thd_timezone.h>
+#include "mysql_time.h"
+typedef long my_time_t;
+enum enum_mysql_timestamp_type
+{
+  MYSQL_TIMESTAMP_NONE= -2, MYSQL_TIMESTAMP_ERROR= -1,
+  MYSQL_TIMESTAMP_DATE= 0, MYSQL_TIMESTAMP_DATETIME= 1, MYSQL_TIMESTAMP_TIME= 2
+};
+typedef struct st_mysql_time
+{
+  unsigned int year, month, day, hour, minute, second;
+  unsigned long second_part;
+  my_bool neg;
+  enum enum_mysql_timestamp_type time_type;
+} MYSQL_TIME;
+extern struct thd_timezone_service_st {
+  my_time_t (*thd_TIME_to_gmt_sec)(void* thd, const MYSQL_TIME *ltime, unsigned int *errcode);
+  void (*thd_gmt_sec_to_TIME)(void* thd, MYSQL_TIME *ltime, my_time_t t);
+} *thd_timezone_service;
+my_time_t thd_TIME_to_gmt_sec(void* thd, const MYSQL_TIME *ltime, unsigned int *errcode);
+void thd_gmt_sec_to_TIME(void* thd, MYSQL_TIME *ltime, my_time_t t);
+#include <mysql/service_sha1.h>
+extern struct my_sha1_service_st {
+  void (*my_sha1_type)(unsigned char*, const char*, size_t);
+  void (*my_sha1_multi_type)(unsigned char*, ...);
+  size_t (*my_sha1_context_size_type)();
+  void (*my_sha1_init_type)(void *);
+  void (*my_sha1_input_type)(void *, const unsigned char *, size_t);
+  void (*my_sha1_result_type)(void *, unsigned char *);
+} *my_sha1_service;
+void my_sha1(unsigned char*, const char*, size_t);
+void my_sha1_multi(unsigned char*, ...);
+size_t my_sha1_context_size();
+void my_sha1_init(void *context);
+void my_sha1_input(void *context, const unsigned char *buf, size_t len);
+void my_sha1_result(void *context, unsigned char *digest);
+#include <mysql/service_md5.h>
+extern struct my_md5_service_st {
+  void (*my_md5_type)(unsigned char*, const char*, size_t);
+  void (*my_md5_multi_type)(unsigned char*, ...);
+  size_t (*my_md5_context_size_type)();
+  void (*my_md5_init_type)(void *);
+  void (*my_md5_input_type)(void *, const unsigned char *, size_t);
+  void (*my_md5_result_type)(void *, unsigned char *);
+} *my_md5_service;
+void my_md5(unsigned char*, const char*, size_t);
+void my_md5_multi(unsigned char*, ...);
+size_t my_md5_context_size();
+void my_md5_init(void *context);
+void my_md5_input(void *context, const unsigned char *buf, size_t len);
+void my_md5_result(void *context, unsigned char *digest);
+#include <mysql/service_logger.h>
+typedef struct logger_handle_st LOGGER_HANDLE;
+extern struct logger_service_st {
+  void (*logger_init_mutexes)();
+  LOGGER_HANDLE* (*open)(const char *path,
+                         unsigned long long size_limit,
+                         unsigned int rotations);
+  int (*close)(LOGGER_HANDLE *log);
+  int (*vprintf)(LOGGER_HANDLE *log, const char *fmt, va_list argptr);
+  int (*printf)(LOGGER_HANDLE *log, const char *fmt, ...);
+  int (*write)(LOGGER_HANDLE *log, const char *buffer, size_t size);
+  int (*rotate)(LOGGER_HANDLE *log);
+} *logger_service;
+  void logger_init_mutexes();
+  LOGGER_HANDLE *logger_open(const char *path,
+                             unsigned long long size_limit,
+                             unsigned int rotations);
+  int logger_close(LOGGER_HANDLE *log);
+  int logger_vprintf(LOGGER_HANDLE *log, const char *fmt, va_list argptr);
+  int logger_printf(LOGGER_HANDLE *log, const char *fmt, ...);
+  int logger_write(LOGGER_HANDLE *log, const char *buffer, size_t size);
+  int logger_rotate(LOGGER_HANDLE *log);
+#include <mysql/service_thd_autoinc.h>
+extern struct thd_autoinc_service_st {
+  void (*thd_get_autoinc_func)(const void* thd,
+                               unsigned long* off, unsigned long* inc);
+} *thd_autoinc_service;
+void thd_get_autoinc(const void* thd,
+                     unsigned long* off, unsigned long* inc);
+#include <mysql/service_thd_error_context.h>
+extern struct thd_error_context_service_st {
+  const char *(*thd_get_error_message_func)(const void* thd);
+  unsigned int (*thd_get_error_number_func)(const void* thd);
+  unsigned long (*thd_get_error_row_func)(const void* thd);
+  void (*thd_inc_error_row_func)(void* thd);
+  char *(*thd_get_error_context_description_func)(void* thd,
+                                                  char *buffer,
+                                                  unsigned int length,
+                                                  unsigned int max_query_length);
+} *thd_error_context_service;
+const char *thd_get_error_message(const void* thd);
+unsigned int thd_get_error_number(const void* thd);
+unsigned long thd_get_error_row(const void* thd);
+void thd_inc_error_row(void* thd);
+char *thd_get_error_context_description(void* thd,
+                                        char *buffer, unsigned int length,
+                                        unsigned int max_query_length);
+#include <mysql/service_thd_specifics.h>
+typedef int MYSQL_THD_KEY_T;
+extern struct thd_specifics_service_st {
+  int (*thd_key_create_func)(MYSQL_THD_KEY_T *key);
+  void (*thd_key_delete_func)(MYSQL_THD_KEY_T *key);
+  void *(*thd_getspecific_func)(void* thd, MYSQL_THD_KEY_T key);
+  int (*thd_setspecific_func)(void* thd, MYSQL_THD_KEY_T key, void *value);
+} *thd_specifics_service;
+int thd_key_create(MYSQL_THD_KEY_T *key);
+void thd_key_delete(MYSQL_THD_KEY_T *key);
+void* thd_getspecific(void* thd, MYSQL_THD_KEY_T key);
+int thd_setspecific(void* thd, MYSQL_THD_KEY_T key, void *value);
+struct st_mysql_xid {
+  long formatID;
+  long gtrid_length;
+  long bqual_length;
+  char data[128];
+};
+typedef struct st_mysql_xid MYSQL_XID;
+enum enum_mysql_show_type
+{
+  SHOW_UNDEF, SHOW_BOOL, SHOW_UINT, SHOW_ULONG,
+  SHOW_ULONGLONG, SHOW_CHAR, SHOW_CHAR_PTR,
+  SHOW_ARRAY, SHOW_FUNC, SHOW_DOUBLE,
+  SHOW_SINT, SHOW_SLONG, SHOW_SLONGLONG, SHOW_SIMPLE_FUNC,
+  SHOW_always_last
+};
+enum enum_var_type
+{
+  SHOW_OPT_DEFAULT= 0, SHOW_OPT_SESSION, SHOW_OPT_GLOBAL
+};
+struct st_mysql_show_var {
+  const char *name;
+  char *value;
+  enum enum_mysql_show_type type;
+};
+typedef int (*mysql_show_var_func)(void*, struct st_mysql_show_var*, char *, enum enum_var_type);
+struct st_mysql_sys_var;
+struct st_mysql_value;
+typedef int (*mysql_var_check_func)(void* thd,
+                                    struct st_mysql_sys_var *var,
+                                    void *save, struct st_mysql_value *value);
+typedef void (*mysql_var_update_func)(void* thd,
+                                      struct st_mysql_sys_var *var,
+                                      void *var_ptr, const void *save);
+struct st_mysql_plugin
+{
+  int type;
+  void *info;
+  const char *name;
+  const char *author;
+  const char *descr;
+  int license;
+  int (*init)(void *);
+  int (*deinit)(void *);
+  unsigned int version;
+  struct st_mysql_show_var *status_vars;
+  struct st_mysql_sys_var **system_vars;
+  void * __reserved1;
+  unsigned long flags;
+};
+struct st_maria_plugin
+{
+  int type;
+  void *info;
+  const char *name;
+  const char *author;
+  const char *descr;
+  int license;
+  int (*init)(void *);
+  int (*deinit)(void *);
+  unsigned int version;
+  struct st_mysql_show_var *status_vars;
+  struct st_mysql_sys_var **system_vars;
+  const char *version_info;
+  unsigned int maturity;
+};
+#include "plugin_ftparser.h"
+#include "plugin.h"
+enum enum_ftparser_mode
+{
+  MYSQL_FTPARSER_SIMPLE_MODE= 0,
+  MYSQL_FTPARSER_WITH_STOPWORDS= 1,
+  MYSQL_FTPARSER_FULL_BOOLEAN_INFO= 2
+};
+enum enum_ft_token_type
+{
+  FT_TOKEN_EOF= 0,
+  FT_TOKEN_WORD= 1,
+  FT_TOKEN_LEFT_PAREN= 2,
+  FT_TOKEN_RIGHT_PAREN= 3,
+  FT_TOKEN_STOPWORD= 4
+};
+typedef struct st_mysql_ftparser_boolean_info
+{
+  enum enum_ft_token_type type;
+  int yesno;
+  int weight_adjust;
+  char wasign;
+  char trunc;
+  char prev;
+  char *quot;
+} MYSQL_FTPARSER_BOOLEAN_INFO;
+typedef struct st_mysql_ftparser_param
+{
+  int (*mysql_parse)(struct st_mysql_ftparser_param *,
+                     const char *doc, int doc_len);
+  int (*mysql_add_word)(struct st_mysql_ftparser_param *,
+                        const char *word, int word_len,
+                        MYSQL_FTPARSER_BOOLEAN_INFO *boolean_info);
+  void *ftparser_state;
+  void *mysql_ftparam;
+  const struct charset_info_st *cs;
+  const char *doc;
+  int length;
+  unsigned int flags;
+  enum enum_ftparser_mode mode;
+} MYSQL_FTPARSER_PARAM;
+struct st_mysql_ftparser
+{
+  int interface_version;
+  int (*parse)(MYSQL_FTPARSER_PARAM *param);
+  int (*init)(MYSQL_FTPARSER_PARAM *param);
+  int (*deinit)(MYSQL_FTPARSER_PARAM *param);
+};
+struct st_mysql_daemon
+{
+  int interface_version;
+};
+struct st_mysql_information_schema
+{
+  int interface_version;
+};
+struct st_mysql_storage_engine
+{
+  int interface_version;
+};
+struct handlerton;
+ struct Mysql_replication {
+   int interface_version;
+ };
+struct st_mysql_value
+{
+  int (*value_type)(struct st_mysql_value *);
+  const char *(*val_str)(struct st_mysql_value *, char *buffer, int *length);
+  int (*val_real)(struct st_mysql_value *, double *realbuf);
+  int (*val_int)(struct st_mysql_value *, long long *intbuf);
+  int (*is_unsigned)(struct st_mysql_value *);
+};
+int thd_in_lock_tables(const void* thd);
+int thd_tablespace_op(const void* thd);
+long long thd_test_options(const void* thd, long long test_options);
+int thd_sql_command(const void* thd);
+void **thd_ha_data(const void* thd, const struct handlerton *hton);
+void thd_storage_lock_wait(void* thd, long long value);
+int thd_tx_isolation(const void* thd);
+int thd_tx_is_read_only(const void* thd);
+int thd_rpl_is_parallel(const void* thd);
+int mysql_tmpfile(const char *prefix);
+unsigned long thd_get_thread_id(const void* thd);
+void thd_get_xid(const void* thd, MYSQL_XID *xid);
+void mysql_query_cache_invalidate4(void* thd,
+                                   const char *key, unsigned int key_length,
+                                   int using_trx);
+void *thd_get_ha_data(const void* thd, const struct handlerton *hton);
+void thd_set_ha_data(void* thd, const struct handlerton *hton,
+                     const void *ha_data);
+void thd_wakeup_subsequent_commits(void* thd, int wakeup_error);
+struct st_mariadb_encryption_key_management
+{
+  int interface_version;
+  unsigned int (*get_latest_key_version)();
+  unsigned int (*has_key_version)(unsigned int version);
+  unsigned int (*get_key_size)(unsigned int version);
+  int (*get_key)(unsigned int version, unsigned char* key, unsigned int keybufsize);
+  int (*get_iv)(unsigned int version, unsigned char* iv, unsigned int ivbufsize);
+};
diff --git a/libmysqld/CMakeLists.txt b/libmysqld/CMakeLists.txt
index 3826fbbc9bf..7168c67e57e 100644
--- a/libmysqld/CMakeLists.txt
+++ b/libmysqld/CMakeLists.txt
@@ -105,7 +105,7 @@ SET(SQL_EMBEDDED_SOURCES emb_qcache.cc libmysqld.c lib_sql.cc
            ../sql/compat56.cc
            ../sql/table_cache.cc
            ../sql/item_inetfunc.cc
-           ../sql/wsrep_dummy.cc
+           ../sql/wsrep_dummy.cc ../sql/encryption_keys.cc
            ${GEN_SOURCES}
            ${MYSYS_LIBWRAP_SOURCE}
 )
diff --git a/mysql-test/include/have_example_key_management_plugin.inc b/mysql-test/include/have_example_key_management_plugin.inc
new file mode 100644
index 00000000000..622e9a5286c
--- /dev/null
+++ b/mysql-test/include/have_example_key_management_plugin.inc
@@ -0,0 +1,5 @@
+if (`select count(*) = 0 from information_schema.plugins
+     where plugin_name = 'example_key_management_plugin' and plugin_status='active'`)
+{
+  --skip Needs example_key_management_plugin
+}
diff --git a/mysql-test/include/have_example_key_management_plugin.opt b/mysql-test/include/have_example_key_management_plugin.opt
new file mode 100644
index 00000000000..581ee1c73b9
--- /dev/null
+++ b/mysql-test/include/have_example_key_management_plugin.opt
@@ -0,0 +1,2 @@
+--plugin-load-add=$EXAMPLE_KEY_MANAGEMENT_PLUGIN_SO
+--loose-example-key-management-plugin
diff --git a/mysql-test/include/have_file_key_management_plugin.inc b/mysql-test/include/have_file_key_management_plugin.inc
new file mode 100644
index 00000000000..fc682a77f35
--- /dev/null
+++ b/mysql-test/include/have_file_key_management_plugin.inc
@@ -0,0 +1,5 @@
+if (`select count(*) = 0 from information_schema.plugins
+     where plugin_name = 'file_key_management_plugin' and plugin_status='active'`)
+{
+  --skip Needs file_key_management_plugin
+}
diff --git a/mysql-test/include/have_file_key_management_plugin.opt b/mysql-test/include/have_file_key_management_plugin.opt
new file mode 100644
index 00000000000..599847be1fe
--- /dev/null
+++ b/mysql-test/include/have_file_key_management_plugin.opt
@@ -0,0 +1,4 @@
+--plugin-load-add=$FILE_KEY_MANAGEMENT_PLUGIN_SO
+--loose-file-key-management-plugin
+--loose-file-key-management-plugin-filename=$MYSQL_TEST_DIR/std_data/keys.txt
+--encryption-algorithm=aes_cbc
diff --git a/mysql-test/suite/innodb/include/keys.txt b/mysql-test/std_data/keys.txt
index 419b76f698f..419b76f698f 100644
--- a/mysql-test/suite/innodb/include/keys.txt
+++ b/mysql-test/std_data/keys.txt
diff --git a/mysql-test/suite/innodb/t/innodb-page_encryption-32k-master.opt b/mysql-test/suite/innodb/t/innodb-page_encryption-32k-master.opt
deleted file mode 100644
index 723c0b360fd..00000000000
--- a/mysql-test/suite/innodb/t/innodb-page_encryption-32k-master.opt
+++ /dev/null
@@ -1,4 +0,0 @@
---default-storage-engine=InnoDB
---encryption-algorithm=aes_cbs
---file-key-management-plugin-filename=$MYSQL_TEST_DIR/suite/innodb/include/keys.txt
---innodb-buffer-pool-size=24M
diff --git a/mysql-test/suite/innodb/t/innodb-page_encryption-32k.opt b/mysql-test/suite/innodb/t/innodb-page_encryption-32k.opt
new file mode 100644
index 00000000000..a9021f6de15
--- /dev/null
+++ b/mysql-test/suite/innodb/t/innodb-page_encryption-32k.opt
@@ -0,0 +1,2 @@
+--default_storage_engine=InnoDB
+--innodb-buffer-pool-size=24M
diff --git a/mysql-test/suite/innodb/t/innodb-page_encryption.opt b/mysql-test/suite/innodb/t/innodb-page_encryption.opt
deleted file mode 100644
index f3aa00059a8..00000000000
--- a/mysql-test/suite/innodb/t/innodb-page_encryption.opt
+++ /dev/null
@@ -1,3 +0,0 @@
---enable-file-key-management-plugin
---encryption-algorithm=aes_cbs
---file-key-management-plugin-filename=$MYSQL_TEST_DIR/suite/innodb/include/keys.txt
diff --git a/mysql-test/suite/innodb/t/innodb-page_encryption.test b/mysql-test/suite/innodb/t/innodb-page_encryption.test
index a3ba64c5d48..fbecf42daad 100644
--- a/mysql-test/suite/innodb/t/innodb-page_encryption.test
+++ b/mysql-test/suite/innodb/t/innodb-page_encryption.test
@@ -1,4 +1,5 @@
 -- source include/have_innodb.inc
+-- source include/have_file_key_management_plugin.inc
 
 --disable_query_log
 let $innodb_file_format_orig = `SELECT @@innodb_file_format`;
diff --git a/mysql-test/suite/innodb/t/innodb-page_encryption_compression.opt b/mysql-test/suite/innodb/t/innodb-page_encryption_compression.opt
deleted file mode 100644
index f3aa00059a8..00000000000
--- a/mysql-test/suite/innodb/t/innodb-page_encryption_compression.opt
+++ /dev/null
@@ -1,3 +0,0 @@
---enable-file-key-management-plugin
---encryption-algorithm=aes_cbs
---file-key-management-plugin-filename=$MYSQL_TEST_DIR/suite/innodb/include/keys.txt
diff --git a/mysql-test/suite/innodb/t/innodb-page_encryption_compression.test b/mysql-test/suite/innodb/t/innodb-page_encryption_compression.test
index c07a03a1e37..0ce70bbc803 100644
--- a/mysql-test/suite/innodb/t/innodb-page_encryption_compression.test
+++ b/mysql-test/suite/innodb/t/innodb-page_encryption_compression.test
@@ -1,4 +1,5 @@
 -- source include/have_innodb.inc
+-- source include/have_file_key_management_plugin.inc
 
 --disable_query_log
 let $innodb_compression_algorithm_orig=`SELECT @@innodb_compression_algorithm`;
diff --git a/mysql-test/suite/innodb/t/innodb_encryption.opt b/mysql-test/suite/innodb/t/innodb_encryption.opt
index e2fc72eb5a8..306e3f95660 100644
--- a/mysql-test/suite/innodb/t/innodb_encryption.opt
+++ b/mysql-test/suite/innodb/t/innodb_encryption.opt
@@ -1,8 +1,7 @@
---enable-example-key-management-plugin
---encrypt-tmp-disk-tables=ON
 --aria-encrypt-tables=ON
---innodb-encryption-threads=4
---innodb-encryption-rotate-key-age=15
+--encrypt-tmp-disk-tables=ON
 --innodb-encrypt-tables=ON
+--innodb-encryption-rotate-key-age=15
+--innodb-encryption-threads=4
 --innodb-tablespaces-encryption
 --encryption-algorithm=aes_ctr
diff --git a/mysql-test/suite/innodb/t/innodb_encryption.test b/mysql-test/suite/innodb/t/innodb_encryption.test
index ffd57e47c01..50aca2a7260 100644
--- a/mysql-test/suite/innodb/t/innodb_encryption.test
+++ b/mysql-test/suite/innodb/t/innodb_encryption.test
@@ -2,6 +2,7 @@
 #
 #
 -- source include/have_innodb.inc
+-- source include/have_example_key_management_plugin.inc
 
 # embedded does not support restart
 -- source include/not_embedded.inc
diff --git a/mysql-test/suite/innodb/t/innodb_scrub.opt b/mysql-test/suite/innodb/t/innodb_scrub.opt
index fd165b269b5..fcbedad0df7 100644
--- a/mysql-test/suite/innodb/t/innodb_scrub.opt
+++ b/mysql-test/suite/innodb/t/innodb_scrub.opt
@@ -1,14 +1,13 @@
---enable-example-key-management-plugin
+--aria-encrypt-tables=ON
+--encrypt-tmp-disk-tables=ON
 --innodb-background-scrub-data-compressed=OFF
 --innodb-background-scrub-data-uncompressed=OFF
 --innodb-encrypt-tables=0
+--innodb-encrypt-tables=ON
+--innodb-encryption-rotate-key-age=15
 --innodb-encryption-threads=0
+--innodb-encryption-threads=4
 --innodb-file-format=Barracuda
 --innodb-file-per-table=1
 --innodb-immediate-scrub-data-uncompressed=ON
---loose-aria-encrypt-tables=ON
---loose-encrypt-tmp-disk-tables=ON
---loose-innodb-encrypt-tables=ON
---loose-innodb-encryption-rotate-key-age=15
---loose-innodb-encryption-threads=4
 --loose-innodb-scrub-force-testing=ON
diff --git a/mysql-test/suite/innodb/t/innodb_scrub.test b/mysql-test/suite/innodb/t/innodb_scrub.test
index 9bb7a359e68..4b370b3e148 100644
--- a/mysql-test/suite/innodb/t/innodb_scrub.test
+++ b/mysql-test/suite/innodb/t/innodb_scrub.test
@@ -1,5 +1,6 @@
 -- source include/have_innodb.inc
 -- source include/not_embedded.inc
+-- source include/have_example_key_management_plugin.inc
 
 let $MYSQLD_DATADIR=`select @@datadir`;
 let ib1_IBD = $MYSQLD_DATADIR/ibdata1;
diff --git a/mysql-test/suite/innodb/t/innodb_scrub_background.opt b/mysql-test/suite/innodb/t/innodb_scrub_background.opt
index e1fc6d82626..bb1f4ce4e86 100644
--- a/mysql-test/suite/innodb/t/innodb_scrub_background.opt
+++ b/mysql-test/suite/innodb/t/innodb_scrub_background.opt
@@ -1,15 +1,14 @@
---enable-example-key-management-plugin
---innodb-background-scrub-data-compressed=ON
---innodb-background-scrub-data-uncompressed=ON
+--innodb-file-per-table=1
+--innodb-file-format=Barracuda
 --innodb-encrypt-tables=0
 --innodb-encryption-threads=0
---innodb-file-format=Barracuda
---innodb-file-per-table=1
 --innodb-immediate-scrub-data-uncompressed=OFF
---innodb-tablespaces-scrubbing
---loose-aria-encrypt-tables=ON
---loose-encrypt-tmp-disk-tables=ON
---loose-innodb-encrypt-tables=ON
---loose-innodb-encryption-rotate-key-age=15
---loose-innodb-encryption-threads=4
+--innodb-background-scrub-data-uncompressed=ON
+--innodb-background-scrub-data-compressed=ON
 --loose-innodb-scrub-force-testing=ON
+--encrypt-tmp-disk-tables=ON
+--aria-encrypt-tables=ON
+--innodb-encryption-threads=4
+--innodb-encryption-rotate-key-age=15
+--innodb-encrypt-tables=ON
+--innodb-tablespaces-scrubbing
diff --git a/mysql-test/suite/innodb/t/innodb_scrub_background.test b/mysql-test/suite/innodb/t/innodb_scrub_background.test
index 931177f6fd4..44cb16b1241 100644
--- a/mysql-test/suite/innodb/t/innodb_scrub_background.test
+++ b/mysql-test/suite/innodb/t/innodb_scrub_background.test
@@ -1,5 +1,6 @@
 -- source include/have_innodb.inc
 -- source include/not_embedded.inc
+-- source include/have_example_key_management_plugin.inc
 
 let $MYSQLD_DATADIR=`select @@datadir`;
 let ib1_IBD = $MYSQLD_DATADIR/ibdata1;
diff --git a/mysql-test/suite/innodb/t/innodb_scrub_compressed.opt b/mysql-test/suite/innodb/t/innodb_scrub_compressed.opt
index b956866e648..ac7ef8a1675 100644
--- a/mysql-test/suite/innodb/t/innodb_scrub_compressed.opt
+++ b/mysql-test/suite/innodb/t/innodb_scrub_compressed.opt
@@ -1,15 +1,15 @@
---enable-example-key-management-plugin
---innodb-background-scrub-data-compressed=ON
---innodb-background-scrub-data-uncompressed=ON
---innodb-encrypt-tables=off
---innodb-encryption-threads=0
---innodb-file-format=Barracuda
 --innodb-file-per-table=1
+--innodb-file-format=Barracuda
+--innodb-encrypt-tables=off
 --innodb-immediate-scrub-data-uncompressed=ON
---innodb-tablespaces-scrubbing
---loose-aria-encrypt-tables=ON
---loose-encrypt-tmp-disk-tables=ON
---loose-innodb-encrypt-tables=ON
---loose-innodb-encryption-rotate-key-age=15
---loose-innodb-encryption-threads=4
+--innodb-background-scrub-data-uncompressed=ON
+--innodb-background-scrub-data-compressed=ON
 --loose-innodb-scrub-force-testing=ON
+--innodb-encryption-threads=0
+--encrypt-tmp-disk-tables=ON
+--aria-encrypt-tables=ON
+--innodb-encryption-threads=4
+--innodb-encryption-rotate-key-age=15
+--innodb-encrypt-tables=ON
+--innodb-tablespaces-scrubbing
+
diff --git a/mysql-test/suite/innodb/t/innodb_scrub_compressed.test b/mysql-test/suite/innodb/t/innodb_scrub_compressed.test
index 4e9cf6d9ec9..c89c32a4de8 100644
--- a/mysql-test/suite/innodb/t/innodb_scrub_compressed.test
+++ b/mysql-test/suite/innodb/t/innodb_scrub_compressed.test
@@ -1,5 +1,6 @@
 -- source include/have_innodb.inc
 -- source include/not_embedded.inc
+-- source include/have_example_key_management_plugin.inc
 
 let $MYSQLD_DATADIR=`select @@datadir`;
 let ib1_IBD = $MYSQLD_DATADIR/ibdata1;
diff --git a/mysql-test/suite/plugins/r/show_all_plugins.result b/mysql-test/suite/plugins/r/show_all_plugins.result
index 24ffbebdc8b..5fe80e23af0 100644
--- a/mysql-test/suite/plugins/r/show_all_plugins.result
+++ b/mysql-test/suite/plugins/r/show_all_plugins.result
@@ -21,11 +21,12 @@ Name	Status	Type	Library	License
 EXAMPLE	NOT INSTALLED	STORAGE ENGINE	ha_example.so	GPL
 UNUSABLE	NOT INSTALLED	DAEMON	ha_example.so	GPL
 daemon_example	NOT INSTALLED	DAEMON	libdaemon_example.so	GPL
+example_key_management_plugin	NOT INSTALLED	ENCRYPTION KEY MANAGEMENT	example_key_management_plugin.so	GPL
 three_attempts	NOT INSTALLED	AUTHENTICATION	dialog_examples.so	GPL
 two_questions	NOT INSTALLED	AUTHENTICATION	dialog_examples.so	GPL
 show status like '%libraries%';
 Variable_name	Value
-Opened_plugin_libraries	6
+Opened_plugin_libraries	7
 show plugins soname where library = 'ha_example.so';
 Name	Status	Type	Library	License
 EXAMPLE	NOT INSTALLED	STORAGE ENGINE	ha_example.so	GPL
diff --git a/mysys/my_thr_init.c b/mysys/my_thr_init.c
index d49a2eff970..debff7d396c 100644
--- a/mysys/my_thr_init.c
+++ b/mysys/my_thr_init.c
@@ -66,10 +66,6 @@ static void my_thread_init_common_mutex(void)
 #if !defined(HAVE_LOCALTIME_R) || !defined(HAVE_GMTIME_R)
   mysql_mutex_init(key_LOCK_localtime_r, &LOCK_localtime_r, MY_MUTEX_INIT_SLOW);
 #endif
-#ifndef DBUG_OFF
-  mysql_rwlock_init(key_LOCK_dbug_encryption_key_version,
-                    &LOCK_dbug_encryption_key_version);
-#endif
 }
 
 void my_thread_destroy_common_mutex(void)
@@ -84,9 +80,6 @@ void my_thread_destroy_common_mutex(void)
 #if !defined(HAVE_LOCALTIME_R) || !defined(HAVE_GMTIME_R)
   mysql_mutex_destroy(&LOCK_localtime_r);
 #endif
-#ifndef DBUG_OFF
-  mysql_rwlock_destroy(&LOCK_dbug_encryption_key_version);
-#endif
 }
 
 
diff --git a/mysys_ssl/CMakeLists.txt b/mysys_ssl/CMakeLists.txt
index 05b04b4d8cb..1479e3b3a90 100644
--- a/mysys_ssl/CMakeLists.txt
+++ b/mysys_ssl/CMakeLists.txt
@@ -40,8 +40,6 @@ SET(MYSYS_SSL_SOURCES
     my_md5.cc
     my_rnd.cc
     my_crypt.cc
-    my_crypt_key_management.cc
-    my_crypt_key_management_impl.cc
    )
 
 ADD_CONVENIENCE_LIBRARY(mysys_ssl ${MYSYS_SSL_SOURCES})
diff --git a/mysys_ssl/my_crypt_key_management.cc b/mysys_ssl/my_crypt_key_management.cc
deleted file mode 100644
index 69efed32567..00000000000
--- a/mysys_ssl/my_crypt_key_management.cc
+++ /dev/null
@@ -1,110 +0,0 @@
-#include <my_global.h>
-#include <my_crypt_key_management.h>
-#include <cstring>
-
-#ifndef DBUG_OFF
-#include <myisampack.h>
-my_bool debug_use_static_encryption_keys = 0;
-
-#ifdef HAVE_PSI_INTERFACE
-PSI_rwlock_key key_LOCK_dbug_encryption_key_version;
-#endif
-mysql_rwlock_t LOCK_dbug_encryption_key_version;
-unsigned int opt_debug_encryption_key_version = 0;
-#endif
-
-/**
- * Default functions
- */
-int GetLatestCryptoKeyVersionImpl();
-unsigned int HasCryptoKeyImpl(unsigned int version);
-int GetCryptoKeySizeImpl(unsigned int version);
-int GetCryptoKeyImpl(unsigned int version, unsigned char* key_buffer,
-                     unsigned int size);
-int GetCryptoIVImpl(unsigned int version, unsigned char* key_buffer,
-                    unsigned int size);
-
-/**
- * Function pointers for
- * - GetLatestCryptoKeyVersion
- * - GetCryptoKey
- */
-static
-struct CryptoKeyFuncs_t cryptoKeyFuncs = {
-  GetLatestCryptoKeyVersionImpl,
-  HasCryptoKeyImpl,
-  GetCryptoKeySizeImpl,
-  GetCryptoKeyImpl,
-  GetCryptoIVImpl
-};
-
-extern "C"
-int GetLatestCryptoKeyVersion() {
-#ifndef DBUG_OFF
-  if (debug_use_static_encryption_keys) {
-    mysql_rwlock_rdlock(&LOCK_dbug_encryption_key_version);
-    unsigned int res = opt_debug_encryption_key_version;
-    mysql_rwlock_unlock(&LOCK_dbug_encryption_key_version);
-    return res;
-  }
-#endif
-
-  return (* cryptoKeyFuncs.getLatestCryptoKeyVersionFunc)();
-}
-
-extern "C"
-unsigned int HasCryptoKey(unsigned int version) {
-  return (* cryptoKeyFuncs.hasCryptoKeyFunc)(version);
-}
-
-extern "C"
-int GetCryptoKeySize(unsigned int version) {
-  return (* cryptoKeyFuncs.getCryptoKeySize)(version);
-}
-
-extern "C"
-int GetCryptoKey(unsigned int version, unsigned char* key, unsigned int size) {
-#ifndef DBUG_OFF
-  if (debug_use_static_encryption_keys) {
-    memset(key, 0, size);
-    // Just don't support tiny keys, no point anyway.
-    if (size < 4) {
-      return 1;
-    }
-
-    mi_int4store(key, version);
-    return 0;
-  }
-#endif
-
-  return (* cryptoKeyFuncs.getCryptoKeyFunc)(version, key, size);
-}
-
-extern "C"
-int GetCryptoIV(unsigned int version, unsigned char* key, unsigned int size) {
-  return (* cryptoKeyFuncs.getCryptoIVFunc)(version, key, size);
-}
-
-extern "C"
-void
-InstallCryptoKeyFunctions(const struct CryptoKeyFuncs_t* _cryptoKeyFuncs)
-{
-  if (_cryptoKeyFuncs == NULL)
-  {
-    /* restore defaults wHashhen called with NULL argument */
-    cryptoKeyFuncs.getLatestCryptoKeyVersionFunc =
-        GetLatestCryptoKeyVersionImpl;
-    cryptoKeyFuncs.hasCryptoKeyFunc =
-	HasCryptoKeyImpl;
-    cryptoKeyFuncs.getCryptoKeySize =
-	GetCryptoKeySizeImpl;
-    cryptoKeyFuncs.getCryptoKeyFunc =
-        GetCryptoKeyImpl;
-    cryptoKeyFuncs.getCryptoIVFunc =
-        GetCryptoIVImpl;
-  }
-  else
-  {
-    cryptoKeyFuncs = *_cryptoKeyFuncs;
-  }
-}
diff --git a/mysys_ssl/my_crypt_key_management_impl.cc b/mysys_ssl/my_crypt_key_management_impl.cc
deleted file mode 100644
index af2077d8d15..00000000000
--- a/mysys_ssl/my_crypt_key_management_impl.cc
+++ /dev/null
@@ -1,34 +0,0 @@
-#include <my_global.h>
-
-// TODO Not yet implemented.
-int GetLatestCryptoKeyVersionImpl()
-{
-  abort();
-  return 0; /* Keep compiler happy */
-}
-
-unsigned int HasCryptoKeyImpl(unsigned int version)
-{
-  abort();
-  return 0; /* Keep compiler happy */
-}
-
-int GetCryptoKeySizeImpl(unsigned int version)
-{
-  abort();
-  return 0; /* Keep compiler happy */
-}
-
-int GetCryptoKeyImpl(unsigned int version, unsigned char* key,
-                     unsigned int key_size)
-{
-  abort();
-  return 0; /* Keep compiler happy */
-}
-
-int GetCryptoIVImpl(unsigned int version, unsigned char* key,
-                     unsigned int key_size)
-{
-  abort();
-  return 0; /* Keep compiler happy */
-}
diff --git a/plugin/example_key_management_plugin/CMakeLists.txt b/plugin/example_key_management_plugin/CMakeLists.txt
index 237d21a1e8e..95ff433dc43 100644
--- a/plugin/example_key_management_plugin/CMakeLists.txt
+++ b/plugin/example_key_management_plugin/CMakeLists.txt
@@ -1 +1,2 @@
-MYSQL_ADD_PLUGIN(EXAMPLE_KEY_MANAGEMENT_PLUGIN example_key_management_plugin.cc MANDATORY)
+MYSQL_ADD_PLUGIN(EXAMPLE_KEY_MANAGEMENT_PLUGIN example_key_management_plugin.cc
+                 MODULE_ONLY)
diff --git a/plugin/example_key_management_plugin/example_key_management_plugin.cc b/plugin/example_key_management_plugin/example_key_management_plugin.cc
index cdc32e87aad..f590fbb55b8 100644
--- a/plugin/example_key_management_plugin/example_key_management_plugin.cc
+++ b/plugin/example_key_management_plugin/example_key_management_plugin.cc
@@ -1,10 +1,9 @@
 // Copyright (C) 2014 Google Inc.
 
-#include <mysql_version.h>
 #include <my_global.h>
 #include <my_pthread.h>
 #include <my_aes.h>
-#include <my_crypt_key_management.h>
+#include <mysql/plugin_encryption_key_management.h>
 #include <my_md5.h>
 #include <my_rnd.h>
 
@@ -17,8 +16,7 @@ static unsigned int key_version = 0;
 static unsigned int next_key_version = 0;
 static pthread_mutex_t mutex;
 
-static
-int
+static unsigned int
 get_latest_key_version()
 {
   uint now = time(0);
@@ -34,8 +32,7 @@ get_latest_key_version()
   return key_version;
 }
 
-static
-int
+static int
 get_key(unsigned int version, unsigned char* dstbuf, unsigned buflen)
 {
   char *dst = (char*)dstbuf; // md5 function takes char* as argument...
@@ -58,7 +55,7 @@ static unsigned int has_key_func(unsigned int keyID)
   return true;
 }
 
-static int get_key_size(unsigned int keyID)
+static unsigned int get_key_size(unsigned int keyID)
 {
 	return 16;
 }
@@ -87,13 +84,6 @@ static int example_key_management_plugin_init(void *p)
 
   pthread_mutex_init(&mutex, NULL);
 
-  struct CryptoKeyFuncs_t func;
-  func.getLatestCryptoKeyVersionFunc = get_latest_key_version;
-  func.hasCryptoKeyFunc = has_key_func;
-  func.getCryptoKeySize = get_key_size;
-  func.getCryptoKeyFunc = get_key;
-  func.getCryptoIVFunc = get_iv;
-  InstallCryptoKeyFunctions(&func);
   return 0;
 }
 
@@ -103,8 +93,13 @@ static int example_key_management_plugin_deinit(void *p)
   return 0;
 }
 
-struct st_mysql_daemon example_key_management_plugin= {
-  MYSQL_DAEMON_INTERFACE_VERSION
+struct st_mariadb_encryption_key_management example_key_management_plugin= {
+  MariaDB_ENCRYPTION_KEY_MANAGEMENT_INTERFACE_VERSION,
+  get_latest_key_version,
+  has_key_func,
+  get_key_size,
+  get_key,
+  get_iv
 };
 
 /*
@@ -112,7 +107,7 @@ struct st_mysql_daemon example_key_management_plugin= {
 */
 maria_declare_plugin(example_key_management_plugin)
 {
-  MYSQL_DAEMON_PLUGIN,
+  MariaDB_ENCRYPTION_KEY_MANAGEMENT_PLUGIN,
   &example_key_management_plugin,
   "example_key_management_plugin",
   "Jonas Oreland",
@@ -124,6 +119,6 @@ maria_declare_plugin(example_key_management_plugin)
   NULL,	/* status variables */
   NULL,	/* system variables */
   "1.0",
-  MariaDB_PLUGIN_MATURITY_UNKNOWN
+  MariaDB_PLUGIN_MATURITY_EXPERIMENTAL
 }
 maria_declare_plugin_end;
diff --git a/plugin/file_key_management_plugin/CMakeLists.txt b/plugin/file_key_management_plugin/CMakeLists.txt
index d5412abf714..87e885c3550 100644
--- a/plugin/file_key_management_plugin/CMakeLists.txt
+++ b/plugin/file_key_management_plugin/CMakeLists.txt
@@ -1,4 +1,4 @@
 SET(FILE_KEY_MANAGEMENT_PLUGIN_SOURCES file_key_management_plugin.cc EncKeys.cc KeySingleton.cc)
 
-MYSQL_ADD_PLUGIN(FILE_KEY_MANAGEMENT_PLUGIN ${FILE_KEY_MANAGEMENT_PLUGIN_SOURCES} DEFAULT
+MYSQL_ADD_PLUGIN(FILE_KEY_MANAGEMENT_PLUGIN ${FILE_KEY_MANAGEMENT_PLUGIN_SOURCES}
                  LINK_LIBRARIES pcre)
diff --git a/plugin/file_key_management_plugin/file_key_management_plugin.cc b/plugin/file_key_management_plugin/file_key_management_plugin.cc
index 11892d74385..7dbf8c132da 100644
--- a/plugin/file_key_management_plugin/file_key_management_plugin.cc
+++ b/plugin/file_key_management_plugin/file_key_management_plugin.cc
@@ -16,6 +16,7 @@
 
 #include <my_global.h>
 #include <mysql_version.h>
+#include <mysql/plugin_encryption_key_management.h>
 #include <my_aes.h>
 #include <my_crypt_key_management.h>
 #include "sql_class.h"
@@ -50,7 +51,7 @@ static struct st_mysql_sys_var* settings[] = {
    rotation feature of encrypting log files.
 */
 
-static int get_highest_key_used_in_key_file()
+static unsigned int get_highest_key_used_in_key_file()
 {
   if (KeySingleton::getInstance().hasKey(0))
   {
@@ -67,7 +68,7 @@ static unsigned int has_key_from_key_file(unsigned int keyID)
   return entry != NULL;
 }
 
-static int get_key_size_from_key_file(unsigned int keyID)
+static unsigned int get_key_size_from_key_file(unsigned int keyID)
 {
   keyentry* entry = KeySingleton::getInstance().getKeys(keyID);
 
@@ -146,16 +147,6 @@ static int file_key_management_plugin_init(void *p)
     return 1;
   }
 
-  /* Initializing the key provider */
-  struct CryptoKeyFuncs_t func;
-  func.getLatestCryptoKeyVersionFunc = get_highest_key_used_in_key_file;
-  func.hasCryptoKeyFunc = has_key_from_key_file;
-  func.getCryptoKeySize = get_key_size_from_key_file;
-  func.getCryptoKeyFunc = get_key_from_key_file;
-  func.getCryptoIVFunc = get_iv_from_key_file;
-
-  InstallCryptoKeyFunctions(&func);
-
   if (filename == NULL || strcmp("", filename) == 0)
   {
     sql_print_error("Parameter file_key_management_plugin_filename is required");
@@ -175,8 +166,13 @@ static int file_key_management_plugin_deinit(void *p)
   return 0;
 }
 
-struct st_mysql_daemon file_key_management_plugin= {
-  MYSQL_DAEMON_INTERFACE_VERSION
+struct st_mariadb_encryption_key_management file_key_management_plugin= {
+  MariaDB_ENCRYPTION_KEY_MANAGEMENT_INTERFACE_VERSION,
+  get_highest_key_used_in_key_file,
+  has_key_from_key_file,
+  get_key_size_from_key_file,
+  get_key_from_key_file,
+  get_iv_from_key_file
 };
 
 /*
@@ -184,7 +180,7 @@ struct st_mysql_daemon file_key_management_plugin= {
 */
 maria_declare_plugin(file_key_management_plugin)
 {
-  MYSQL_KEY_MANAGEMENT_PLUGIN,
+  MariaDB_ENCRYPTION_KEY_MANAGEMENT_PLUGIN,
   &file_key_management_plugin,
   "file_key_management_plugin",
   "Denis Endro eperi GmbH",
diff --git a/sql/CMakeLists.txt b/sql/CMakeLists.txt
index 8ac9d2d324d..c78fa73bb51 100644
--- a/sql/CMakeLists.txt
+++ b/sql/CMakeLists.txt
@@ -115,7 +115,7 @@ SET (SQL_SOURCE
                my_json_writer.cc my_json_writer.h
                rpl_gtid.cc rpl_parallel.cc
 	       ${WSREP_SOURCES}
-               table_cache.cc
+               table_cache.cc encryption_keys.cc
                ${CMAKE_CURRENT_BINARY_DIR}/sql_builtin.cc
                ${GEN_SOURCES}
                ${MYSYS_LIBWRAP_SOURCE}
diff --git a/sql/encryption_keys.cc b/sql/encryption_keys.cc
new file mode 100644
index 00000000000..f924ad1c599
--- /dev/null
+++ b/sql/encryption_keys.cc
@@ -0,0 +1,110 @@
+#include <my_global.h>
+#include <mysql/plugin_encryption_key_management.h>
+#include <my_crypt_key_management.h>
+#include "log.h"
+#include "sql_plugin.h"
+
+#ifndef DBUG_OFF
+my_bool debug_use_static_encryption_keys = 0;
+uint opt_debug_encryption_key_version = 0;
+#endif
+
+/* there can be only one encryption key management plugin enabled */
+static plugin_ref encryption_key_manager= 0;
+static struct st_mariadb_encryption_key_management *handle;
+
+uint get_latest_encryption_key_version()
+{
+#ifndef DBUG_OFF
+  if (debug_use_static_encryption_keys)
+  {
+    //mysql_mutex_lock(&LOCK_global_system_variables);
+    uint res = opt_debug_encryption_key_version;
+    //mysql_mutex_unlock(&LOCK_global_system_variables);
+    return res;
+  }
+#endif
+
+  if (encryption_key_manager)
+    return handle->get_latest_key_version();
+
+  return BAD_ENCRYPTION_KEY_VERSION;
+}
+
+uint has_encryption_key(uint version)
+{
+  if (encryption_key_manager)
+    return handle->has_key_version(version);
+
+  return 0;
+}
+
+uint get_encryption_key_size(uint version)
+{
+  if (encryption_key_manager)
+    return handle->get_key_size(version);
+
+  return 0;
+}
+
+int get_encryption_key(uint version, uchar* key, uint size)
+{
+#ifndef DBUG_OFF
+  if (debug_use_static_encryption_keys)
+  {
+    memset(key, 0, size);
+    // Just don't support tiny keys, no point anyway.
+    if (size < 4)
+      return 1;
+
+    mi_int4store(key, version);
+    return 0;
+  }
+#endif
+
+  if (encryption_key_manager)
+    return handle->get_key(version, key, size);
+
+  return 1;
+}
+
+int get_encryption_iv(uint version, uchar* iv, uint size)
+{
+  if (encryption_key_manager)
+    return handle->get_iv(version, iv, size);
+
+  return 1;
+}
+
+int initialize_encryption_key_management_plugin(st_plugin_int *plugin)
+{
+  if (encryption_key_manager)
+    return 1;
+
+  if (plugin->plugin->init && plugin->plugin->init(plugin))
+  {
+    sql_print_error("Plugin '%s' init function returned error.",
+                    plugin->name.str);
+    return 1;
+  }
+
+  encryption_key_manager= plugin_lock(NULL, plugin_int_to_ref(plugin));
+  handle= (struct st_mariadb_encryption_key_management*)
+            plugin->plugin->info;
+  return 0;
+}
+
+int finalize_encryption_key_management_plugin(st_plugin_int *plugin)
+{
+  DBUG_ASSERT(encryption_key_manager);
+
+  if (plugin->plugin->deinit && plugin->plugin->deinit(NULL))
+  {
+    DBUG_PRINT("warning", ("Plugin '%s' deinit function returned error.",
+                           plugin->name.str));
+  }
+  plugin_unlock(NULL, encryption_key_manager);
+  encryption_key_manager= 0;
+  return 0;
+}
+
diff --git a/sql/sql_plugin.cc b/sql/sql_plugin.cc
index 7ec7b0ccc9d..3aba1e0a3bb 100644
--- a/sql/sql_plugin.cc
+++ b/sql/sql_plugin.cc
@@ -37,6 +37,7 @@
 #include "lock.h"                               // MYSQL_LOCK_IGNORE_TIMEOUT
 #include <mysql/plugin_auth.h>
 #include <mysql/plugin_password_validation.h>
+#include <mysql/plugin_encryption_key_management.h>
 #include "sql_plugin_compat.h"
 
 #define REPORT_TO_LOG  1
@@ -85,7 +86,8 @@ const LEX_STRING plugin_type_names[MYSQL_MAX_PLUGIN_TYPE_NUM]=
   { C_STRING_WITH_LEN("AUDIT") },
   { C_STRING_WITH_LEN("REPLICATION") },
   { C_STRING_WITH_LEN("AUTHENTICATION") },
-  { C_STRING_WITH_LEN("PASSWORD VALIDATION") }
+  { C_STRING_WITH_LEN("PASSWORD VALIDATION") },
+  { C_STRING_WITH_LEN("ENCRYPTION KEY MANAGEMENT") }
 };
 
 extern int initialize_schema_table(st_plugin_int *plugin);
@@ -94,6 +96,9 @@ extern int finalize_schema_table(st_plugin_int *plugin);
 extern int initialize_audit_plugin(st_plugin_int *plugin);
 extern int finalize_audit_plugin(st_plugin_int *plugin);
 
+extern int initialize_encryption_key_management_plugin(st_plugin_int *plugin);
+extern int finalize_encryption_key_management_plugin(st_plugin_int *plugin);
+
 /*
   The number of elements in both plugin_type_initialize and
   plugin_type_deinitialize should equal to the number of plugins
@@ -102,13 +107,13 @@ extern int finalize_audit_plugin(st_plugin_int *plugin);
 plugin_type_init plugin_type_initialize[MYSQL_MAX_PLUGIN_TYPE_NUM]=
 {
   0, ha_initialize_handlerton, 0, 0,initialize_schema_table,
-  initialize_audit_plugin, 0, 0, 0
+  initialize_audit_plugin, 0, 0, 0, initialize_encryption_key_management_plugin
 };
 
 plugin_type_init plugin_type_deinitialize[MYSQL_MAX_PLUGIN_TYPE_NUM]=
 {
   0, ha_finalize_handlerton, 0, 0, finalize_schema_table,
-  finalize_audit_plugin, 0, 0, 0
+  finalize_audit_plugin, 0, 0, 0, finalize_encryption_key_management_plugin
 };
 
 /*
@@ -119,7 +124,7 @@ plugin_type_init plugin_type_deinitialize[MYSQL_MAX_PLUGIN_TYPE_NUM]=
 static int plugin_type_initialization_order[MYSQL_MAX_PLUGIN_TYPE_NUM]=
 {
   MYSQL_DAEMON_PLUGIN,
-  MYSQL_KEY_MANAGEMENT_PLUGIN,
+  MariaDB_ENCRYPTION_KEY_MANAGEMENT_PLUGIN,
   MYSQL_STORAGE_ENGINE_PLUGIN,
   MYSQL_INFORMATION_SCHEMA_PLUGIN,
   MYSQL_FTPARSER_PLUGIN,
@@ -160,7 +165,8 @@ static int min_plugin_info_interface_version[MYSQL_MAX_PLUGIN_TYPE_NUM]=
   MYSQL_AUDIT_INTERFACE_VERSION,
   MYSQL_REPLICATION_INTERFACE_VERSION,
   MIN_AUTHENTICATION_INTERFACE_VERSION,
-  MariaDB_PASSWORD_VALIDATION_INTERFACE_VERSION
+  MariaDB_PASSWORD_VALIDATION_INTERFACE_VERSION,
+  MariaDB_ENCRYPTION_KEY_MANAGEMENT_INTERFACE_VERSION
 };
 static int cur_plugin_info_interface_version[MYSQL_MAX_PLUGIN_TYPE_NUM]=
 {
@@ -172,7 +178,8 @@ static int cur_plugin_info_interface_version[MYSQL_MAX_PLUGIN_TYPE_NUM]=
   MYSQL_AUDIT_INTERFACE_VERSION,
   MYSQL_REPLICATION_INTERFACE_VERSION,
   MYSQL_AUTHENTICATION_INTERFACE_VERSION,
-  MariaDB_PASSWORD_VALIDATION_INTERFACE_VERSION
+  MariaDB_PASSWORD_VALIDATION_INTERFACE_VERSION,
+  MariaDB_ENCRYPTION_KEY_MANAGEMENT_INTERFACE_VERSION
 };
 
 static struct
@@ -1954,8 +1961,6 @@ void plugin_shutdown(void)
       if (!(plugins[i]->state & (PLUGIN_IS_UNINITIALIZED | PLUGIN_IS_FREED |
                                  PLUGIN_IS_DISABLED)))
       {
-        sql_print_warning("Plugin '%s' will be forced to shutdown",
-                          plugins[i]->name.str);
         /*
           We are forcing deinit on plugins so we don't want to do a ref_count
           check until we have processed all the plugins.
diff --git a/sql/sys_vars.cc b/sql/sys_vars.cc
index e7092354606..198e4073ef8 100644
--- a/sql/sys_vars.cc
+++ b/sql/sys_vars.cc
@@ -62,7 +62,7 @@
 #include "sql_repl.h"
 #include "opt_range.h"
 #include "rpl_parallel.h"
-#include "my_crypt_key_management.h"
+#include <my_crypt_key_management.h>
 
 /*
   The rule for this file: everything should be 'static'. When a sys_var
@@ -1134,15 +1134,12 @@ static Sys_var_mybool Sys_debug_use_static_keys(
        READ_ONLY GLOBAL_VAR(debug_use_static_encryption_keys),
        CMD_LINE(OPT_ARG), DEFAULT(FALSE));
 
-static PolyLock_rwlock PLock_sys_debug_encryption_key_version(
-       &LOCK_dbug_encryption_key_version);
-
 static Sys_var_uint Sys_debug_encryption_key_version(
        "debug_encryption_key_version",
        "Encryption key version. Only to be used in internal testing.",
        GLOBAL_VAR(opt_debug_encryption_key_version),
        CMD_LINE(REQUIRED_ARG), VALID_RANGE(0,UINT_MAX), DEFAULT(0),
-       BLOCK_SIZE(1), &PLock_sys_debug_encryption_key_version);
+       BLOCK_SIZE(1));
 #endif
 
 static Sys_var_mybool Sys_trust_function_creators(
diff --git a/storage/innobase/fil/fil0crypt.cc b/storage/innobase/fil/fil0crypt.cc
index 8ff2c490d35..c12bc385720 100644
--- a/storage/innobase/fil/fil0crypt.cc
+++ b/storage/innobase/fil/fil0crypt.cc
@@ -210,7 +210,7 @@ fil_crypt_get_key(byte *dst, uint* key_length,
         {
             // load iv
 
-	    int rc = GetCryptoIV(version, (unsigned char*)iv, iv_len);
+	    int rc = get_encryption_iv(version, (unsigned char*)iv, iv_len);
 
 	    if (rc != CRYPT_KEY_OK) {
 		ib_logf(IB_LOG_LEVEL_FATAL,
@@ -219,10 +219,10 @@ fil_crypt_get_key(byte *dst, uint* key_length,
 	    }
         }
 
-	if (HasCryptoKey(version)) {
-	    *key_length = GetCryptoKeySize(version);
+	if (has_encryption_key(version)) {
+	    *key_length = get_encryption_key_size(version);
 
-	    int rc = GetCryptoKey(version, (unsigned char*)keybuf, *key_length);
+	    int rc = get_encryption_key(version, (unsigned char*)keybuf, *key_length);
 
 	    if (rc != CRYPT_KEY_OK) {
 		ib_logf(IB_LOG_LEVEL_FATAL,
@@ -295,7 +295,7 @@ fil_crypt_get_latest_key(byte *dst, uint* key_length,
 {
 	if (srv_encrypt_tables) {
 	        // used for key rotation - get the next key id from the key provider
-		int rc = GetLatestCryptoKeyVersion();
+		int rc = get_latest_encryption_key_version();
 
 		// if no new key was created use the last one
 		if (rc >= 0)
@@ -325,7 +325,7 @@ fil_space_create_crypt_data()
 		crypt_data->min_key_version = 0;
 	} else {
 		crypt_data->type = CRYPT_SCHEME_1;
-		crypt_data->min_key_version = GetLatestCryptoKeyVersion();
+		crypt_data->min_key_version = get_latest_encryption_key_version();
 	}
 
 	mutex_create(fil_crypt_data_mutex_key,
@@ -652,7 +652,7 @@ fil_space_encrypt(ulint space, ulint offset, lsn_t lsn,
 	{
 	    // take the iv from the key provider
 
-	    int load_iv_rc = GetCryptoIV(key_version, (uchar *) iv, sizeof(iv));
+	    int load_iv_rc = get_encryption_iv(key_version, (uchar *) iv, sizeof(iv));
 
 	    // if the iv can not be loaded the whole page can not be encrypted
 	    if (load_iv_rc != CRYPT_KEY_OK)
@@ -869,7 +869,7 @@ fil_space_decrypt(fil_space_crypt_t* crypt_data,
 	{
 	    // take the iv from the key provider
 
-	    int load_iv_rc = GetCryptoIV(key_version, (uchar *) iv, sizeof(iv));
+	    int load_iv_rc = get_encryption_iv(key_version, (uchar *) iv, sizeof(iv));
 
 	    // if the iv can not be loaded the whole page can not be decrypted
 	    if (load_iv_rc != CRYPT_KEY_OK)
@@ -1049,7 +1049,7 @@ fil_crypt_get_key_state(
 	key_state_t *new_state)
 {
 	if (srv_encrypt_tables == TRUE) {
-		new_state->key_version = GetLatestCryptoKeyVersion();
+		new_state->key_version = get_latest_encryption_key_version();
 		new_state->rotate_key_age = srv_fil_crypt_rotate_key_age;
 		ut_a(new_state->key_version > 0);
 	} else {
@@ -2375,7 +2375,7 @@ fil_space_crypt_get_status(
 	}
 
 	if (srv_encrypt_tables == TRUE) {
-		status->current_key_version = GetLatestCryptoKeyVersion();
+		status->current_key_version = get_latest_encryption_key_version();
 	} else {
 		status->current_key_version = 0;
 	}
diff --git a/storage/innobase/fil/fil0fil.cc b/storage/innobase/fil/fil0fil.cc
index cbe9ec56e88..7eb585609d2 100644
--- a/storage/innobase/fil/fil0fil.cc
+++ b/storage/innobase/fil/fil0fil.cc
@@ -1153,7 +1153,7 @@ fil_space_create(
 	ut_a(fil_system);
 
 	if (fsp_flags_is_page_encrypted(flags)) {
-		if (!HasCryptoKey(fsp_flags_get_page_encryption_key(flags))) {
+		if (!has_encryption_key(fsp_flags_get_page_encryption_key(flags))) {
 			/* by returning here it should be avoided that
 			 * the server crashes, if someone tries to access an
 			 * encrypted table and the encryption key is not available.
diff --git a/storage/innobase/handler/ha_innodb.cc b/storage/innobase/handler/ha_innodb.cc
index df5867ce43b..5c5c21280c8 100644
--- a/storage/innobase/handler/ha_innodb.cc
+++ b/storage/innobase/handler/ha_innodb.cc
@@ -11370,7 +11370,7 @@ ha_innobase::check_table_options(
 			return "PAGE_ENCRYPTION_KEY";
 		}
 
-		if (!HasCryptoKey(options->page_encryption_key)) {
+		if (!has_encryption_key(options->page_encryption_key)) {
 			push_warning_printf(
 				thd, Sql_condition::WARN_LEVEL_WARN,
 				HA_WRONG_CREATE_OPTION,
diff --git a/storage/innobase/include/fsp0pageencryption.ic b/storage/innobase/include/fsp0pageencryption.ic
index 42c980b0430..e2bd76679ee 100644
--- a/storage/innobase/include/fsp0pageencryption.ic
+++ b/storage/innobase/include/fsp0pageencryption.ic
@@ -147,9 +147,9 @@ fil_page_encryption_status(
 	if (page_type == FIL_PAGE_TYPE_FSP_HDR) {
 		ulint flags = mach_read_from_4(FSP_HEADER_OFFSET + FSP_SPACE_FLAGS + buf);
 		if (fsp_flags_is_page_encrypted(flags)) {
-			if (!HasCryptoKey(fsp_flags_get_page_encryption_key(flags))) {
+			if (!has_encryption_key(fsp_flags_get_page_encryption_key(flags))) {
 				/* accessing table would surely fail, because no key or no key provider available */
-				if (!HasCryptoKey(fsp_flags_get_page_encryption_key(flags))) {
+				if (!has_encryption_key(fsp_flags_get_page_encryption_key(flags))) {
 					return PAGE_ENCRYPTION_KEY_MISSING;
 				}
 				return PAGE_ENCRYPTION_ERROR;
@@ -159,7 +159,7 @@ fil_page_encryption_status(
 
 	if(page_type == FIL_PAGE_PAGE_COMPRESSED_ENCRYPTED) {
 		ulint key = mach_read_from_4(buf + FIL_PAGE_FILE_FLUSH_LSN_OR_KEY_VERSION);
-		if (!HasCryptoKey(key)) {
+		if (!has_encryption_key(key)) {
 						return PAGE_ENCRYPTION_KEY_MISSING;
 		}
 		return PAGE_ENCRYPTION_ERROR;
diff --git a/storage/innobase/include/log0crypt.h b/storage/innobase/include/log0crypt.h
index 188e82397a2..0c0d046c471 100644
--- a/storage/innobase/include/log0crypt.h
+++ b/storage/innobase/include/log0crypt.h
@@ -12,7 +12,7 @@ Created 11/25/2013 Minli Zhu
 #include "ut0lst.h"
 #include "ut0rnd.h"
 #include "my_aes.h"
-#include "my_crypt_key_management.h"	// for key version and key 
+#include <my_crypt_key_management.h>
 
 #define PURPOSE_BYTE_LEN	MY_AES_BLOCK_SIZE - 1
 #define PURPOSE_BYTE_OFFSET	0
diff --git a/storage/innobase/log/log0crypt.cc b/storage/innobase/log/log0crypt.cc
index 0647fd04e84..17e1404777e 100644
--- a/storage/innobase/log/log0crypt.cc
+++ b/storage/innobase/log/log0crypt.cc
@@ -37,7 +37,7 @@ Note:
 We should not use flags and conditions such as:
 	(srv_encrypt_log &&
 	 debug_use_static_keys &&
-	 GetLatestCryptoKeyVersion() == UNENCRYPTED_KEY_VER)
+	 get_latest_encryption_key_version() == UNENCRYPTED_KEY_VER)
 because they haven't been read and set yet in the situation of resetting
 redo logs.
 */
@@ -93,7 +93,7 @@ log_init_crypt_key(
 	}
 
 	byte mysqld_key[MY_AES_BLOCK_SIZE] = {0};
-	if (GetCryptoKey(crypt_ver, mysqld_key, MY_AES_BLOCK_SIZE))
+	if (get_encryption_key(crypt_ver, mysqld_key, MY_AES_BLOCK_SIZE))
 	{
 		fprintf(stderr,
 			"\nInnodb redo log crypto: getting mysqld crypto key "
@@ -234,7 +234,7 @@ log_crypt_set_ver_and_key(
 	byte* crypt_key)		/*!< out: crypto key */
 {
 	if (!srv_encrypt_log ||
-	    (key_ver = GetLatestCryptoKeyVersion()) == UNENCRYPTED_KEY_VER)
+	    (key_ver = get_latest_encryption_key_version()) == UNENCRYPTED_KEY_VER)
 	{
 		key_ver = UNENCRYPTED_KEY_VER;
 		memset(crypt_key, 0, MY_AES_BLOCK_SIZE);
diff --git a/storage/xtradb/fil/fil0crypt.cc b/storage/xtradb/fil/fil0crypt.cc
index 930b8c63255..be0c120c6c7 100644
--- a/storage/xtradb/fil/fil0crypt.cc
+++ b/storage/xtradb/fil/fil0crypt.cc
@@ -210,7 +210,7 @@ fil_crypt_get_key(byte *dst, uint* key_length,
         {
             // load iv
 
-	    int rc = GetCryptoIV(version, (unsigned char*)iv, iv_len);
+	    int rc = get_encryption_iv(version, (unsigned char*)iv, iv_len);
 
 	    if (rc != CRYPT_KEY_OK) {
 		ib_logf(IB_LOG_LEVEL_FATAL,
@@ -219,10 +219,10 @@ fil_crypt_get_key(byte *dst, uint* key_length,
 	    }
         }
 
-	if (HasCryptoKey(version)) {
-	    *key_length = GetCryptoKeySize(version);
+	if (has_encryption_key(version)) {
+	    *key_length = get_encryption_key_size(version);
 
-	    int rc = GetCryptoKey(version, (unsigned char*)keybuf, *key_length);
+	    int rc = get_encryption_key(version, (unsigned char*)keybuf, *key_length);
 
 	    if (rc != CRYPT_KEY_OK) {
 		ib_logf(IB_LOG_LEVEL_FATAL,
@@ -295,7 +295,7 @@ fil_crypt_get_latest_key(byte *dst, uint* key_length,
 {
 	if (srv_encrypt_tables) {
 	        // used for key rotation - get the next key id from the key provider
-		int rc = GetLatestCryptoKeyVersion();
+		int rc = get_latest_encryption_key_version();
 
 		// if no new key was created use the last one
 		if (rc >= 0)
@@ -326,7 +326,7 @@ fil_space_create_crypt_data()
 		crypt_data->min_key_version = 0;
 	} else {
 		crypt_data->type = CRYPT_SCHEME_1;
-		crypt_data->min_key_version = GetLatestCryptoKeyVersion();
+		crypt_data->min_key_version = get_latest_encryption_key_version();
 	}
 
 	mutex_create(fil_crypt_data_mutex_key,
@@ -653,7 +653,7 @@ fil_space_encrypt(ulint space, ulint offset, lsn_t lsn,
 	{
 	    // take the iv from the key provider
 
-	    int load_iv_rc = GetCryptoIV(key_version, (uchar *) iv, sizeof(iv));
+	    int load_iv_rc = get_encryption_iv(key_version, (uchar *) iv, sizeof(iv));
 
 	    // if the iv can not be loaded the whole page can not be encrypted
 	    if (load_iv_rc != CRYPT_KEY_OK)
@@ -869,7 +869,7 @@ fil_space_decrypt(fil_space_crypt_t* crypt_data,
 	{
 	    // take the iv from the key provider
 
-	    int load_iv_rc = GetCryptoIV(key_version, (uchar *) iv, sizeof(iv));
+	    int load_iv_rc = get_encryption_iv(key_version, (uchar *) iv, sizeof(iv));
 
 	    // if the iv can not be loaded the whole page can not be decrypted
 	    if (load_iv_rc != CRYPT_KEY_OK)
@@ -1049,7 +1049,7 @@ fil_crypt_get_key_state(
 	key_state_t *new_state)
 {
 	if (srv_encrypt_tables == TRUE) {
-		new_state->key_version = GetLatestCryptoKeyVersion();
+		new_state->key_version = get_latest_encryption_key_version();
 		new_state->rotate_key_age = srv_fil_crypt_rotate_key_age;
 		ut_a(new_state->key_version > 0);
 	} else {
@@ -2375,7 +2375,7 @@ fil_space_crypt_get_status(
 	}
 
 	if (srv_encrypt_tables == TRUE) {
-		status->current_key_version = GetLatestCryptoKeyVersion();
+		status->current_key_version = get_latest_encryption_key_version();
 	} else {
 		status->current_key_version = 0;
 	}
diff --git a/storage/xtradb/fil/fil0fil.cc b/storage/xtradb/fil/fil0fil.cc
index d0abced2cdb..530326c0f66 100644
--- a/storage/xtradb/fil/fil0fil.cc
+++ b/storage/xtradb/fil/fil0fil.cc
@@ -1188,7 +1188,7 @@ fil_space_create(
 	ut_a(fil_system);
 
 	if (fsp_flags_is_page_encrypted(flags)) {
-		if (!HasCryptoKey(fsp_flags_get_page_encryption_key(flags))) {
+		if (!has_encryption_key(fsp_flags_get_page_encryption_key(flags))) {
 			/* by returning here it should be avoided that
 			 * the server crashes, if someone tries to access an
 			 * encrypted table and the encryption key is not available.
diff --git a/storage/xtradb/handler/ha_innodb.cc b/storage/xtradb/handler/ha_innodb.cc
index c7e98f02702..8053e7c9ce3 100644
--- a/storage/xtradb/handler/ha_innodb.cc
+++ b/storage/xtradb/handler/ha_innodb.cc
@@ -11887,7 +11887,7 @@ ha_innobase::check_table_options(
 			return "PAGE_ENCRYPTION_KEY";
 		}
 
-		if (!HasCryptoKey(options->page_encryption_key)) {
+		if (!has_encryption_key(options->page_encryption_key)) {
 			push_warning_printf(
 				thd, Sql_condition::WARN_LEVEL_WARN,
 				HA_WRONG_CREATE_OPTION,
diff --git a/storage/xtradb/include/fsp0pageencryption.ic b/storage/xtradb/include/fsp0pageencryption.ic
index a2c8c3b0660..311618e905a 100644
--- a/storage/xtradb/include/fsp0pageencryption.ic
+++ b/storage/xtradb/include/fsp0pageencryption.ic
@@ -27,9 +27,6 @@ Created 08/28/2014
 #include "fil0pageencryption.h"
 #include <my_crypt_key_management.h>
 
-
-
-
 /********************************************************************//**
 Determine if the tablespace is page encrypted from dict_table_t::flags.
 @return	TRUE if page encrypted, FALSE if not page encrypted */
@@ -151,9 +148,9 @@ fil_page_encryption_status(
 	if (page_type == FIL_PAGE_TYPE_FSP_HDR) {
 		ulint flags = mach_read_from_4(FSP_HEADER_OFFSET + FSP_SPACE_FLAGS + buf);
 		if (fsp_flags_is_page_encrypted(flags)) {
-			if (!HasCryptoKey(fsp_flags_get_page_encryption_key(flags))) {
+			if (!has_encryption_key(fsp_flags_get_page_encryption_key(flags))) {
 				/* accessing table would surely fail, because no key or no key provider available */
-				if (!HasCryptoKey(fsp_flags_get_page_encryption_key(flags))) {
+				if (!has_encryption_key(fsp_flags_get_page_encryption_key(flags))) {
 					return PAGE_ENCRYPTION_KEY_MISSING;
 				}
 				return PAGE_ENCRYPTION_ERROR;
@@ -163,7 +160,7 @@ fil_page_encryption_status(
 
 	if(page_type == FIL_PAGE_PAGE_COMPRESSED_ENCRYPTED) {
 		ulint key = mach_read_from_4(buf + FIL_PAGE_FILE_FLUSH_LSN_OR_KEY_VERSION);
-		if (!HasCryptoKey(key)) {
+		if (!has_encryption_key(key)) {
 			return PAGE_ENCRYPTION_KEY_MISSING;
 		}
 		return PAGE_ENCRYPTION_ERROR;
diff --git a/storage/xtradb/include/log0crypt.h b/storage/xtradb/include/log0crypt.h
index 188e82397a2..0c0d046c471 100644
--- a/storage/xtradb/include/log0crypt.h
+++ b/storage/xtradb/include/log0crypt.h
@@ -12,7 +12,7 @@ Created 11/25/2013 Minli Zhu
 #include "ut0lst.h"
 #include "ut0rnd.h"
 #include "my_aes.h"
-#include "my_crypt_key_management.h"	// for key version and key 
+#include <my_crypt_key_management.h>
 
 #define PURPOSE_BYTE_LEN	MY_AES_BLOCK_SIZE - 1
 #define PURPOSE_BYTE_OFFSET	0
diff --git a/storage/xtradb/log/log0crypt.cc b/storage/xtradb/log/log0crypt.cc
index 0647fd04e84..17e1404777e 100644
--- a/storage/xtradb/log/log0crypt.cc
+++ b/storage/xtradb/log/log0crypt.cc
@@ -37,7 +37,7 @@ Note:
 We should not use flags and conditions such as:
 	(srv_encrypt_log &&
 	 debug_use_static_keys &&
-	 GetLatestCryptoKeyVersion() == UNENCRYPTED_KEY_VER)
+	 get_latest_encryption_key_version() == UNENCRYPTED_KEY_VER)
 because they haven't been read and set yet in the situation of resetting
 redo logs.
 */
@@ -93,7 +93,7 @@ log_init_crypt_key(
 	}
 
 	byte mysqld_key[MY_AES_BLOCK_SIZE] = {0};
-	if (GetCryptoKey(crypt_ver, mysqld_key, MY_AES_BLOCK_SIZE))
+	if (get_encryption_key(crypt_ver, mysqld_key, MY_AES_BLOCK_SIZE))
 	{
 		fprintf(stderr,
 			"\nInnodb redo log crypto: getting mysqld crypto key "
@@ -234,7 +234,7 @@ log_crypt_set_ver_and_key(
 	byte* crypt_key)		/*!< out: crypto key */
 {
 	if (!srv_encrypt_log ||
-	    (key_ver = GetLatestCryptoKeyVersion()) == UNENCRYPTED_KEY_VER)
+	    (key_ver = get_latest_encryption_key_version()) == UNENCRYPTED_KEY_VER)
 	{
 		key_ver = UNENCRYPTED_KEY_VER;
 		memset(crypt_key, 0, MY_AES_BLOCK_SIZE);