使用MariaDB AES_DECRYPT(CBC模式)报错1582：参数数量不正确

Hey there! Let's figure out why you're getting that Error 1582 and how to get AES-256-CBC working in MariaDB properly.

That error pops up because your MariaDB version doesn’t support passing an IV as the third parameter to AES_DECRYPT (and AES_ENCRYPT). MariaDB only added support for the optional IV parameter starting in version 10.1.3. If you’re running an older version, those functions only accept two arguments: the data and the key.

First, check your MariaDB version #

Run this query to confirm your version:

SELECT VERSION();

Case 1: Your version is 10.1.3 or newer #

Your original code is almost correct—you just need to account for the fact that AES_DECRYPT returns binary data, so you’ll need to cast it to a character string to see the readable plaintext. Also, let’s confirm your key and IV meet AES-256-CBC requirements:

• Your key (3C5QYgFQr9AARjMyLNNQ3fL8QauXLTz0) is 32 bytes long—perfect for AES-256 (which requires a 256-bit/32-byte key).
• Your IV (kaNUE3JAIVB9Em9v) is 16 bytes long, which matches AES’s block size (mandatory for CBC mode).

Here’s the corrected, working code:

SET @key_str = '3C5QYgFQr9AARjMyLNNQ3fL8QauXLTz0';
SET @iv = 'kaNUE3JAIVB9Em9v';
SET @ciphertext = AES_ENCRYPT('Hello', @key_str, @iv);
-- Cast the binary decryption result to a readable string
SELECT CAST(AES_DECRYPT(@ciphertext, @key_str, @iv) AS CHAR);

For better security, you should use a random IV for every encryption operation (hardcoding an IV weakens the security of your encryption). Here’s a more secure example that stores the IV alongside the ciphertext (using hex encoding for easy database storage):

-- Generate a random 16-byte IV (matches AES block size)
SET @iv = RANDOM_BYTES(16);
SET @key_str = '3C5QYgFQr9AARjMyLNNQ3fL8QauXLTz0';
SET @plaintext = 'Hello';

-- Perform encryption
SET @ciphertext = AES_ENCRYPT(@plaintext, @key_str, @iv);

-- Convert IV and ciphertext to hex strings for easy storage
SET @stored_iv = HEX(@iv);
SET @stored_ciphertext = HEX(@ciphertext);

-- Decrypt: convert hex values back to binary first
SET @decrypt_iv = UNHEX(@stored_iv);
SET @decrypt_ciphertext = UNHEX(@stored_ciphertext);
SELECT CAST(AES_DECRYPT(@decrypt_ciphertext, @key_str, @decrypt_iv) AS CHAR) AS decrypted_plaintext;

Case 2: Your version is older than 10.1.3 #

Older MariaDB versions only support AES in ECB mode, which is not secure for most real-world use cases. The best solution is to upgrade your MariaDB instance to at least version 10.1.3 to gain proper CBC mode support with IVs.

If upgrading isn’t feasible, you’d have to implement CBC mode manually using custom functions—but this is error-prone and not recommended for production systems. Upgrading is the safer, simpler path forward.

内容的提问来源于stack exchange，提问作者Arun P