TDE and Backups

  • Comments posted to this topic are about the item TDE and Backups

  • Nice clear and unambiguous question.

    Tom

  • Tom.Thomson (8/10/2011)


    unambiguous question

    Oh, what is a normal backup :ermm: a backup before TDE was enabled or backup following standard procedure :blush:

  • Nice question, thanks.

    Need an answer? No, you need a question
    My blog at https://sqlkover.com.
    MCSE Business Intelligence - Microsoft Data Platform MVP

  • This was removed by the editor as SPAM

  • Thanks Steve.

  • I got confused with the question and got it wrong. I thought that the normal backups which Steve was referring to might be the backups for databases without TDE enabled. I guess there might be a few who thought like I did.

    M&M

  • nice question!

    thanks steve!!!!


    [font="Times New Roman"]rfr.ferrari[/font]
    DBA - SQL Server 2008
    MCITP | MCTS

    remember is live or suffer twice!
    the period you fastest growing is the most difficult period of your life!
  • From the referenced article...

    Transparent data encryption (TDE) performs real-time I/O encryption and decryption of the data and log files. The encryption uses a database encryption key (DEK), which is stored in the database boot record for availability during recovery. The DEK is a symmetric key secured by using a certificate stored in the master database of the server or an asymmetric key protected by an EKM module.

    ....

    Note

    When enabling TDE, you should immediately back up the certificate and the private key associated with the certificate. If the certificate ever becomes unavailable or if you must restore or attach the database on another server, you must have backups of both the certificate and the private key or you will not be able to open the database.

    From the article, I didn't consider DEK == certificate

  • Seemed like a no-brainer, as I thought that was the purpose of "at rest" data protection. But, I've seen the issues posted above. Some day we'll all converse in an arithmetic language and ambiguity will be a things of the past ... unless we aren't all using the same encoding....

    [font="Verdana"]Please don't go. The drones need you. They look up to you.[/font]
    Connect to me on LinkedIn

  • I was kind of thrown by the term "normal backup". Is there any other kind? If I have an abnormal backup, I can't use it for restores. 😀

  • Thanks, I needed that. 🙂

  • I'm learning a lot about TDE with these questions. Thanks and keep them coming.

    http://brittcluff.blogspot.com/

  • I figured it had to require the key, because encrypted anything just about always does.

    So I was like no duh.... then I was like "If it's such a no-duh question, then there has to be a trick answer"

    Then I started running psychological analysis loops until I eventually recursed myself into oblivion.

    Finally, I went with my original answer, and got it right.

    Thanks a lot for making me second and third guess myself.



    --Mark Tassin
    MCITP - SQL Server DBA
    Proud member of the Anti-RBAR alliance.
    For help with Performance click this link[/url]
    For tips on how to post your problems[/url]

  • m mcdonald (8/11/2011)


    From the referenced article...

    Transparent data encryption (TDE) performs real-time I/O encryption and decryption of the data and log files. The encryption uses a database encryption key (DEK), which is stored in the database boot record for availability during recovery. The DEK is a symmetric key secured by using a certificate stored in the master database of the server or an asymmetric key protected by an EKM module.

    ....

    Note

    When enabling TDE, you should immediately back up the certificate and the private key associated with the certificate. If the certificate ever becomes unavailable or if you must restore or attach the database on another server, you must have backups of both the certificate and the private key or you will not be able to open the database.

    From the article, I didn't consider DEK == certificate

    Totally agree. I got it wrong because I was thinking the same "DEK <> certificate"

Viewing 15 posts - 1 through 15 (of 23 total)

You must be logged in to reply to this topic. Login to reply