InstantForum.NET v2.9.0SQLServerCentralhttp://www.sqlservercentral.com/Forums/notifications@sqlservercentral.comSat, 25 May 2013 01:29:27 GMT20http://www.sqlservercentral.com/Forums/Topic1412556-1526-1.aspxou can't use a custom certificate with salesforce.com, it just doesn't work that way. At what level are you looking to encrypt the data? Data is already encrypted during data transport (uses TLS encryption where available). If you want to store the data in salesforce.com, use Encrypted Text Fields (free, available on request).Fri, 22 Feb 2013 11:45:23 GMTssnrobtcokhttp://www.sqlservercentral.com/Forums/Topic1412556-1526-1.aspx[quote][b]PHXHoward (1/29/2013)[/b][hr]That makes sense. I was wondering about the reencrypt process because an auditor asked me that question so I wanted to give him an answer.[/quote]Auditor :-) so all is clear, auditors sometimes ask weird questions...Tue, 29 Jan 2013 12:21:36 GMTe4d4http://www.sqlservercentral.com/Forums/Topic1412556-1526-1.aspxThat makes sense. I was wondering about the reencrypt process because an auditor asked me that question so I wanted to give him an answer.Tue, 29 Jan 2013 12:11:23 GMTPHXHowardhttp://www.sqlservercentral.com/Forums/Topic1412556-1526-1.aspx[quote][b]PHXHoward (1/29/2013)[/b][hr]Thank you for the replies. I understand now.How safe is the reencrypt process? Is there data file ever exposed while it is reencrypted?[/quote]Encrypted data in decrypted form are in:- buffer pool- RAM- swap file- and i don't know where elseEncryption is on page level, so probably reencrypt occur as follow: read a page->decrypt->encrypt by a new key->write a pageBut why are you so afraid about encryption process?Tue, 29 Jan 2013 12:03:17 GMTe4d4http://www.sqlservercentral.com/Forums/Topic1412556-1526-1.aspxThank you for the replies. I understand now.How safe is the reencrypt process? Is there data file ever exposed while it is reencrypted?Tue, 29 Jan 2013 11:41:49 GMTPHXHowardhttp://www.sqlservercentral.com/Forums/Topic1412556-1526-1.aspx[quote][b]PHXHoward (1/28/2013)[/b][hr]I'm referring to TDE encryption.When we regenerate the DEK or create a new certificate and encrypt using certificate, does it decrypt/reencrypt the data itself?[/quote]Without decryption how can it change a key?When you regenerate a DEK you can track progress in [b]sys.dm_database_encryption_keys[/b] column encryption_state=4 (Key change in progress), then all data from the DB must be decrypted and encrypted using a new key. eg:[code="sql"]ALTER DATABASE ENCRYPTION KEYREGENERATE WITH ALGORITHM = AES_128;[/code]When you change only the certificate that protect DEK only DEK is decrypted and encrypted by using a new key. DEK keys aren't changed and there is no need to decrypt and encrypt all data in DB[code="sql"]alter DATABASE ENCRYPTION KEYENCRYPTION BY SERVER CERTIFICATE NewCert;[/code]Tue, 29 Jan 2013 02:16:26 GMTe4d4http://www.sqlservercentral.com/Forums/Topic1412556-1526-1.aspxI'm referring to TDE encryption.When we regenerate the DEK or create a new certificate and encrypt using certificate, does it decrypt/reencrypt the data itself?Mon, 28 Jan 2013 14:37:04 GMTPHXHowardhttp://www.sqlservercentral.com/Forums/Topic1412556-1526-1.aspx[quote][b]PHXHoward (1/28/2013)[/b][hr]Hi everyone.At what point does the actual data get reencrypted by SQL Server? Does it happen when I regenerate a database encryption key or when a new certificate is created and associated with an encrypted database?[/quote]Are you talking about Transparent Data Encryption (TDE) or cell encryption with crtificates and keys?[quote][b]PHXHoward (1/28/2013)[/b][hr]When the data itself is reencrypted, is there a security issue during the decrypt/reencrypt process?None of the Microsoft documents seem to address this.Thanks much.[/quote]I don't know about any issue but you should rember that when you have debug permission on OS level and none permission to SQL server you can read encrypted data from memory...and do many more things ;)Mon, 28 Jan 2013 14:27:42 GMTe4d4http://www.sqlservercentral.com/Forums/Topic1412556-1526-1.aspxHi everyone.At what point does the actual data get reencrypted by SQL Server? Does it happen when I regenerate a database encryption key or when a new certificate is created and associated with an encrypted database?When the data itself is reencrypted, is there a security issue during the decrypt/reencrypt process?None of the Microsoft documents seem to address this.Thanks much.Mon, 28 Jan 2013 10:46:15 GMTPHXHoward