|
|
|
SSC Veteran
      
Group: General Forum Members
Last Login: Wednesday, May 22, 2013 2:09 PM
Points: 265,
Visits: 636
|
|
|
|
|
|
SSC Veteran
      
Group: General Forum Members
Last Login: Sunday, August 12, 2012 1:38 AM
Points: 284,
Visits: 493
|
|
Excellent article! While I haven't tested any of the scripts mentioned, it does provide a solid background to this subject (one that I didn't get the chance to experience yet...). I learned a lot.
|
|
|
|
|
SSC Journeyman
      
Group: General Forum Members
Last Login: Monday, June 21, 2010 6:23 AM
Points: 77,
Visits: 14
|
|
Concept is good, I have tested its working. Need to explore for implementation
|
|
|
|
|
SSCommitted
      
Group: General Forum Members
Last Login: Thursday, May 02, 2013 1:12 AM
Points: 1,584,
Visits: 379
|
|
Nice article. Especially like the tip about the cost of opening the symmetric key. Not something I'd thought of before.
Dan www.firstcs.co.uk
|
|
|
|
|
Forum Newbie
      
Group: General Forum Members
Last Login: Wednesday, August 29, 2007 1:32 PM
Points: 1,
Visits: 1
|
|
Execllent article, and I like the mindset of trying to take a simple approach. Too many time complex approaches result in failed implementations or complications. Thanks.
|
|
|
|
|
SSC Veteran
      
Group: General Forum Members
Last Login: Tuesday, September 04, 2012 2:04 AM
Points: 263,
Visits: 324
|
|
| Greate article on what I need to know as a DBA without getting bogged down in the details. This is a departure from most things that I have read about encryption! Thanks.
|
|
|
|
|
SSCertifiable
       
Group: General Forum Members
Last Login: Tuesday, May 14, 2013 4:39 PM
Points: 6,260,
Visits: 1,977
|
|
Clear, Simple and to the point.
Good Job!
Thanks,
* Noel
|
|
|
|
|
SSC-Enthusiastic
      
Group: General Forum Members
Last Login: Tuesday, January 22, 2013 3:15 PM
Points: 107,
Visits: 163
|
|
Mike - great, I did a similar thing a few months back when one of our programmers needed to do an encrypted field for the first time (rot-13 really doesn't cut it) and it was great to see someone with a similar background go through the same exercise.
Off topic:
I notice you were a programmer who ended up doing full time Sybase/SQL Server DBA work. This is my background as well, for the past 5 years I've been working on moving large Sybase DBs to SQL Server - which is a great deal of programming since there really aren't commercial products to do this - which has caused me to assume that most Sybase db's are being left in place, even if the shop ends up doing all new work on SQL Server.
Roger L Reid
|
|
|
|
|
SSC Veteran
      
Group: General Forum Members
Last Login: Wednesday, May 22, 2013 2:09 PM
Points: 265,
Visits: 636
|
|
I'm really glad to see this is being received well. The code snippets got reformatted a little, so I apologize if hard to read; this is my first article & I have lot to learn about publishing in HTML. We just reviewed this with our development team and they made a great suggestion which we've adopted as our standard approach, and that I wish I'd included in the original article: write custom "encrypt" and "decrpyt" UDFs for each encrypted column. These make subsequent coding much simpler, developers don't have to know names of the symmetric key or the certificate, don't have to worry about casting the datatypes, etc. create function dbo.fnEncryptAccountNbr(@AccountNbr varchar(16)) returns varbinary(68) as begin return EncryptByKey(Key_GUID('MyKey'), @AccountNbr); end go create function dbo.fnDecryptAccountNbr(@EncryptedAccountNbr varbinary(68)) returns varchar(16) as begin return convert(varchar(16), DecryptByKeyAutoCert(cert_id('MyCert'), null, @EncryptedAccountNbr)); end go I have only tested this a little bit, but so far don't see any performance hit caused by these UDFs (I've been badly burned by UDF performance--or lack thereof--in SQL2000, am always on guard for that now).
|
|
|
|
|
SSC Veteran
      
Group: General Forum Members
Last Login: Wednesday, May 22, 2013 2:09 PM
Points: 265,
Visits: 636
|
|
Forgot to include this: in addition to the UDFs, we've also decided to use a stored proc to wrap/hide the open symmetric key business. create proc dbo.spOpenSymmKey as --open symm key if not already open set nocount on if not exists(select 1 from sys.openkeys where key_name = 'MySymmKey' and database_name = db_name()) open symmetric key MySymmKey decryption by certificate MyCert; go PS - Would have been cool to embed this functionality in the fnEncryptxxx UDF, but cannot because it causes a "side-effect" and SQL won't let you.
|
|
|
|