I have been validating the encryption/decryption stuff particularly the 3des and have run into a decryption issue that might be a bug/feature but I couldn't find anything in the docs about it.  When you create a new master key all decryption using any previous local key that uses the older master key fails.  Is there an implied limit of only having one master key in the table?

In looking into this I noticed that the fn_decrypt_des stored proc is missing a tie in the WHERE clause to the master key itself.  I changed the WHERE clause from this:

  WHERE l.[name] = @localkeyname

To this:

  WHERE l.[name] = @localkeyname and m.[Name] = l.[Master_Key_Name]

thinking it would solve the issue but even passing the proper master key to the extended stored procs doesn't allow for decryption.

-Ben