Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've been reading multiple resources on SQL Server Encryption, and everyone does it basically the same way, but no one explains why we use asymmetric keys in SQL Server. And by this I mean when we follow "proper" procedure and encrypt data symmetrically first, followed by an asymmetric key or certificate as in this MSDN heirarchy:

enter image description here

So if I have data, first I encrypt it with a symmetric key for speed and avoidance of re-encryption if compromised. We then secure that key with a second-tier of encryption.

Now lets assume I secure the second key with a password. What advantage does a Certificate, Asymmetric Key, or Symmetric Key have in this scenario? It seems to me we never utilize the public aspect of a Certificate or Asymmetric key using this strategy since we are only using the decryption aspect. So shouldn't be be agnostic to which of the three methods we choose? We can revoke access to all three key types and grant permissions to use all three keys. Why not use another symmetric key?

The only difference I see here is that you can protect a Cert or Asym key with the DMK so users need not enter a password. This makes access easier at the expense of losing the security of forcing users to enter that second password.

Is this a correct understanding?

share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.