1)
CREATE SYMMETRIC KEY SecureSymmetricKey
WITH ALGORITHM = DESX
ENCRYPTION BY PASSWORD = N'StrongPassword';
I'm trying to figure out about the sql Server encryption.
- once ive executed the code above , is there any way to find out later what is the passowrd value for the
SecureSymmetricKey?
2)
If now im doing this with Certificates :
Im ( the admin) created
CREATE MASTER KEY ENCRYPTION
BY PASSWORD = 'DB Master key password!'
GO
only I know the password.
later I :
CREATE CERTIFICATE MyCertificate
WITH SUBJECT = 'My Certificate Subject'
CREATE SYMMETRIC KEY MySymetricKey
WITH ALGORITHM = TRIPLE_DES ENCRYPTION
BY CERTIFICATE MyCertificate
until now , Its all ok.
now , When a hacker comes to the computer , all he have to do is :
OPEN SYMMETRIC KEY MySymetricKey DECRYPTION
BY CERTIFICATE MyCertificate
and then :
SELECT
convert( NVARCHAR(max), decryptbykey(namePAss))
FROM tbl1
so where is the protection in certificates ? no one asked him for a password ( like in password encryption (as in my first question)...?he only needed to know the certificate name
OPEN SYMMETRIC KEY MySymetricKey DECRYPTION BY CERTIFICATE MyCertificate
and its not a problem to find out what is the certificate name ...So where is the protedtion in decypher data from the Hacker ?
3)
When im using
CREATE SYMMETRIC KEY SecureSymmetricKey
WITH ALGORITHM = DESX
ENCRYPTION BY PASSWORD = N'StrongPassword';
DECLARE @str NVARCHAR(100)
SET @str = 'lala';
OPEN SYMMETRIC KEY SecureSymmetricKey
DECRYPTION BY PASSWORD = N'StrongPassword';
Whom itrying to protect the data from ? the data being sent from client to server ? ( the data is being sent by plaing text - i cant activate sql commands before sending the data...) or people who has access to the sql server?
