Hot answers tagged encryption
7
Q1a: Is the master key password created per DB instance?
A1a: Assuming the question really means "Is the master key created per DB?"" then answer is Yes. Each DB has an different master key. there is also a thing called the service master key, which is per SQL Server instance.
Q1b: When I backup that DB (.bak) will I be able to restore the DB to
...
5
Why would you want to do this? What risk does it mitigate?
This sounds like a great way to lock yourself out of your database in a way that requires downtime to recover. Limit your exposure by securing the servers with firewalls and SSH and keep MySQL authentication simple. If you are worried about brute force attacks from within your trusted network, ...
4
Great question! There's a handful of
ways of doing this, depending on how deeply you want to be involved in
the configuration and long term maintenance. You certainly could use
Cassandra on top of an encrypted filesystem, such as TrueCrypt or
eCryptfs, and it should function normally.
While possible, it's a little complicated to set up encrypted
filesystem ...
4
General guidelines:
Server physical security: behind a locked door, with a very short list of people able to access it (as a point of interest, I myself can't access our server room without being escorted).
Backup security: Make sure your backups are encrypted (if you use physical media for backups, make sure they're stored with a similar level of security ...
4
This article on msdn indicates it's a new feature in SQL Server 2008. To me that means it's not available in 2005.
There are a lot of resources available with step-by-step guides for other data encryption types in 2005, though. I think it's probably beyond the scope of a question on a Q&A site, however.
3
\df *crypt in psql reveals the argument types of the pgcrypto encrypt and decrypt functions (as do the PgCrypto docs):
List of functions
Schema | Name | Result data type | Argument data types | Type
--------+-----------------+------------------+--------------------------+--------
...
public | decrypt ...
3
I'm not sure about pgPool, but pgBouncer (another connection pool) can use SSL by using Stunnel.
Check your functional requirements to see if pgBouncer can solve your problem. Maybe pgPool can also use Stunnel, you could give it a try.
3
Encrypting files through SSIS is possible, but there is no real easy native solution available with SSIS. There are a wealth of third party productions out there than can assist with this. Time is money, so it all depends on how much you want to spend on trying to come up with a customized solution or just go buy something that can help you do it quicker.
...
3
TDE is a new feature in SQL Server 2008. You can do column level encryption of the data within the database or in the application tier but that's about it.
What's the goal of the encryption? Protecting data in the database? Protecting data in the data file? Protecting data in the backup files? Etc?
3
Usually, you don't want to do this. Have you given second thoughts to this?
Else, pg_crypto is your friend. But as the above-mentioned slides suggest, it isn't necessarily a panacea.
3
Things that come to my mind:
use the contrib module pgcrypto to encrypt the column contents manually (will require a change to your application)
Store the data on an encrypted volume/partition (this can be done on table level using tablespaces that are located on the encrypted volume)
3
I think what you are referring to is cell-level encryption, but using this feature requires changing the application. TDE (transparent database encryption) is another option, this encrypts the files on the disk, but they are decrypted in-memory, so anyone with direct access to the machine and sufficient privileges to look into the block buffer cache directly ...
3
Since TDE relies on a certificate stored in master (which is used to encrypt the database encryption key), then this would work only work if you could restore the master database to another server in such a way that the certificate could be decrypted.
This is the TDE encryption hierarchy:
Service master key (protected by Windows; tied to the service ...
3
Yes, it is normal. The certificates and keys are part of you database.
CREATE CERTIFICATE my_certificate
ENCRYPTION BY PASSWORD = 'blahblah' ...;
CREATE SYMMETRIC KEY my_symmetric_key
... ENCRYPTION BY CERTIFICATE my_certificate;
Your posted code creates a symmetric key encrypted with a certificate encrypted with a password. The master key is not involve ...
3
The specific permissions required are:
GRANT CONTROL ON CERTIFICATE :: [cert] TO [user]
GRANT VIEW DEFINITION ON SYMMETRIC KEY :: [key] TO [user]
However, rather than grant permissions directly on the Certificate and Key, I like to have two stored procedures - one for encryption and one for decryption. We generally have different users that perform the ...
3
No. Scalar operators cannot magically transform themselves into relational operators. You use the ENCRYPTBYPASSPHRASE to encrypt a column (there is no way to 'encrypt a table') and you use DECRYPTBYPASSPHRASE to decrypt a column.
Using passphrases to encrypt the data directly is a very very poor choice. A proper key hierarchy is needed where data is ...
2
Yes, it's very possible to accomplish that but not with a unique query!
First, you need to know where to look for metadata: This kind of information is stored into an internal mysql database called information_schema, this database in used only internally by Mysql every time you execute any kind of query involving any database entities. There you will find ...
2
Have a look at PostgreSQL, it has unlimited database size, what appears to be many options for encryption, support for full text search and interfaces for several languages (C as well via libpg). It is also open source. See the about-page for PostgreSQL for more info.
2
I think that your problem can be solved with the MS framework called "Trust Services".
Buck Woody explains in this article how you can use it to solve problems of encrypted data with SQL Azure. From his article, a short description about how to use Trust Services:
"With the new Trust Services service, the basic process is that you
use a Portal to ...
2
The sequence of steps is entirely depended on you current (old db) encryption hierarchy. There is no cookie-cutter recipe that can be applied w/o knowing your encryption hierarchy, which you did not present. It cannot be deduce from the code you posted, steps like creating a new certificate after the database copy is attached make not much sense. Normally ...
2
Note that I am not a crypto systems or security expert. This is what I've seen done and it makes sense, but I cannot claim it doesn't have security issues beyond what I outline below. As always, get a proper security audit if it's important.
In the following, "credential" can refer to ssh keys, passwords, or whatever needs storing.
The typical model is to ...
1
You could make use of native MySQL encryption and require each user accessing the web app to also provide the encryption key along with his user credentials
http://dev.mysql.com/doc/refman/5.1/en/encryption-functions.html#function_aes-encrypt
Without the correct encryption key, stored data could be accessed.
That would allow you to protect your web app ...
1
If you are talking about SQL service master key, then there is a rare chance when you really need to restore the same.
I am thinking of couple of scenarios where you need to restore SMK......
1)Somehow it got corrupted.
2)You are rebuilding your SQL server and planning to restore every database including system databases from backup.Usually in this case also ...
1
When you are moving a TDE database to a new instance, what you need to ensure is that the proper certificate (or asymmetric key) is also in the destination master's database. If you fail to do this, you'll receive the following error:
Msg 33111, Level 16, State 3, Line 2
Cannot find server certificate with thumbprint ...
1
Short answer: as of April 20, 2012 column encryption is not supported in SQL Azure, see: http://msdn.microsoft.com/en-us/library/windowsazure/ee336253.aspx and search for ENCRYPT. You will see that all of the encryption functions are listed as unsupported.
If you need to encrypt your data at rest and have to support SQL Azure then you are going to have to ...
1
Requirement 2 requires the data be stored "normally": that is, you can't use encryption in the client for all data. Encrypting data in the client also contradicts requirement 1
Requirement 3 requires the media or the actual backups are encrypted. Encrypting the HDDs isn't reliable because once someone has the actual media then it can normally be unencrypted ...
1
The typical choice for embedded databases is SQLite. It does contain FT extensions (which allow to FT index documents outside the DB, not the DB itself) and 3rd parties provide extensions like SQLite Encryption. But in the end SQLite has no goal of matching the capabilities of a full fledged standalone database. MySQL has a en embedded option but is ...
1
To use SSL for encrypting the transfer of the binary log required during replication, both the master and the slave must support SSL network connections. If either host does not support SSL connections (because it has not been compiled or configured for SSL), replication through an SSL connection is not possible.
Setting up replication using an SSL ...
1
As per books online
"The is_master_key_encrypted_by_server column of the sys.databases catalog view in master indicates whether the database master key is encrypted by the service master key."
Here is the link http://technet.microsoft.com/en-us/library/ms174382.aspx
Only top voted, non community-wiki answers of a minimum length are eligible
