Tag Info

Hot answers tagged

14

Your problem boils down to access control. The first defense I'd propose is to simply deny access to the untrusted users. If they can't get into the database, they can't query the database and get at the sensitive data. If they must be allowed to access the database server, you can look at either explicitly granting them read permission to the tables they ...


7

The problem with cell level encryption is that the column itself isn't really encrypted, it's the data contained in that column. The columns themselves are just varbinary columns (because that's what's required) and could contain completely legible data. It's the use of the ENCRYPTBY* and DECRYPTBY* functions that truly make the data encrypted. You can ...


6

The only way to use encryption to protect the data against your own administrators/IT is when the user enters the decryption password him/herself, every time it queries the data. If your application presents the user with a password dialog and then issues an OPEN SYMMETRIC KEY ... DECRYPTION BY CERTIFICATE ... WTIHT PASSWORD ... (or some equivalent) to open ...


5

No, this is not true, and there is an easy proof. On one server, create a database, and store some data using ENCRYPTBYPASSPHRASE(): CREATE DATABASE blat; GO USE blat; GO CREATE TABLE dbo.mort(floob INT, splunge VARBINARY(64)); GO INSERT dbo.mort VALUES (1, ENCRYPTBYPASSPHRASE(N'kerplunk', N'secret')), (2, ENCRYPTBYPASSPHRASE(N'kerplunk', N'hidden')); ...


5

As a rule of thumb: If your data is well structured, well known (in advance) and of a limited size per entry (no mega BLOBs), relational databases are really good at storing it. Even if you don't use the advanced indexing features. Managing space, especially empty space in data files, is a very hard problem to solve. Relational databases have been dealing ...


4

When you encrypt the first database in the instance, tempdb will also be encrypted. As per this reference on TDE: Transparent Data Encryption and the tempdb System Database The tempdb system database will be encrypted if any other database on the instance of SQL Server is encrypted by using TDE. This will be the case when you set ENCRYPTION ON ...


3

Look at the encryption hierarchy found in this TechNet article. This document from MS shows the entire hierarchy. You can see that the Master Key is created from the Windows DPAPI service and is used for: -DB Master Key -Certificates -Symmetric Keys -Asymmetric Keys -TDE -Transact SQL Encryption Functions -Passwords (I'm not 100% on this, but it ...


2

My guess is that you would want to use an Oracle wallet so that you don't need to embed the username and password in your application at all. Depending on the architecture of your application, there may be other options as well-- if you're building a Java application that is deployed to an application server, for example, most application servers have a way ...


2

I was able to move the Java code to Oracle. I am writing this for people who are facing similar issue. Log on to server where Oracle database is installed through Putty (command prompt in case of windows) Place the Java file in server using WinSCP. Find the Java compiler present in oracle home using command find / -name javac Compile the Java file using ...


2

The MySQL documentation Encryption and Compression Functions page has various functions that can be used for hashing passwords. It also clearly states that: Note The PASSWORD() function is used by the authentication system in MySQL Server; you should not use it in your own applications. For that purpose, consider MD5() or SHA2() instead. Also see ...


2

If you create keys without a certificate like: CREATE SYMMETRIC KEY smTestKey WITH ALGORITHM=AES_256 , IDENTITY_VALUE = 'Key to protect bla' , Key_SOURCE = N'Secret pass phrase' ENCRYPTION BY PASSWORD = 'secret password'; then the following is enough: GRANT ALTER ANY SYMMETRIC KEY TO dbuser If you create symmetric keys that's encrypted by a ...


2

Assuming you are talking about data that is encrypted with SQL Server keys, there is way to find these columns. The Key_name() Function will return the name of the key used for the encryption for that particular value and will return NULL if there isn't anything encrypted with a "known" key (3rd party, or simple not encrypted). With that knowlegde we can ...


2

There have been no significant enhancements in pgcrypto, and there's no functionality to allow functions to be marked sensitive such that queries that use them don't get logged. That'd fill one security hole and create another anyway. So long as you don't actually store the key in the DB, you're not inherently giving the DB the ability to decrypt the data. ...


1

I like this presentation by Giuseppe Bianchi. Starting on page 5 it contains a desctiption of the TLS protocol - segment size, header size, HMAC overhead. As for the handshake, the impact on replication should be negligible. It will only occur on connection, and there may be a key exchange going on every hour, depending on the configuration. As for the ...


1

You need to use the condition that works. The reason is easy to demonstrate. Run this: DECLARE @x VARBINARY(8000) = ENCRYPTBYPASSPHRASE('12','YYY'); SELECT @x, CONVERT(VARCHAR(32), DECRYPTBYPASSPHRASE('12', @x)); GO 5 Do you see the same result every time? No. This is because the encryption adds some magic to prevent predictable results (that is grossly ...


1

There isn't enough information in the question to make an informed decision, but here are some basic points. If you want more detail, please explain more about how the data is going to be queried and how large is it expected to grow, and how large are encrypted segments supposed to be and so on. So, in general - regardless of what else is decided, I ...


1

Based on my, potentially flawed, understanding from Steve Jones's session The Encryption Primer the important concept is that we use keys to protect other keys and a lot of this is mathematical matryoshka dolls. The article linked by @Ali Razeghi has an excellent picture showing the layers. Slide 30 of Steve's presentation also has a pretty picture. The ...


1

1.If you want to restore a encrypted backup to another server as usual you encounter the following error Cannot find server certificate with thumbprint …... 2.Find the cert name : in this example vestacert SELECT * FROM sys.certificates 3.backup the cert from source server (Source encryptedserver) : BACKUP CERTIFICATE vestacert TO FILE = ...



Only top voted, non community-wiki answers of a minimum length are eligible