Tag Info

Hot answers tagged

7

The problem with cell level encryption is that the column itself isn't really encrypted, it's the data contained in that column. The columns themselves are just varbinary columns (because that's what's required) and could contain completely legible data. It's the use of the ENCRYPTBY* and DECRYPTBY* functions that truly make the data encrypted. You can ...


5

As a rule of thumb: If your data is well structured, well known (in advance) and of a limited size per entry (no mega BLOBs), relational databases are really good at storing it. Even if you don't use the advanced indexing features. Managing space, especially empty space in data files, is a very hard problem to solve. Relational databases have been dealing ...


4

Assuming you are talking about data that is encrypted with SQL Server keys, there is way to find these columns. The Key_name() Function will return the name of the key used for the encryption for that particular value and will return NULL if there isn't anything encrypted with a "known" key (3rd party, or simple not encrypted). With that knowlegde we can ...


4

When you restore a database, TRUSTWORTHY is automatically set to OFF. For Service Broker, if you don't use encryption and do use cross-database message transmission, TRUSTWORTHY needs to be set to ON. Try ALTER DATABASE MyDB SET TRUSTWORTHY ON ...for all restored databases involved with Broker.


3

Yes. Transparent Data Encryption doesn't change any of the internal processing of queries. Database pages are transparently encrypted/decrypted during I/O (i.e. when they are read from or written to disk). In-memory query processing is therefore unaffected, so indexes continue to function exactly as they did without TDE. TDE is designed to negate the need ...


3

Depending on your security restrictions you could: use cell-level encryption (basically column-level encryption), which decrypts the data once it hits the buffer pool; it's available in all SQL Server versions, including Express encrypt/decrypt data in your own application, so unencrypted data is never present in the database server's memory


3

PostgreSQL doesn't currently support DB-level encryption. (Correct as of 9.4, at least). You can use an encrypted file system, though the performance impact can be pretty serious for write-heavy systems, especially those doing random I/O. Your options depend on the operating system - Microsoft BitLocker, Linux's dm-crypt/LUKS/cryptsetup, OS X's FileVault 2, ...


2

There have been no significant enhancements in pgcrypto, and there's no functionality to allow functions to be marked sensitive such that queries that use them don't get logged. That'd fill one security hole and create another anyway. So long as you don't actually store the key in the DB, you're not inherently giving the DB the ability to decrypt the data. ...


2

OK, In case anyone wants to know, I got to the bottom of this. The chain is pretty easy to work out: Create Service Master Key (automatically done upon install) Create Database Master Key (user creates their own key) SymetricEncrypt(Service Key,Database Master Key) -> Store Encrypted Master Key into Master DB Create Certificate ...


2

I primarily use them when I'm moving or copying a database to a new instance of SQL Server. In that case, the DMK in the database will be re-encrypted with the new instance's service master key, but the objects encrypted by the DMK (in your case, the symmetric keys) will not be updated accordingly. You'll need to restore the DMK from a separate backup using ...


1

I got a SaaS product and the data is kinda sensitive. I want to give my customers 100% security on the fact that I can't read their data. If it's software as a service, and you do more than simply store blobs of data then give those blobs back when the customer asks, this is pretty much impossible. You're dreaming. You can't realistically combine SaaS ...


1

If you are receiving the thumbprint error the certificate was not created properly from the Source Server's Cert/Key backups. I found this question which was already answered with a solution for you: Restore encrypted database to another server


1

Microsoft's MSDN blog has a table describing the possible conditions and their outcomes. See Selectively using secure connection to SQL Server to understand client side setting and connection property options impacting secure connections for just the client involved. The server and other clients are not impacted.


1

Service Broker uses encryption by default unless you specify that you don't want to use it when sending the messages. At some point the database master key had to be created unless like I said you were specifying that encryption was off when you send the messages (it might be when you create the conversation, I don't remember). Anyway, when you restored ...


1

There is no built-in solution in SQL Server. A symmetric key that was created without specifying the source and identity can never be scripted or copied. That means, in your case you have to decrypt and re-encrypt on the fly while copying the data. You could also create a new key in the current database (specifying source and identity) and decrypt and ...


1

I like this presentation by Giuseppe Bianchi. Starting on page 5 it contains a desctiption of the TLS protocol - segment size, header size, HMAC overhead. As for the handshake, the impact on replication should be negligible. It will only occur on connection, and there may be a key exchange going on every hour, depending on the configuration. As for the ...


1

You need to use the condition that works. The reason is easy to demonstrate. Run this: DECLARE @x VARBINARY(8000) = ENCRYPTBYPASSPHRASE('12','YYY'); SELECT @x, CONVERT(VARCHAR(32), DECRYPTBYPASSPHRASE('12', @x)); GO 5 Do you see the same result every time? No. This is because the encryption adds some magic to prevent predictable results (that is grossly ...


1

Unless you've done 'something' to encrypt the connection it is in the clear. And if you want to encrypt this communication using an Oracle solution, you must be using the Enterprise Edition and you must purchase the Advanced Security addon. If you the free way of doing this, use Stunnel https://www.stunnel.org/index.html Amazingly enough, Stunnel and ...


1

There isn't enough information in the question to make an informed decision, but here are some basic points. If you want more detail, please explain more about how the data is going to be queried and how large is it expected to grow, and how large are encrypted segments supposed to be and so on. So, in general - regardless of what else is decided, I ...



Only top voted, non community-wiki answers of a minimum length are eligible