Tag Info

Hot answers tagged

4

When you encrypt the first database in the instance, tempdb will also be encrypted. As per this reference on TDE: Transparent Data Encryption and the tempdb System Database The tempdb system database will be encrypted if any other database on the instance of SQL Server is encrypted by using TDE. This will be the case when you set ENCRYPTION ON ...


4

Since TDE relies on a certificate stored in master (which is used to encrypt the database encryption key), then this would work only work if you could restore the master database to another server in such a way that the certificate could be decrypted. This is the TDE encryption hierarchy: Service master key (protected by Windows; tied to the service ...


3

Yes. Transparent Data Encryption doesn't change any of the internal processing of queries. Database pages are transparently encrypted/decrypted during I/O (i.e. when they are read from or written to disk). In-memory query processing is therefore unaffected, so indexes continue to function exactly as they did without TDE. TDE is designed to negate the need ...


2

1.If you want to restore a encrypted backup to another server as usual you encounter the following error Cannot find server certificate with thumbprint …... 2.Find the cert name : in this example vestacert SELECT * FROM sys.certificates 3.backup the cert from source server (Source encryptedserver) : BACKUP CERTIFICATE vestacert TO FILE = ...


2

Is there a way to decrypt TDE log files on disk for use with 3rd party software? The short answer is -- this cannot be done. Encryption of the database file is performed at the page level. The pages in an encrypted database are encrypted before they are written to disk and decrypted when read into memory. TDE does not increase the size of the encrypted ...


2

From my knowledge, you cannot have multiple encryption database encryption keys as the Server stores a Server Master key automatically when SQL Server is first installed. It will use this for decryption (among other things) of database keys. When you have created a database key (which is implicit) it will store a copy in the Master db, if you issue another ...


2

In the absence of any other input, here's what I was able to deduce. Short story: this appears to work fine. As far as I can see, enabling TDE for a database is a logged operation, but the actual data encryption is not logged (otherwise the transaction log would grow considerably, which it doesn't). I assume there's something like the differential change ...


2

If you are talking about the SQL service master key, then there is a rare occurrence where you really need to restore it. I'm thinking of a couple of scenarios where you need to restore the SMK... Somehow it got corrupted. You are rebuilding your SQL server and planning to restore every database including system databases from backup. Usually in ...


2

Yup, I have 2 clusters with TDE in both SQL 2008 R1 and SQL 2012 and nothing special was required. The master key is encrypted by the Windows DPAPl (I think that's the right acryonym) service, but then the generated key is in the Master DB that gets moved between nodes as you stated.


1

When you are moving a TDE database to a new instance, what you need to ensure is that the proper certificate (or asymmetric key) is also in the destination master's database. If you fail to do this, you'll receive the following error: Msg 33111, Level 16, State 3, Line 2 Cannot find server certificate with thumbprint ...



Only top voted, non community-wiki answers of a minimum length are eligible