Here are the requirements:

Key-encrypting keys are stored separately from data-encrypting keys. ( Certificate and the symmetric key should be stored separately – not within the same database)

I am using certificate based encryption so I made the certificate on the database I'll be using. How do I access a certificate from a different database?

  • What DBMS is this about?
    – mustaccio
    Feb 4, 2018 at 18:35

1 Answer 1


In SQL Server for column encryption, you typically use the Service Master Key to encrypt your Database Master Key, which, in turn, encrypts your Certificate, which encrypts your Symmetric Key, which encrypts your data.

See https://learn.microsoft.com/en-us/sql/relational-databases/security/encryption/encryption-hierarchy

For Transparent Database Encryption the hierarchy is a little different. The Database Encryption Key in your database is encrypted by the Database Master Key in the Master Database.


In both cases the key used to encrypt/decrypt data is protected by an encryption chain that goes through the Master database. I think both meet your requirement in effect.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.