0

When a symmetric key is created we have the option to encrypted it by using at least one of the following: certificate, password, symmetric key, asymmetric key or EKM.

When a password is used, it it said that:

When a symmetric key is encrypted with a password instead of a certificate (or another key), the TRIPLE DES encryption algorithm is used to encrypt the password. Because of this, keys that are created with a strong encryption algorithm, such as AES, are themselves secured by a weaker algorithm.

So, using password is not best way to protect it. I was not able to find any pros and cons for using the other techniques.

Can anyone tell is there are difference from security or performance matter or it is just a matter of choice?

  • Tangencial but if you have concerns someone cracking your passwords you will get a lot more secure option by using an asymetric "encryption" (salted slow hash) but I don't think SQL implemented slow hashes yet – jean Mar 19 '18 at 16:48
1

As you show in your question, the Microsoft Docs say:

When a symmetric key is encrypted with a password instead of a certificate (or another key), the TRIPLE DES encryption algorithm is used to encrypt the password. Because of this, keys that are created with a strong encryption algorithm, such as AES, are themselves secured by a weaker algorithm.

This is a simple warning that a key protected by a password is weaker than the same key protected by a certificate.

So, in order to compromise the symmetric key, you need to know the password. An attacker might obtain the password by cracking the 3-DES encryption; they would then have access to symmetric key, and by extension everything that is protected by that key.

The take-away is, don't use a password to protect a key if the data protected by the key is valuable. Use a certificate to encrypt the symmetric key.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.