We use an external HSM device to create and store keys and use it for TDE. Our auditors are asking questions about where the keys are store. So obviously the key is stored in the external HSM device.
In this link, under step 5,
USE master ; GO CREATE ASYMMETRIC KEY ekm_login_key FROM PROVIDER [EKM_Prov] WITH ALGORITHM = RSA_512, PROVIDER_KEY_NAME = 'SQL_Server_Key' ; GO
- Does this create a copy of the key in master DB also?
- In case of TDE, how often does SQL Server has to contact the EKM device? Does it have to contact the ekm device veytime while reading data file from disk?