1

In sqlservercentral blog I've encountered this phrase

Symmetric keys are deterministic when created, meaning that the same parameters run in different databases will result in the same key. That means that the same key in a different database (or instance) can decrypt data that was encrypted in your production instance. Keep control of the parameters used to create symmetric keys and secure them. That means watch out for storage of these items in source control, in installation files, upgrade scripts, etc.

I can't understand what it tries to say. Symmetric keys are protected by DMKs, so how can they be the same on different instances?

Thanks.

Improve this question

1 Answer 1

Reset to default
2

It's saying that it is possible to have different servers with the same symmetric key values generated. This may or may not be desirable per the business. For example, you can create your own symmetric keys that match.

The DMK just protects the symmetric key by encrypting it, however once decrypted the actual key portion could be the same. This can be desirable as symmetric keys have no backup/restore mechanism on their own.

Improve this answer
3
  • thanks for the helpful answer. Is this also true for asymmetric keys? @SeanGallardy
    – igelr
    Commented Jul 22, 2019 at 11:54
  • @ElGrig No, you have full backup/restore capabilities with asymmetric keys and thus backup/restore is the proper way to handle those.
    – Sean Gallardy
    Commented Jul 22, 2019 at 12:30
  • Fine. Thanks very much for your help! Your answers are really helpful @seangallardy
    – igelr
    Commented Jul 22, 2019 at 13:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.