1

In sqlservercentral blog I've encountered this phrase

Symmetric keys are deterministic when created, meaning that the same parameters run in different databases will result in the same key. That means that the same key in a different database (or instance) can decrypt data that was encrypted in your production instance. Keep control of the parameters used to create symmetric keys and secure them. That means watch out for storage of these items in source control, in installation files, upgrade scripts, etc.

I can't understand what it tries to say. Symmetric keys are protected by DMKs, so how can they be the same on different instances?

Thanks.

2

It's saying that it is possible to have different servers with the same symmetric key values generated. This may or may not be desirable per the business. For example, you can create your own symmetric keys that match.

The DMK just protects the symmetric key by encrypting it, however once decrypted the actual key portion could be the same. This can be desirable as symmetric keys have no backup/restore mechanism on their own.

3
  • thanks for the helpful answer. Is this also true for asymmetric keys? @SeanGallardy – igelr Jul 22 '19 at 11:54
  • @ElGrig No, you have full backup/restore capabilities with asymmetric keys and thus backup/restore is the proper way to handle those. – Sean Gallardy - Retired User Jul 22 '19 at 12:30
  • Fine. Thanks very much for your help! Your answers are really helpful @seangallardy – igelr Jul 22 '19 at 13:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.