1

We have a handful of MSSQL databases encrypted using Transparent Data Encryption (TDE) without an HSM. So the current chain is:

 Service Master Key (SMK) ->
  Master Key (DMK) ->
   Certificate encrypted by DMK ->
    User Database - Data Encryption Key (DEK)

The databases are encrypted using the same certificate. Is there a possible migration path to utilizing an HSM without having to re-encrypt all of the databases?
(there is around 100TB of data, so I am trying to avoid re-encryption if at all possible)

1 Answer 1

0

You can switch to an HSM key very easily by simply re-encrypting the DEK using an asymmetric key from the HSM:

I won't get into all the details of setting up an HSM, except for the final two items:

First, make sure you have your HSM asymmetric key set up:

CREATE ASYMMETRIC KEY TDE_KEY
    FROM PROVIDER AzureKeyVault_EKM_Prov WITH
    PROVIDER_KEY_NAME = 'MySQLRSAKey', -- The name of the asymmetric key in Azure Key Vault
    CREATION_DISPOSITION = OPEN_EXISTING -- To indicate that this is an existing key in Azure Key Vault

Second, re-encrypt your DEK with the asymmetric key you just set up:

USE [MyDatabase]
ALTER DATABASE ENCRYPTION KEY ENCRYPTION BY SERVER ASYMMETRIC KEY TDE_KEY

That's it! If you ever have to switch back to non-HSM mode (i.e. a certificate):

USE [MyDatabase]
ALTER DATABASE ENCRYPTION KEY ENCRYPTION BY SERVER CERTIFICATE MyEncryptionCertificate

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.