Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [transparent-data-encryption]

Transparent Data Encryption, a feature used to provide protection for data at rest.

0
votes
1answer
247 views

Is it (always) necessary to backup a certificate with private key?

I'm starting a project to encrypt database files. I've created a master key and a certificate the following way: USE master; GO CREATE MASTER KEY ENCRYPTION BY PASSWORD = 'Master_K3y'; GO CREATE ...
6
votes
2answers
2k views

TDE on replicated databases

I have implemented Master-Slave replication between two databases. Now I have to implement Transparent Data Encryption (TDE) on the master database. Is it possible to implement TDE in the master ...
0
votes
2answers
4k views

Protect SQL Server Express data file

I need to protect a Microsoft SQL Server 2008 data file (.mdf) against restoring/attaching on another machine. I'm aware of TDE or Transparent Data Encryption but unfortunately this option is not ...
2
votes
3answers
532 views

What do I need to restore an encrypted MSSQL database?

I am trying to get my head around MSSQL TDE encryption. I have followed these steps to encrypt a database: 1) Create a master key on the master database: USE master GO CREATE MASTER KEY ENCRYPTION ...
1
vote
1answer
534 views

How can I prevent our IT admins with sysadmin to read data stored inside an encrypted database? [closed]

I built a web application that stores sensitive data into a SQL Enterprise 2014 database with TDE encryption. My key is safe; I know if someone steals the database file from disk the data is protected....
3
votes
1answer
2k views

Microsoft SQL Server 2016 Service Pack 1 (SP1) support for TDE (transparent data encryption)

Does Microsoft SQL Server 2016 Service Pack 1 add support for TDE (Transparent Data Encryption) to Standard Edition as well? As per What's new in Database Engine - SQL Server 2016 and A Big Deal : ...
1
vote
1answer
251 views

Backup errors after TDE certificate expired and new cert was created with AlwaysOn

I have 2 databases in AlwaysOn with TDE enabled. My TDE cert expired and i created a new one but Ola's Backup script is still failing: EXECUTE [dbo].[DatabaseBackup] @Databases = 'DB1, DB2', @...
1
vote
0answers
21 views

Do any databases other than SAP ASE support key custodians?

SAP Sybase ASE supports the notion of a key custodian. This allows for a setup where the trust can be split between two roles: the database administrator and a key custodian. The database ...
13
votes
1answer
514 views

Backup Compression Causing Corruption In SQL 2017 TDE Database

On SQL Server 2017 (CU3), whenever I enable backup compression on one of my TDE databases, the backup process always corrupts a specific page in the database. If I run the backup without compression, ...
4
votes
3answers
4k views

Open source & cheap 'data at rest' encryption solutions

So I am exploring some options about database encryption. The best options are commercial (TDE). I am looking for an open-source implementation. Recent releases of MySQL and MariaDB have data-at-rest ...
4
votes
1answer
396 views

Backup Failure on SQL TDE Database with Maxtransfersize Specified for Compression

Recently, my company has upgraded to 2016 and enabled TDE on all of our databases. Additionally, we have the production databases replicated on high availability servers. Our backups are taken from ...
10
votes
3answers
678 views

Unable to restore TDE enabled database when MAXTRANSFERSIZE and CHECKSUM is used

Update: @AmitBanerjee - Senior Program Manager for the Microsoft SQL Server Product Group confirmed that MS will look into the issue as it is a defect. Has anyone encountered issue restoring backups ...
4
votes
1answer
904 views

TDE Encryption on database tripled size of backup files

After enabling TDE Encryption my database backup file .bak is 3x larger than before. Is there a way to improve this? Is this due to compression not being as efficient on an encrypted file?
3
votes
1answer
1k views

TDE cannot encrypt database

In order to encrypt a SQL db, I run the following commands: CREATE CERTIFICATE <certname> ENCRYPTION BY PASSWORD = '<UseStrongPasswordHere>' WITH SUBJECT = 'certificate subject', ...
5
votes
1answer
117 views

Swapping TDE Cert Slow, any way to improve performance?

Fair warning, I am very new to encryption with DBs. Right now we use the following statement to swap certificates when in the process backing/restoring DBs between servers: ALTER DATABASE ENCRYPTION ...
1
vote
0answers
467 views

How to shrink transaction log for a database that was previously in AlwaysOn Availability Group?

I need to move databases having TDE enabled to another instance and re-enable the TDE with a different certificate. Generally, this would not be a problem but I seem to have problems if the databases ...
2
votes
1answer
171 views

TDE Performance and Cost Threshold for Parallelism

Is there any documentation, test data, or other evidence to suggest that the Cost Threshold for Parallelism (CTP) setting might impact performance when TDE is enabled on a database? Without going ...
9
votes
2answers
335 views

Is network traffic encrypted when writing remote backups using SQL Server TDE?

They do say there is no such thing as a “stupid question”, so here goes: I understand that SQL Server Transparent Data Encryption (TDE) encrypts data at rest, so that your database files (.mdf) and ...
1
vote
1answer
57 views

encrypting live data in SQL Azure

We are using webjob in azure which imports data every 2 hours into the tables I've created in the cloud. As I read it from here, I can encrypt the db very easily using azure TDE feature. But I am ...
2
votes
1answer
432 views

TDE Change Encryption Key - Is it safe?

We use SQL Server 2012 Enterprise Edition and Transparent Data Encryption (TDE). Microsoft have a command to let you change the encryption on the database "ALTER DATABASE ENCRYPTION KEY". The docs ...
39
votes
2answers
18k views

In SQL Server 2016, what is the difference between Always Encrypted and Transparent Data Encryption?

As I write this I am still awaiting the official release of SQL Server 2016 so that we can explore the usefulness of its "Always Encrypted" feature. I would just like to know what the specific ...
2
votes
3answers
236 views

Deploying transparent data encryption

I have an installation of SQL 2016 Enterprise and my boss want to deploy TDE. I googled online and all the instruction said about "you can use a self sign certificate for test/dev purpose". Most ...
13
votes
3answers
2k views

When do I need to backup the Service Master Key?

I'm reading some documentation and whitepaper about Transparent Data Encryption. Some documentation mention to backup the Service Master Key as well (For clarification I'm not talking about the ...
7
votes
1answer
5k views

Set “Encryption Enabled” to FALSE…what can go wrong?

I'm migrating a database from SQL Server 2012 to SQL Server 2014 on the same server. I'm configuring LOG SHIPPING on a database that is apparently encrypted: When setting the log shipping I got this ...
10
votes
2answers
960 views

TDE prep: key/certificate backup for restores

I am working in a dev environment to better understand TDE encryption. I have it working along with backups and restores on another server. Had a few questions, I know I need to backup the certificate ...
10
votes
3answers
6k views

Can I recover a TDE certificate by restoring the MASTER database?

(We are, fortunately, not currently in this situation, just planning ahead to see what our options would be if it ever occurred.) For a database encrypted with Transparent Date Encryption (TDE), a ...
3
votes
2answers
2k views

Replacing SQL Server TDE soon expiring certificate

What is the best way to replace a soon expiring certificate? Downtime should be avoided. Databases size is 100GB.
-1
votes
2answers
325 views

oracle 10g - encrypting existing column - Transparent Data Encryption

It's possible encrypting existing column without lost and rewrite data? I've few milion of record and it's very important not lost data.
2
votes
2answers
2k views

Backup and restore of TDE Databases to different server

There seems to be a lot of information on backing up and restoring TDE databases, but it's generally all the same information, and there seems to be some contradiction about certain points. I have ...
1
vote
1answer
713 views

Using SQL Server TDE - Encryption 0 percent

I'm using TDE for SQL Server. Querying certificate: select database_name = d.name, dek.encryptor_type, cert_name = c.name from sys.dm_database_encryption_keys dek left join sys.certificates c on dek....
2
votes
1answer
495 views

Encrypt / Decrypt String

I've been approached with a requirement. One of our devs wants to be able to store information in the database, but once there it needs to be encrypted, so that if anyone ever gets a copy of the ...
6
votes
1answer
2k views

TDE - Encryption on a large database

I'm in the process of researching TDE implementation on a VLDB and would like to know if anyone has real world experience with enabling encryption on a production server. What kind of problems (if ...
0
votes
1answer
365 views

Installing SQL Server TDE on a Windows Cluster

i'm going to be upgrading two Instances to Enterprise and thenI'm going to be installing TDE on two sides of a Windows Cluster. All of the databases are on one storage device and whichever Instance is ...
1
vote
0answers
431 views

MySQL Supported versions of MySQL Enterprise TDE

We are bidding for a project involving developing a portal using Liferay, which requires that we use MySQL version 5.5 which is the current compliant version of MySQL with Liferay. We need also use ...
1
vote
1answer
57 views

When would one want to use Oracle transparent data encryption

Oracle TDE features comes with various limitations such as not being able to encrypt columns which are used in foreign key constraints. And probably is available only with enterprise edition which ...
1
vote
2answers
618 views

Databases in Suspect state after enabling TDE

A few of my databases are in a suspect state. How can I get them online? I don’t know what info is relevant and what isn’t, but I’ll give as much as I can. Here is what happened: I enabled TDE in ...
1
vote
2answers
543 views

Encryption in SQL Server 2012/2014

We are hosting sharepoint DBs with AlwaysOn AGs and FCI. My boss asked me what the options for encryption are on the content database, it's backup files and at the column level? I have read about TDE....
1
vote
1answer
951 views

Enable TDE When Publishing DACPAC

In the database properties in Visual Studio there is a checkbox for encryption. I'm not sure if I check this if it will enforce encryption when doing a DACPAC deploy. What I would really like to do is ...
3
votes
1answer
952 views

SQL Server 2012 Transparent Data Encryption and indexes

Does SQL Server TDE allow a query like this: select * from Patient where lastname = 'Smith' to occur without a full-table scan if the lastname column is indexed?
3
votes
1answer
541 views

Backup File Size Almost 50% of Database File Size with TDE Enabled

I receive a full backup of a very large database once per week from a vendor. It contains transactional data which we then load into our data warehouse. Fully restored, the database is around 707GB. ...
1
vote
1answer
476 views

Can we use TDE as an anti-injection technique

TDE prevent unauthorized access to the data by restoring the files to another server, because it requires the original encryption certificate and master key. If i applied a table level encryption ...
2
votes
1answer
214 views

Microsoft TDE Permissions For Changing Keys

I am setting up roles as a layer of protection inside of MSSQL. One of the roles will only have the ability to change database encryption keys for TDE on the database server. The server will be using ...
4
votes
1answer
202 views

TDE restored DB encryption state

I've been looking into using TDE in our SQL Server 2014 environment and have a few questions. I think I have a fairly solid grasp on the numerous "how-to's" that are out there on initially ...
7
votes
2answers
2k views

SharePoint 2013 Database encryption

I'm using SharePoint 2013 with SQL Server 2012 as persistence layer. I need to encrypt the data stored in the database. I stumbled upon the SQL Server feature Transparent Data Encryption (TDE). What ...
5
votes
1answer
522 views

Moving TDE database to a new database but having problems with the cert

This is my first time working with TDE so hopefully I haven't done anything horribly wrong. I'm trying to move my TDE database from one server to another. I have created a master key on the master ...
1
vote
1answer
2k views

Transactional replication between SQL Server 2014 (Publisher) and SQL Server 2012 (subscriber)

We need to set up transactional replication between two servers A and B, configs listed below: Server A (Publisher) Microsoft SQL Server 2014 - 12.0.2254.0 (X64) Enterprise Edition (64-bit) ...
2
votes
0answers
163 views

Alwayson Database Recovery Failure during TDE encryption

Last week I enabled TDE encryption on my AlwaysOn Availability Group databases of SQL Server 2012. During the encryption of one of the larger databases, bigDB (~200gb) a failover event occurred. Of ...
2
votes
0answers
3k views

SQL Server TDE Stuck at Encryption_State 2 and 0% on a Tiny DB

I'm having a heck of a time with this issue and can't figure out what is wrong. I'm not sure how long this tiny DB has been in 'encryption_state = 2' from query: SELECT * FROM sys....
5
votes
2answers
354 views

Separation of Duties - Can a DBA patch or Upgrade a SQL Server 2008 R2 DB without TDE Encryption keys?

Are there any considerations I should have in mind when I patch or upgrade a TDE encrypted database? In the context of separation of duties, does the person executing the patch or upgrade process need ...
1
vote
1answer
140 views

AlwaysOn with TDE

Recently, I setup an availability group with 3 nodes. The 2 synchronous nodes are on the same domain, "domain 1". The third asynchronous (DR) node is on a different domain, "domain 2". I have a new ...