22

You can join on the certificate thumbprint: use master; go select database_name = d.name, dek.encryptor_type, cert_name = c.name from sys.dm_database_encryption_keys dek left join sys.certificates c on dek.encryptor_thumbprint = c.thumbprint inner join sys.databases d on dek.database_id = d.database_id; My sample output: database_name ...


17

\df *crypt in psql reveals the argument types of the pgcrypto encrypt and decrypt functions (as do the PgCrypto docs): List of functions Schema | Name | Result data type | Argument data types | Type --------+-----------------+------------------+--------------------------+-------- ... public | decrypt ...


16

Your problem boils down to access control. The first defense I'd propose is to simply deny access to the untrusted users. If they can't get into the database, they can't query the database and get at the sensitive data. If they must be allowed to access the database server, you can look at either explicitly granting them read permission to the tables they ...


15

As in the other answer: you need a recent CU for TLS1.2. See https://support.microsoft.com/en-us/kb/3052404: Cumulative Update 8 for SQL Server 2014 Cumulative Update 1 for SQL Server 2014 SP1 Cumulative Update 6 for SQL Server 2012 SP2 Cumulative Update 7 for SQL Server 2014 After enabling only TLS 1.2 you will possibly encounter two errors: SQL Server ...


14

But how does it know what was the algorithm used to encrypt data if there's no argument related to that on the function DECRYPTBYPASSPHRASE? Is it part of the encrypted data? Yes, right on point. I'm going to use the following for the output: DECLARE @Data VARBINARY(MAX) DECLARE @Text NVARCHAR(MAX) = N'I''ll get you, and your little dog too!' DECLARE @...


12

We have recently implemented TDE along with AlwaysON in Production running SQL Server 2014. In our application, we noticed a slight (1-3%) increase in CPU utilization. Your environment is different, so do a thorough load testing with some realistic PROD datasize. Takeaways from embracing TDE : Backup compression and TDE does not go hand in hand i.e. You ...


11

If you create keys without a certificate like: CREATE SYMMETRIC KEY smTestKey WITH ALGORITHM=AES_256 , IDENTITY_VALUE = 'Key to protect bla' , Key_SOURCE = N'Secret pass phrase' ENCRYPTION BY PASSWORD = 'secret password'; then the following is enough: GRANT ALTER ANY SYMMETRIC KEY TO dbuser If you create symmetric keys that's encrypted by a ...


11

From TechNet sys.dm_exec_connections DMV: the encrypt_option will display FALSE if the connection is not encrypted. Here is an example TSQL statement that can be run by administrators (VIEW SERVER STATE is the required privilege): SELECT session_id, connect_time, net_transport, encrypt_option, auth_scheme, client_net_address FROM sys.dm_exec_connections


10

The only way to use encryption to protect the data against your own administrators/IT is when the user enters the decryption password him/herself, every time it queries the data. If your application presents the user with a password dialog and then issues an OPEN SYMMETRIC KEY ... DECRYPTION BY CERTIFICATE ... WTIHT PASSWORD ... (or some equivalent) to open ...


10

Assuming you are talking about data that is encrypted with SQL Server keys, there is way to find these columns. The Key_name() Function will return the name of the key used for the encryption for that particular value and will return NULL if there isn't anything encrypted with a "known" key (3rd party, or simple not encrypted). With that knowlegde we can ...


10

The attacker will get the data unencrypted. The T in TDE stands for "transparent". The user will never see encrypted data. The database transparently decrypts it when it is read from disk and transparently encrypts it when writing to disk. If your application is insecure, TDE doesn't help you plug those application security holes. You need to fix those ...


10

Create a brand new master key on your second instance. i.e. don't create it from backup you taken from 1st instance. Then restore certificate from the backup taken and then try. I guess you don't need master key and only certificate is required for restore purposes. Follow the below steps: Step1: Create Master Key CREATE MASTER KEY ENCRYPTION BY PASSWORD ...


10

I have yet to come across a definitive "Best Practices" list regarding multiple encryption types for SQL Server, but in your situation I would probably recommend the following: Encrypt necessary data using Always Encrypt Its the new hotness. You're on 2016, enjoy it! Better security - the DBA can't decrypt data since the key is stored outside the database. ...


10

Ok, apparently just changing 'BEGIN PRIVATE KEY' to 'BEGIN RSA PRIVATE KEY' isn't enough. It must be properly converted from PKCS#8 to PKCS#1 Reference openssl rsa -in /etc/mysql/ssl/nginx.key -out ~/nginx.key.rsa


9

Since TDE relies on a certificate stored in master (which is used to encrypt the database encryption key), then this would work only work if you could restore the master database to another server in such a way that the certificate could be decrypted. This is the TDE encryption hierarchy: Service master key (protected by Windows; tied to the service ...


8

If you are talking about the SQL service master key, then there is a rare occurrence where you really need to restore it. I'm thinking of a couple of scenarios where you need to restore the SMK... Somehow it got corrupted. You are rebuilding your SQL server and planning to restore every database including system databases from backup. Usually in this ...


8

No, this is not true, and there is an easy proof. On one server, create a database, and store some data using ENCRYPTBYPASSPHRASE(): CREATE DATABASE blat; GO USE blat; GO CREATE TABLE dbo.mort(floob INT, splunge VARBINARY(64)); GO INSERT dbo.mort VALUES (1, ENCRYPTBYPASSPHRASE(N'kerplunk', N'secret')), (2, ENCRYPTBYPASSPHRASE(N'kerplunk', N'hidden')); ...


8

Since you are using Standard Edition, you cant use TDE. So other options are Using encryption keys at instance/database level : SQL Server has two kinds of keys: symmetric and asymmetric. Symmetric keys use the same password to encrypt and decrypt data. Asymmetric keys use one password to encrypt data (called the public key) and another to decrypt data (...


8

The problem with cell level encryption is that the column itself isn't really encrypted, it's the data contained in that column. The columns themselves are just varbinary columns (because that's what's required) and could contain completely legible data. It's the use of the ENCRYPTBY* and DECRYPTBY* functions that truly make the data encrypted. You can ...


8

Don't confuse Oracle Advanced Security with encrypted SSL client connections to the database. The Advanced Security option is comprised of two main features, Data Radaction and Transparent Data Encryption. TDE is the encryption of data within tables, so that if someone captures the datafiles they won't be able to read table data in the clear inside the ...


8

PostgreSQL doesn't currently support DB-level encryption. (Correct as of 9.4, at least). You can use an encrypted file system, though the performance impact can be pretty serious for write-heavy systems, especially those doing random I/O. Your options depend on the operating system - Microsoft BitLocker, Linux's dm-crypt/LUKS/cryptsetup, OS X's FileVault 2, ...


8

SQL Server supports SSL 3.0 and TLS 1.0 only, you must have at least one of them enabled or SQL Server will not be able to start. SQL Server does not support TLS 1.1, 1.2 etc, it specifically uses TLS 1.0. Your options here are to enable SSL 3.0 and/or TLS 1.0, no other way around it I'm afraid. Cheers Mat


8

We have quite some mixed servers, using encryption, depending upon the need of business. For very critical servers, we decided to upgrade to Enterprise edition as it not only provides TDE but other benefits as well when it comes to performance or troubleshooting. Yes, TDE is quite effective and very good, but since it comes with a cost we decided for medium ...


8

No, there is no way to do this. And there is not much purpose in doing so anyway as you can easily decompile Assemblies with tools such as ILSpy. The two ways to protect your intellectual property are: Proper license agreement. Consult with a lawyer to see what is best for you. There are many options and laws vary by state / region / country / etc so ...


8

Traffic will be encrypted regardless of the client encryption specification when you turn on the Force Encryption option on the server side (SSCM-->SQL Server Network Configuration-->Protocols for MSSQLSERVER-->Properties-->Flags-->Force Encryption). If you don't install a certificate from a trusted CA, SQL Server will use a self-signed certificate. Clients ...


7

As a rule of thumb: If your data is well structured, well known (in advance) and of a limited size per entry (no mega BLOBs), relational databases are really good at storing it. Even if you don't use the advanced indexing features. Managing space, especially empty space in data files, is a very hard problem to solve. Relational databases have been dealing ...


7

As far as my testing goes (using SQL Server Express 2014, SP1 and SQL Server Developer 2012 SP2, both 64-it), the formula when not using an authenticator for the return value (VARBINARY) length of: ENCRYPTBYPASSPHRASE('_My_PassPhr@zE_yo_', {anything}) is: 28 + (8 * (DATALENGTH(@ClearText) / 8)) Try the following: DECLARE @ClearText VARCHAR(8000); SET @...


7

In order to programmatically determine if the current SMK was used to protect the DMK, you should be able to simply attempt an operation that would require the DMK. Such an operation would need to first decrypt the DMK in order to use it. Assuming that you have not opened the DMK explicitly (using the password supplied when creating it), decrypting the DMK ...


7

Yes, backups are encrypted while moving over the network because TDE data is encrypted on disk, and the backup operation never decrypts it. Paul Randal's Backup Myths: Myth 30-09) backups read data through the buffer pool No. The backup subsystem opens its own channels to the database files to avoid the performance hit of having to read everything ...


7

I would guess they mean rows created for symmetric keys. create symmetric key KeyTest with algorithm = aes_128, identity_value = '123456' encryption by password = '123456!Q'; go -- Needs a DAC connection select * from sys.sysclsobjs where Name = 'KeyTest' Result: class id name status type intprop created modified ---...


Only top voted, non community-wiki answers of a minimum length are eligible