Microsoft SQL Server Support Blog : SQL Security

PART II - Data security enhancements in SQL Server 2005

sqlblog — Fri, 16 Feb 2007 19:50:00 GMT

In the previous edition (Data security enhancements in SQL Server 2005) , we talked about data encryption/decryption in general.

In this installment, let’s talk about key maintenance. It is important to ensure that we can decrypt our data, even in case of user mistake or corruption.

For this, we need to protect our keys in our database. We have couple of options to do this.

Master key and certificate

You can use the following steps to backup Master key and Certificates

· Backing Master key

BACKUP MASTER KEY TO FILE = 'path_to_file'

ENCRYPTION BY PASSWORD = 'password'

RESTORE MASTER KEY FROM FILE = 'path_to_file'

DECRYPTION BY PASSWORD = 'password'

ENCRYPTION BY PASSWORD = 'password'

[ FORCE ]

More information on the syntax is available here.

Backing Certificate

BACKUP CERTIFICATE certname TO FILE = 'path_to_file'

[ WITH PRIVATE KEY

(

FILE = 'path_to_private_key_file' ,

ENCRYPTION BY PASSWORD = 'encryption_password'

[ , DECRYPTION BY PASSWORD = 'decryption_password' ]

)

]

To restore a backed up certificate, use the CREATE CERTIFICATE statement. More information is available here.

Symmetric key

In order to maintain symmetric key properly and have the ability to restore it, you will have to use the same values for the following during key creation:

· algorithm,

· key_source,

· identity_value

Key can be protected by password or certificate, but values above should exactly be the same. You may also use different name of symmetric key.

Let’s take an example to better understand this.

SELECT * INTO Employee_symm FROM AdventureWorks.HumanResources.Employee

ALTER TABLE Employee_symm

ADD EncryptedNationalIDNumber varbinary(128);

--- Lets create symmetric key with protection by password first

CREATE SYMMETRIC KEY symm_key_combo

WITH

ALGORITHM = triple_des,

IDENTITY_VALUE = 'Example of encryption',

KEY_SOURCE = 'Put here some unique and long enough phrase.'

ENCRYPTION BY PASSWORD = 'Avc#ptNO$cf@o!';

--- Encrypt data

OPEN SYMMETRIC KEY symm_key_combo

DECRYPTION BY PASSWORD = 'Avc#ptNO$cf@o!'

UPDATE Employee_symm

SET EncryptedNationalIDNumber = EncryptByKey(Key_GUID('symm_key_combo'), NationalIDNumber);

--- Now let’s drop symmetric key

DROP SYMMETRIC KEY symm_key_combo

--- Re-create symmetric key with protection by certificate.

--- Also let’s use different name for symmetric key

CREATE SYMMETRIC KEY symm_key_combo_new

WITH

-- Values here should be exactly the same

ALGORITHM = triple_des,

IDENTITY_VALUE = 'Example of encryption',

KEY_SOURCE = 'Put here some unique and long enough phrase.'

--- Protection can be done by certificate now though

ENCRYPTION BY CERTIFICATE HumanResources037;

--- Now let’s decrypt here using new symmetric key

OPEN SYMMETRIC KEY symm_key_combo_new

DECRYPTION BY CERTIFICATE HumanResources037;

SELECT NationalIDNumber, EncryptedNationalIDNumber

AS 'Encrypted ID Number',

CONVERT(nvarchar, DecryptByKey(EncryptedNationalIDNumber))

AS 'Decrypted ID Number'

FROM Employee_symm;

CLOSE SYMMETRIC KEY symm_key_combo_new

DROP SYMMETRIC KEY symm_key_combo_new

DROP TABLE Employee_symm

So in order to be able to restore symmetric key following 3 values need to be set

ALGORITHM = triple_des,

IDENTITY_VALUE = 'Example of encryption',

KEY_SOURCE = 'Put here some unique and long enough phrase.'

Use the same values to re-create the symmetric key in future.

Hope this helps!

Posted By: Sergey Pustovit

PART I - Data security enhancements in SQL Server 2005

sqlblog — Fri, 03 Nov 2006 04:27:00 GMT

In this two part series, we will talk about data encryption and its implementation in SQL Server 2005.

You may encrypt sensitive data like credit card numbers, client information etc. using SQL Server data encryption functionality.

Let’s take an example to demonstrate the different steps involved in encrypting and decrypting your data.

STEP I – Setting the stage for encryption. Steps below are needed to be done only once

--- Create test database

CREATE DATABASE encryption_test;

USE encryption_test;

--- Copy table from AdventureWorks DB for tests.

SELECT * INTO Employee FROM AdventureWorks.HumanResources.Employee

--- Add a column of encrypted data.

ALTER TABLE Employee

ADD EncryptedNationalIDNumber varbinary(128);

/*Creating master key, certificate.*/

--- Create a master key

CREATE MASTER KEY ENCRYPTION BY PASSWORD = 'mzkvdlk979438teag$$ds987yghn)(*&4fdg^';

--- Open master key

OPEN MASTER KEY DECRYPTION BY PASSWORD = 'mzkvdlk979438teag$$ds987yghn)(*&4fdg^';

--- Create certificate

CREATE CERTIFICATE HumanResources037

WITH SUBJECT = 'Sammamish HR',

EXPIRY_DATE = '10/31/2009';

--- Create symmetric key protected by certificate

CREATE SYMMETRIC KEY SSN_Key_01 WITH ALGORITHM = DES

ENCRYPTION BY CERTIFICATE HumanResources037;

STEP II – Encrypting your data

--- Open symmetric key

OPEN SYMMETRIC KEY SSN_Key_01

DECRYPTION BY CERTIFICATE HumanResources037 ;

--- Encrypt data with symmetric key

UPDATE Employee

SET EncryptedNationalIDNumber = EncryptByKey(Key_GUID('SSN_Key_01'), NationalIDNumber);

--- Close the key used to encrypt the data.

CLOSE SYMMETRIC KEY SSN_Key_01;

STEP III – Different ways to decrypt data

--- Option one. Require symmetric key to be opened explicitly

OPEN SYMMETRIC KEY SSN_Key_01

DECRYPTION BY CERTIFICATE HumanResources037;

SELECT NationalIDNumber, EncryptedNationalIDNumber

AS 'Encrypted ID Number',

CONVERT(nvarchar, DecryptByKey(EncryptedNationalIDNumber))

AS 'Decrypted ID Number'

FROM Employee;

CLOSE SYMMETRIC KEY SSN_Key_01;

--- Option two

USE encryption_test;

SELECT NationalIDNumber, EncryptedNationalIDNumber

AS 'Encrypted ID Number',

CONVERT(nvarchar, DecryptByKeyAutoCert ( cert_ID('HumanResources037') , NULL ,EncryptedNationalIDNumber))

AS 'Decrypted ID Number'

FROM Employee

What’s next?

Next time, we will delve deep into key maintenance - How to backup and restore different types of keys.

Additional Resources

Improving Data Security by Using SQL Server 2005

Cryptographic functions

How to encrypt data

How to decrypt data

You may also check Laurentiu Cristofor's blog. Laurentiu works on security features of SQL Server. It is a great resource with technical details for data encryption.

POSTED BY : Sergey Pustovit