January 28, 2013 at 10:46 am
Hi everyone.
At what point does the actual data get reencrypted by SQL Server? Does it happen when I regenerate a database encryption key or when a new certificate is created and associated with an encrypted database?
When the data itself is reencrypted, is there a security issue during the decrypt/reencrypt process?
None of the Microsoft documents seem to address this.
Thanks much.
January 28, 2013 at 2:27 pm
PHXHoward (1/28/2013)
Hi everyone.At what point does the actual data get reencrypted by SQL Server? Does it happen when I regenerate a database encryption key or when a new certificate is created and associated with an encrypted database?
Are you talking about Transparent Data Encryption (TDE) or cell encryption with crtificates and keys?
PHXHoward (1/28/2013)
When the data itself is reencrypted, is there a security issue during the decrypt/reencrypt process?None of the Microsoft documents seem to address this.
Thanks much.
I don't know about any issue but you should rember that when you have debug permission on OS level and none permission to SQL server you can read encrypted data from memory...and do many more things 😉
January 28, 2013 at 2:37 pm
I'm referring to TDE encryption.
When we regenerate the DEK or create a new certificate and encrypt using certificate, does it decrypt/reencrypt the data itself?
January 29, 2013 at 2:16 am
PHXHoward (1/28/2013)
I'm referring to TDE encryption.When we regenerate the DEK or create a new certificate and encrypt using certificate, does it decrypt/reencrypt the data itself?
Without decryption how can it change a key?
When you regenerate a DEK you can track progress in sys.dm_database_encryption_keys column encryption_state=4 (Key change in progress), then all data from the DB must be decrypted and encrypted using a new key. eg:
ALTER DATABASE ENCRYPTION KEY
REGENERATE WITH ALGORITHM = AES_128;
When you change only the certificate that protect DEK only DEK is decrypted and encrypted by using a new key. DEK keys aren't changed and there is no need to decrypt and encrypt all data in DB
alter DATABASE ENCRYPTION KEY
ENCRYPTION BY SERVER CERTIFICATE NewCert;
January 29, 2013 at 11:41 am
Thank you for the replies. I understand now.
How safe is the reencrypt process? Is there data file ever exposed while it is reencrypted?
January 29, 2013 at 12:03 pm
PHXHoward (1/29/2013)
Thank you for the replies. I understand now.How safe is the reencrypt process? Is there data file ever exposed while it is reencrypted?
Encrypted data in decrypted form are in:
- buffer pool
- RAM
- swap file
- and i don't know where else
Encryption is on page level, so probably reencrypt occur as follow: read a page->decrypt->encrypt by a new key->write a page
But why are you so afraid about encryption process?
January 29, 2013 at 12:11 pm
That makes sense. I was wondering about the reencrypt process because an auditor asked me that question so I wanted to give him an answer.
January 29, 2013 at 12:21 pm
PHXHoward (1/29/2013)
That makes sense. I was wondering about the reencrypt process because an auditor asked me that question so I wanted to give him an answer.
Auditor 🙂 so all is clear, auditors sometimes ask weird questions...
February 22, 2013 at 11:45 am
ou can't use a custom certificate with salesforce.com, it just doesn't work that way. At what level are you looking to encrypt the data? Data is already encrypted during data transport (uses TLS encryption where available). If you want to store the data in salesforce.com, use Encrypted Text Fields (free, available on request).
Viewing 9 posts - 1 through 8 (of 8 total)
You must be logged in to reply to this topic. Login to reply