Download eBook (PDF) - Red Gate Software

5 – Cell-Level EncryptionEncrypting Large Plain Text ValuesDocuments and manuscripts may contain information that would be classifiedat a high sensitivity level. The plain text size of these items can often be verylengthy. The challenge that this type of data presents is that all of thecryptographic functions for symmetric and asymmetric keys in SQL Serverreturn a varbinary type with a maximum length of 8,000 bytes. Thistranslates to a maximum plain text length, for encryption, of 7,943 characters.When the plain text length exceeds this upper limit, the encryption methodreturns a NULL value, so the encryption not only fails but you also lose the datayou were trying to encrypt.In order to get round this limitation, and use cell-level encryption for largeplain text documents, one option is to chop the data into smaller units. Forexample, the manuscript can be encrypted in segments according to naturalbreaks that occur in the document, such as chapters. However, this approachwould require additional schema modifications since these separate units willrequire relational storage for efficient retrieval.Another option is to investigate whether or not the large text really does requireencryption because the intent to obfuscate data does not necessarily call forencryption. As an alternative, consider converting the plain text directly into avarbinary data type with a length designation of max, using the CONVERTmethod. An example of this syntax is:CONVERT(Varbinary(max),@YourPlainText)The max length designation increases the storage limit from a maximum of8,000 bytes to 2,147,483,647 bytes. Assuming that the plain text length iswithin this size this statement will return a varbinary version of the plaintext that is equal to the full length of the string.Its resulting value is not discernable to the naked eye. To return this value toplain text requires only the conversion of the varbinary(max) data to avarchar(max) data type using the same CONVERT method. This approachdoes not provide the same security level as that offered by cell-levelencryption, but it does overcome the data type size limitations associated withthe cryptographic functions, and it may suffice if a limited degree ofobfuscation is required.104