Download eBook (PDF) - Red Gate Software

5 – Cell-Level EncryptionOur first step will be to create a database master key for our HomeLendingdatabase. This is accomplished using the CREATE MASTER KEY method. TheENCRYPTION BY PASSWORD argument is required and defines the passwordused to encrypt the key, as shown in Listing 5-3.USE HomeLending;GOCREATE MASTER KEYENCRYPTION BY PASSWORD = 'MyStr0ngP@ssw0rd2009';GOListing 5-3: Creating the Database Master Key.The requirement of defining the ENCRYPTION BY PASSWORD argument mightbe a bit confusing since our intent, based upon requirement 4, is to protect thedatabase master key with the service master key, instead of a password.Creating the database master key, as shown in Listing 5-3, not only protects thedatabase master key with a password; but also automatically adds theadditional protection by the service master key. The use of either keyencryption method is valid for opening the database master key.If we execute a query against the sys.key_encryptions catalog view, forthe ##MS_DatabaseMasterKey## key , as shown in Listing 5-4, we seethat ENCRYPTION BY MASTER KEY is returned, which is in reference to theservice master key.USE HomeLending;GOSELECTb.name,a.crypt_type_descFROMsys.key_encryptions aINNER JOIN sys.symmetric_keys bON a.key_id = b.symmetric_key_idWHEREb.name = '##MS_DatabaseMasterKey##';GOListing 5-4: Confirming protection of the database master key by the service masterkey.The next step is to create a self-signed certificate that is protected by thedatabase master key of our HomeLending database. All certificates created110