Download eBook (PDF) - Red Gate Software

4 – Encryption Basics for SQL ServerFigure 4-2: Key Lifecycle.Other than providing a means to create new keys and regenerate encrypted datawith a new key, SQL Server does not offer a built-in means to manage keysthrough this lifecycle. At first glance, this may seem to be a bad oversight but,in fact, provision of key management functionality within the database thatcontains the encrypted data and keys introduces a potential vulnerability in datasecurity.Extensible Key Management (SQL Server 2008)To address the maintenance issue, SQL Server 2008 introduced functionalitycalled Extensible Key Management (EKM).Through the MicrosoftCryptographic API (MCAPI) provider, this feature offers the ability toimplement a third party solution, or even a custom built solution, forgenerating, backing up, exporting, distributing, retrieving keys and managingthe overall key lifecycle externally from the database. EKM also enables use ofdevices such as Hardware Security Modules (HSM), smartcards, andfingerprint readers to store, configure and manage key lifecycles.MCAPI cryptographic providers can be created in SQL Server through theexecution of the CREATE CRYPTOGRAPHIC PROVIDER command, as shownin Listing 4-6. The .dll file provided in this example represents a third partyproduct that would be used for key management functionality.Use Master;GOCREATE CRYPTOGRAPHIC PROVIDER MyCryptoProviderFROM FILE = 'D:\InstanceA\CryptoProvider\CryptA.dll';GOListing 4-6: Creating a cryptographic provider in SQL Server.91