Download eBook (PDF) - Red Gate Software

4 – Encryption Basics for SQL Server• DESX: This option in SQL Server is actually a misnomer and when it isused, Triple_DES_3KEY is actually applied. The DESX option willnot be an option in future versions of SQL Server.• Triple_DES: This is a block cipher that processes text in 64 bitblocks. The result is a key size of 168 bits. The Triple_DES optionin SQL Server actually returns a 128 bit key size. TheTriple_DES_3KEY option returns a 192 bit key size. Triple_DESis the algorithm used when a database master key is created.Rivest Cipher• RC2: This is a block cipher that processes text in 64 bit blocks. Theresult is a key size of 64 bits.• RC4: This is a stream cipher resulting in a key size between 40-256bits. This option will be removed from future versions of SQL Server.• 128-bit RC4: This is a stream cipher resulting in a key size of 128bits. This will not be an option in future versions of SQL Server.Of the three options, AES, DES and RC, the AES group of algorithms is thestrongest. This is reflected in the fact that the US National Security Agencystates that the AES algorithm should be used to protect systems andinformation of national security interest.Due to the inherent weaknesses of the RC4 and 128-bit RC4 algorithmsthese options will not be available in future versions of SQL Server. Their useis therefore discouraged.Asymmetric Key AlgorithmsAsymmetric keys utilize a series of computational methods to derive theprivate and public key instead of the block/stream methods identified forsymmetric keys. The following Rivest/Shamir/Adleman (RSA) keyalgorithms are available for asymmetric keys in SQL Server:• RSA 512: The result is a private key size of 512 bits.• RSA 1024: The result is a private key size of 1024 bits.• RSA 2048: The result is a private key size of 2048 bits.When a self-signed certificate is generated within SQL Server, the private keythat is created uses the RSA 1024 algorithm.It is important to note that the term "key length" for asymmetric keys is inreference to the portion of the algorithm calculation that is called the95