186 reputation
3
bio website kuemerle.com
location Pennsylvania
age 42
visits member for 3 years, 9 months
seen Mar 29 at 16:46

I am a developer in the New York City area with over 15 years of development and database experience. I specialize in application and data security topics as well as application usage tracking. I speak at user groups, community events, regional and national conferences.

You can find me on Twitter as @jkuemerle


Apr
14
awarded  Teacher
Apr
12
awarded  Supporter
Apr
12
comment SQL field level encryption, how safe is it?
you can set up the encryption to be automated (the default) and protect the master keys using DPAPI or you can use a only passphrase that has to be entered to unlock the database master key. You can also store all keys outside of the DB itself using an Extensible Key Module (EKM). See: msdn.microsoft.com/en-us/library/ms189586.aspx for the key management diagrams and msdn.microsoft.com/en-us/library/bb895340.aspx for EKM details.
Apr
11
answered SQL field level encryption, how safe is it?
Apr
11
comment SQL field level encryption, how safe is it?
A few comments from a crypto geek: #1. do not encrypt passwords, hash them. #2. The question is about using the built in SQL Server encryption therefore the algorithms available are already only strong ones and the engine takes care of key generation and management (including using unique IVs every time data is written #3. the SQL Server key management is strong & multi layered. #4. the built in encryption is done before any tlog or data pages are written to disk so there is not a way for an attacker to see cleartext from the file system. See: sqlcrypto.codeplex.com for sample code
Feb
11
awarded  Autobiographer