How is an ODBC connection encrypted?

Question

Most conversations about ODBC are Microsoft centric, but the protocol is often used in heterogeneous environements, such as a Windows client connecting to a database on an *nix server. While my question is open ended, I'm most interested in the heterogeneous scenario.

In researching a specific use case, I was surprised to find almost no encryption specific controls in the drivers. There was a check-box to turn on encryption, but I could find no documentation about controlling the algorithms used or to specify/provide certificates. Red lights started flashing. "Does it use TLS 1.2, or an older version?" "Is there mutual authentication?" "Are the certificates validated or are self-signed certs trusted?" "What certs are used?" Yea, like that...

I found some information about how this operates in a Microsoft environment. Even this information was not entirely satisfying, but the documentation for the protocol itself or for specific drivers from the *nix world seems to be almost completely lacking.

Answer 1

It depends upon the ODBC driver. If the driver has internal crypto, you can activate it. However, it also depends upon the backend database. ODBC may be used to connect to databases other than SQL server. For example, a native Oracle ODBC driver written on top of Oracle's DB client can use oracle network security when connecting. Other ODBC drivers may not use or have native security.

EDIT for Clarification

ODBC - Open Database Connectivity - is an API (library) within a program, it is not a network protocol. There's the Driver Manager, which is what is linked into the program and then there are Drivers which connect to various databases that are dynamically loaded (often) or statically linked (infrequently) into the program.

The program can exist on the same machine as the database (and use interprocess communication) or remotely on another machine (and use network communication). As there is no universal network protocol for accessing every type of database, each driver has its own network protocol, if it's network capable. For example, in the case of ODBC/Oracle, there would be a specific ODBC Oracle Driver that slots under the ODBC call stack and converts ODBC calls into SQL*Net calls. Those calls may be secured (the point of your question) using Oracle's Advanced Security Option (its native network security).

Likely, you're using a different database. In that case, you'll need a different ODBC Driver that, hopefully, has a secure networking layer built into it.

Years ago, I worked for a startup that specialized in building secure ODBC drivers for Oracle, Sybase and Generic ODBC networking. For the generic ODBC driver, we wrote our own client/server network protocol that used Kerberos and DCE RPC for securing network communications and the server side would call into the database via another ODBC Driver Manager.