Do certificates protect the keys, really?

Question

The book "Microsoft Azure Security Infrastructure" in a section on "transparent data encryption", says

"One solution to the problem is to encrypt high value data in a database and protect the keys that are used to encrypt the data by using a certificate. This prevents anyone without the keys from using the data."

A certificate doesn't protect the keys (plural, as in public, private) used to encrypt the data, right?

Following on from that, the next sentence is confusing.

"The encryption process uses a database encryption key. The database encryption key is: * a symmetric key secured by a certificate stored in either the master database or the server ..."

It's a fine point, but I find x509, certs, etc rather dense being an average programmer and all, in case my question is confusing.

Answer 1

They give a pretty short and confusing explanation of what to do if this is supposed to be prescriptive advice. But it is basically correct.

If you encrypt bulk data records you are probably using a symmetric encryption algorithm like AES because it is fast. The keys associated with that encryption could then be asymmetrically encrypted using the public key associated with a certificate. That would meant possession of the corresponding private key is required to decrypt the symmetric encryption keys to then decrypt the data records.

So to your question, the 'certificate' doesn't really protect the public/private key pair but the symmetric key(s), and your source seems to be glossing over the distinction. You'd still need some way to protect your private key.