In MS SQL Server 2005/2008 standard encryption all data in the database is encrypted using the SMK/DMK scheme. In this scheme a key is issued for each client connecting to the database. What would a hacker sniffing network traffic will see and what should be the strategy to prohibit this

  1. Would Applying Encryption inside the database will be enough.
  2. Would Applying Encryption outside the database (Applying encryption where the data originates) will be necessary.
  3. A Hybrid solution will be more suitable
  4. Do I also need to provide a secure link (SSL) between client and server ?

Yes, else the attacker could grab the key off the wire as it passes to the client and can decrypt the information the same as the client. One needs to use a secure key exchange, the easiest way to do that is to push everything through SSL.

  • Per BOL ms-help://MS.SQLCC.v10/MS.SQLSVR.v10.en/s10de_4deptrbl/html/c75d0d4b-4008-4e71-9a9d-cee2a566bd3b.htm employing TDE in SQL Server does not provide encryption across communication channels. MS recommends SSL to ensure encrypt data across channels so eanm89 is correct in recommending SSL. – jl01 Nov 30 '11 at 15:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.