Certificate (Encryption – Decryption in SQL Server 2008 Part 4)

Well, we are moving one step forward for data encryption and decryption, I have already described some of the essential topics in this area which are mandatory before implementing this step. If you want to go backward, have a look at series of article on this topic at below given link.

Encryption – Decryption in SQL Server 2008 Part 1

Service Master Key (Encryption – Decryption in SQL Server 2008 Part 2)

Database Master Key (Encryption – Decryption in SQL Server 2008 Part 3)

Once you have SMK and DMK, you will have choice to go for Certificates, Asymmetric key, Symmetric key. Scope of this article is use of certificate. Let us start our journey.

Certificate is a kind of Asymmetric encryption with some additional metadata. In Asymmetric encryption data got encryption by two different methods but mathematically both are same. You can use “CREATE CERTIFICATE” T-SQL for creating new or use existing certificate.

--create new cerfiticate

CREATE CERTIFICATE ADV

ENCRYPTION BY PASSWORD ='$qlhub'

WITH SUBJECT ='ADVENTUREWORKS CERTIFICATE',

START_DATE='09/14/2009', --IF NOT PROVIDED, CURRENT DATE IS START DATE

EXPIRY_DATE='09/13/2015'-- IF NOT PROVIDED, ONE YEAR AFTER START_DATE IS EXPIRY_DATE

go

I have observed that people are really very cautious about the data and used to take regular backup of data but not that much cautious for certificates. I HIGHLY recommend taking backup of your certificate as soon as you create it, so let us seeing the script of that.

BACKUP CERTIFICATE ADV

TO FILE = 'd:\ADV.CER'

WITH PRIVATE KEY

(

      FILE='d:\ADV.PVK',

      ENCRYPTION BY PASSWORD='$qlhub',

      DECRYPTION BY PASSWORD='$qlhub'

)

go

Generally you think of restore command as soon as you finish backup. Let me tell you that there is no restore certificate command as you can restore your existing certificate from your backup file itself from CREATE CERTIFICATE command only. Have a look.

--LET US drop just created certificate and restore it from

--.cer file so that we are sure that certificate is created

--perfectly

DROP CERTIFICATE ADV

--restore from file

CREATE CERTIFICATE ADV

FROM FILE='D:\ADV.CER'

Once you create certificate and take a backup of it, now, you are ready to encrypt your data with certificate and decrypt it whenever it is needed.

DECLARE @Text nvarchar(max)

DECLARE @TextEnrypt varbinary(128)

DECLARE @TextDecrypt nvarchar(max)

SET @Text=N'hi, this is first certificate test, created by Ritesh Shah'

SET @TextEnrypt=ENCRYPTBYCERT(CERT_ID('ADV'),@Text)

SET @TextDecrypt=DECRYPTBYCERT(CERT_ID('ADV'),@TextEnrypt,N'$qlhub')

SELECT @Text AS 'ORIGINAL TEXT',@TextEnrypt AS 'Encrypted Text',@TextDecrypt as 'Decrypted Text'

GO

Hope you have enjoyed this small tour.

Reference: Ritesh Shah
http://www.sqlhub.com
Note: Microsoft Books online is a default reference of all articles but examples and explanations prepared by Ritesh Shah, founder ofhttp://www.SQLHub.com