Contents
How to enable TDE on SQL Server using EKM?
To enable TDE using EKM Copy the files supplied by the EKM provider to an appropriate location on the SQL Server computer. Install certificates to the computer as required by your EKM provider. In Object Explorer, connect to an instance of Database Engine. On the Standard bar, click New Query.
Can a symmetric key be used on an EKM?
You can create and use both symmetric and asymmetric keys on an EKM device. You can encrypt native (non-EKM) symmetric keys with EKM asymmetric keys. The following example creates a database symmetric key and encrypts it using a key on an EKM module.
What does EKM stand for in SQL Server?
Extensible Key Management (EKM) is another new feature that gives SQL Server the ability to store the encryption key used for TDE on hardware specifically design for key security and management. Such devices are called High Security Modules (HSM), whose vendors are referred to as EKM providers.
How does symmetric encryption work in SQL Server?
When you enable Transparent Data Encryption on your SQL Server database the database generates a symmetric encryption key and protects it using the EKM Provider software from your key management vendor. The EKM Provider software sends the symmetric key to the key server where it is encrypted with an asymmetric key.
Can a EKM device sign in to SQL Server?
Users cannot sign in using that login, but the Database Engine will be able to authenticate itself with the EKM device. If the asymmetric key stored in the EKM module is lost, the database will not be able to be opened by SQL Server.
Is there any way to recover the EKM key?
To recover the key, one option would be to restore the Master database from a backup that had the EKM provider settings and the asymmetric key required to decrypt the database files and backups. But, restoring Master might not be an option.
Where is the asymmetric key stored in the EKM?
The EKM Provider’s user account name and password, which is needed to register the EKM Provider’s DLL. The filename that the asymmetric key is stored in on the device. The system generated thumbprint for the previous asymmetric key.