SQL Server 加密 - 轮换密钥以实现 PCI 合规性
美好的一天，
不确定这个问题是否更适合 SO 还是 SF...
PCI 合规性要求每年轮换密钥。我不断遇到的“密钥轮换”的定义是解密您的数据，然后使用新密钥重新加密。真的吗？每个人每年都会解密/加密他们所有的加密数据？
目前，我在 3 台服务器上有 16 个数据库，每个数据库中有多个表 - 而且这个数据库还会继续增长。手动执行此操作会带来巨大的错误机会，导致我的数据不可读。是的，我可以写一些东西来做到这一点......但这真的是每个人都在做的吗？您能推荐一个负担得起的（主观的，我知道）第三方工具吗？
我看到了一些关于“更改”层次结构中更高层的键的建议。我们使用经常推荐的数据库主密钥层次结构来加密证书，该证书加密对称密钥，后者加密数据。
首先，这似乎不符合“旋转密钥”的定义。其次，即使我更改 DMK 或证书，这也不会阻止使用可能是坏人窃取/破解的相同对称密钥来解密数据。
谢谢！
Good day,
Not sure if this question is better suited for SO or SF...
PCI compliance requires annual rotation of keys. The definition of "rotation of keys" that I keep coming across is decrypting your data, then re-encrypting with a new key. Really? Everyone out there is decrypting / encrypting all their encrypted data every year?
Currently, I've got 16 databases across 3 servers, with multiple tables in each database - and this will just continue to grow. Doing this manually introduces a huge opportunity for mistake, rendering my data unreadable. Yes, I could write something to do this...but is this really what everyone is doing? Can you recommend an affordable (subjective, I know) 3rd party tool?
I've seen some suggestions out there about "changing" the keys higher up in the hierarchy. We use the oft recommended hierarchy of Database Master Key encrypting a Certificate, which encrypts a Symmetric Key, which encrypts the data.
First, this doesn't seem to meet the definition of "rotating the keys". Second, even if I change the DMK or the Cert, this doesn't prevent the data from being decrypted with the same Symmetric Key that presumably bad guy has stolen / cracked.
Thanks!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
您无需解密和重新加密整个数据库，而只需解密和重新加密用于保护数据的对称密钥。数据库在此操作期间被加密，需要几秒钟的时间。
只需测试它，并编写一个每年都会执行此操作的简单脚本。
请记住永远保留旧钥匙，强烈建议这样做。例如，他们可能需要恢复旧的备份。
You're not decrypting and re-encrypting the whole database, just the symmetric key which is used to protect the data. Database is encrypted during this operation and it takes a couple of seconds.
Just test it, and write a simple script that will do it annually.
Remember to keep old keys forever, this is highly recommended. They may be required to e.g. restore old backups.