Voice of the DBA

Category: Blog

  • Better Secure Hashing – SHA3

    I’ve been giving an encryption talk over the last year, focusing on educating DBAs on the various features and capabilities available in SQL Server. One of the things I note in the talk is that SHA1 is not considered secure. You should avoid SHA or SHA1 if you are using SQL Server 2012. If you’re on an earlier version, you don’t have a choice.

    Hopefully we’ll have more choices in the future. NIST has selected an SHA-3 algorithm as a new standard. This should provide more security, though there will be some time before we find out if there are any problems or potential attacks against this algorithm.

  • The Modern Resume at the PASS Professional Development VC

    I gave the Modern Resume/Branding presentation today for the PASS Professional Development Virtual Chapter. It was recorded and if you are a PASS member, you can access it.

    I’ve also updated the slide deck and it’s available here: BrandingDreamJob – v16.ppt

  • T-SQL Tuesday #36 – What Does Community Mean?

    tsqltuesdayIt’s T-SQL Tuesday time, this time it’s a non-technical topic, or at least not a directly technically related topic. The SQL Corner, from Chris Yates (b | t), is hosting and the topic this month is “What Does Community Mean To You?”

    You can read the rules on Chris’ blog, and if you’re interesting in hosting, contact Adam Machanic (b | t).

    Community

    I run one of the largest SQL Server communities on the Internet. From the very beginning, Andy, Brian, and I were concerned about building a community. Our goal was to create something that reflected who we were, embodied our ideals, and would be the type of place that we would want to visit ourselves.

    In a little over a decade, it has grown to be an amazing place where people help each other out on a daily basis. Whether it’s with articles written that someone will read weeks in the future, or through near real time interactions in the forums, there are thousands of data professionals on a daily basis interacting with each other at SQLServerCentral.

    Community to me is more than SQLServerCentral, however. It’s more than a web site, or a SQL Saturday, or a group of people that perform the same jobs. Community is more than sharing your knowledge, or asking questions of others. Community includes the bonds of caring, of having each of the members matter to the others. It’s not perfect, and we have our share of disagreements, discontent, and even dislike among members.

    In that case, it’s like family. This SQL Server community reminds me of family: not always pretty or peaceful, but always something I am proud of being a member.

  • Create an Asymmetric Key

    SQL Server has asymmetric keys available for encryption. I wouldn’t recommend them for direct encryption of data since they are slow, i.e. they require lots of resources, but they are good for encrypting the (faster) symmetric keys.

    How can you create one? It’s actually easy, using the standard CREATE ASYMMETRIC KEY DDL. 

    create asymmetric key HRProtection
 with algorithm = RSA_1024
 ENCRYPTION BY PASSWORD = 'Use4SomeStr0ngP@ssword%^'
;
GO

    This create a key with the name and using the RSA algorithm at 1024 bits and protects the key with a password. You could chose other key lengths (512, 1024, 2048), but 1024 is the minimum I would use. It has been shown that 512 bit keys can be cracked relatively cheaply and easily on AWS for less than US$100.

    These keys can be created from key files (a key pair set of files if you used something like SN from the Windows SDK. This would require a path to the files and permissions to read them. Just like protecting the password with this file, you should have limited permissions set on any key pair files that exist on your OS. The ideal way to create these keys is with a hardware EKM device, but those are expensive, rarely used, and not foolproof.

    This requires the CREATE ASYMMETRIC KEY permission, or equivalent. Most of the DDL type permissions include this permission.

    There are no GRANT/DENY/REVOKE permission statements with keys. Make sure you use a strong password and protect it. Do not disclose this unnecessarily.

    That’s the basic of the key creation. I’ll look at some other options with these keys in another post.