Backing up DPAPI keys in relation to SQL Server

Hi,

There alot of talk about Service Master and DB Master keys and the importance of backing them up seperately.

What about the DPAPI keys used to protect the Service Master keys. What procedures to I take to back those up during my database backup.

If I understand correctly, if I do a backup on one machine, and then try to restore in a different machine, I won't be able to decrypt data becuase the DPAPI keys don't "match".

This is assumming I don't use a password to protect my DB Master keys, I just rely on the service master to protect them.

Thanks for any help,

Database master keys(DbMK) are always protected by a password - you have no choice about that.

If you backup the service master key(SMK), there is no need to be concerned about DPAPI - those keys are managed by the OS and the database automatically uses them to encrypt a loaded SMK.

When you do a database backup, you actually don't need to backup anything else than the database - you just have to remember the database master key password. You don't need the SMK or the DPAPI keys to be able to restore the database.

Thanks

Laurentiu

|||

Thanks,

I understand that I can restore the database without the SMK or DPAPI keys, but I'm surprised that I will be able decrypt data without them. I thought this was the whole purpose of the encryption heirarchy.

If I can indeed restore a database, and see the decrypted data with just the DbMK, then why do I need the DPAPI and SMK?

I thought they were in place to add additional "seperation of duties" for keys - so if someone stole a database backup tape, they wouldn't be able to restore the tape on a 'bad guy' server, and see by encrypted data - because they didn't have the SMK and DPAPI key.

Thanks for your help!