SQL Encryption

by Andrei Hetel 26. April 2010 05:50

In case you don't know yet, there is an option in SQL Server to kind of 'protect' your database objects (stored procedures, triggers, views etc). That is achieved by using 'WITH ENCRYPTION' keyword.

 

CREATE PROCEDURE Test
WITH ENCRYPTION
AS
BEGIN
...
END

 

If somebody is trying to script your object will get something like that:

Encrypted Stored Procedure / Function

 

Nice isn't it? But, what happens if a large team is working on a product, company standard is to encrypt the stored procedures, but one of of the programmers forgot to check in the code for a couple of stored procedures in source control? People are making mistakes... it's human nature. Anyway, good news is that there are some stored procedures written, and free that can decrypt and repair those mistaken. I won't tell you where you can find them, just do a search on the web if you are interested in the subject.

The question is: it worth the effort to encrypt your stored procedures or not? If somebody want to get them is not a big problem. Even Microsoft documentation is saying that WITH ENCRYPTION 'obfuscating' not 'encrypting' the code. I'll let you judge what's the best solution.

 

blog comments powered by Disqus