Re: SQL 2005 - Searching Encrypted SSN

Because we did not find any compelling reason to provide this option. We
have considered it, but we decided not to provide such a feature, because
for most uses, it would not be a safe option. We recommend randomly
generating IVs, so we did not want to add ambiguity by providing an option
to specify custom IVs.

Thanks

--
Laurentiu Cristofor [MSFT]
Software Design Engineer
SQL Server Engine
http://blogs.msdn.com/lcris/

This posting is provided "AS IS" with no warranties, and confers no rights.

"Mike C#" <xyz@xxxxxxx> wrote in message
news:ORer7OQoGHA.1208@xxxxxxxxxxxxxxxxxxxxxxx
"Laurentiu Cristofor [MSFT]" <laur@xxxxxxxxxx> wrote in message
news:uNLoccGoGHA.2364@xxxxxxxxxxxxxxxxxxxxxxx
Of course you are better: if you have two pieces of data encrypted with
different IVs, you're not going to be able to tell whether they're
identical or not, but if you use a fixed IV, the blobs will be identical.
Storing the IVs with the data is ok, they're not supposed to be secret;
the encryption key is the secret.

Thanks

That said, why is there no option to allow programmers to specify their
own IV at encryption time?



.

Relevant Pages

  • Re: SQL 2005 - Searching Encrypted SSN
    ... IVs with the data is ok, they're not supposed to be secret; ... Software Design Engineer ... SQL Server Engine ...
    (microsoft.public.sqlserver.security)
  • Re: SQL 2005 - Searching Encrypted SSN
    ... identical or not, but if you use a fixed IV, the blobs will be identical. ... Storing the IVs with the data is ok, they're not supposed to be secret; ... the encryption key is the secret. ...
    (microsoft.public.sqlserver.security)