Skip to content

Commit 7ae849f

Browse files
DAILLYDAILLY
DAILLY
authored and
DAILLY
committed
Updated documentation
1 parent 67f4e6f commit 7ae849f

File tree

3 files changed

+12
-12
lines changed

3 files changed

+12
-12
lines changed

2.CreateGenericCMK-CEK.md

+6-5
Original file line numberDiff line numberDiff line change
@@ -187,15 +187,15 @@ New-SqlColumnEncryptionKey -Name $cekName -InputObject $database -ColumnMasterKe
187187

188188
You can now check the keys in SQL Server Management Studio. The result should be like the following screenshot.
189189

190-
- CMK / CEK available
190+
- CMK / CEK available :
191191

192192
![CMK/CEK available](assets/ssms_keys_creation.png)
193193

194-
- CMK Details
194+
- CMK Details (check the Key Store Provider and Key Path) :
195195

196196
![Generic CMK](assets/ssms_cmk_details.png)
197197

198-
- CEK Details
198+
- CEK Details :
199199

200200
![Generic CMK](assets/ssms_cek_details.png)
201201

@@ -240,7 +240,7 @@ Set-SqlColumnEncryption -ColumnEncryptionSettings $ces -LogFileDirectory $logdir
240240

241241
![Data PlainText](assets/ssms_after_encryption.png)
242242

243-
- Log file result :
243+
- Log file result (for information) :
244244

245245
```
246246
9/10/2018 4:12:17 PM INFO MainThread Logger initialized.
@@ -256,4 +256,5 @@ Set-SqlColumnEncryption -ColumnEncryptionSettings $ces -LogFileDirectory $logdir
256256
9/10/2018 4:13:27 PM INFO [dbo].[Patients] Catch-up iteration #2 for table '[dbo].[Patients]' completed. Data migration is 99.9 % done.
257257
9/10/2018 4:13:28 PM INFO [dbo].[Patients] Catch-up phase completed.
258258
9/10/2018 4:13:28 PM INFO MainThread Finalizing data migration.
259-
9/10/2018 4:13:29 PM INFO MainThread Deploying the specified encryption settings completed in 0d:0h:1m:12s.
259+
9/10/2018 4:13:29 PM INFO MainThread Deploying the specified encryption settings completed in 0d:0h:1m:12s.
260+
```

Issue1.md

+4-4
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ public static class AlwaysEncryptedManagement {
3030
}
3131
```
3232

33-
The main issue in this code is the default statement. Only an error is returned whenever you attempt to access a custom provider. Normally the code should behave as in the the "AZURE_KEY_VAULT" statement.
33+
The main issue in this code is the default statement. Only an error is returned whenever you attempt to access a custom provider. Normally the code should behave as in the "AZURE_KEY_VAULT" statement.
3434

3535
With the original code, it is impossible to achieve Always Encrypted configuration with PowerShell and a custom/generic provider. It may be possible with a full C# or Java, but all the documentation use PowerShell.
3636

@@ -54,7 +54,7 @@ private static SqlColumnEncryptionKeyStoreProvider GetProvider(string providerNa
5454
}
5555
```
5656

57-
- IL:
57+
- IL :
5858
<div style="font-size:0.8em">
5959

6060
|Offset |OpCode |Operand|
@@ -72,13 +72,13 @@ private static SqlColumnEncryptionKeyStoreProvider GetProvider(string providerNa
7272
By updating the IL Code from the original DLL, the SqlServer PowerShell module doesn't allow anymore you to load this assembly.
7373

7474
There is 2 solutions for this:
75-
- Update by yourself the IL code, and while saving the modified DLL Reflexil will prompt to "Register it for verification skipping" :<br />
75+
- Update by yourself the IL code, and while saving the modified DLL Reflexil will prompt you to "Register it for verification skipping" :<br />
7676
![](assets/reflexil_verification_skipping.png)
7777

7878
- Use the already patched [System.Management.SQLServer.Management.dll](bin/Microsoft.SqlServer.Management.AlwaysEncrypted.Management.dll), and register the assembly to bypass Strong Name checking (using the sn.exe utility of the .NET SDK). The sn.exe utility is provided with the .NET Framework. Check a path like this one, depending the version of the .NET Framework installed "C:\Program Files (x86)\Microsoft SDKs\Windows\v8.1A\bin\NETFX 4.5.1 Tools".<br />
7979
Below are the following commands to:
8080
- Enable the CLR policy for bypass Strong Name verification
81-
- Register the DLL for bypass Strong Name verification for all users
81+
- Register the DLL to bypass Strong Name verification for all users
8282

8383
Commands
8484
```Cmd

Readme.md

+2-3
Original file line numberDiff line numberDiff line change
@@ -159,7 +159,7 @@ This solution provide in order:
159159

160160
## Known Issues
161161

162-
- SQL Server Management Studio cannot decrypt columns when setting "Column Encryption Setting=enabled". Or we should access the .NET assemblies loaded by the 'smss' process and register the generic provider into the SqlConnection class loaded by the process. I even don't know if this can be done (easily I mean).
162+
- SQL Server Management Studio cannot decrypt columns when setting "Column Encryption Setting=enabled". Or we should access the .NET assemblies loaded by the 'smss' process and register the generic provider into the SqlConnection class loaded by the process. I even don't know if this can be done (easily I mean). Nevertheless, it may be possible to update the IL code of any assembly (remove Strong Name verification for this assembly) loaded by ssms.exe to provide a static constructor (in any existing class) that would load the assembly of the generic provider ([the generic dll](bin\SQLServerAlwaysEncrypted.dll)) and create an instance of this generic provider with the right parameters to access the key, and register it. This would allow ssms.exe to decrypt columns.
163163

164164
![connectionstring](assets/smss_settings.png)
165165

@@ -179,13 +179,12 @@ SELECT [PatientID]
179179
```
180180

181181
Output:
182-
<blockquote style="color:red;">
182+
```
183183
Msg 0, Level 11, State 0, Line 0<br />
184184
Failed to decrypt column 'SSN'.<br />
185185
Msg 0, Level 11, State 0, Line 0<br />
186186
Failed to decrypt a column encryption key. Invalid key store provider name: 'GENERIC'...
187187
```
188-
</blockquote>
189188

190189

191190
## Licence

0 commit comments

Comments
 (0)