在存储过程中使用密码打开对称密钥答案

【问题标题】：Open Symmetric Key With Password In Stored Procedure在存储过程中使用密码打开对称密钥
【发布时间】：2012-01-09 04:08:26
【问题描述】：

我正在尝试编写一个存储过程来解密一些由对称密钥加密的数据，该对称密钥使用带有密码的非对称密钥加密。

OPEN SYMMETRIC KEY 需要一个字符串文字作为密码，所以我不得不使用EXEC sp_executesql 来解决这个问题。有没有更好的方法来做到这一点？

DECLARE @open nvarchar(200), @close nvarchar(200)
SET @open = 'OPEN SYMMETRIC KEY skey DECRYPTION BY ASYMMETRIC KEY akey WITH PASSWORD = ' + quotename(@password,'''') + ';';
SET @close = 'CLOSE SYMMETRIC KEY skey;';

EXEC sp_executesql @open

SELECT [TransactionID],Convert(varchar(max),DECRYPTBYKEY([EncryptedText])) as DecryptedText FROM [dbo].[TestTable];

EXEC sp_executesql @close

如果你使用错误的密码执行它会抛出以下错误：

Msg 15466, Level 16, State 1, Line 1
An error occurred during decryption.
Msg 15315, Level 16, State 1, Line 1
The key 'skey' is not open. Please open the key before using it.

我应该将EXEC sp_executesql @open 包裹在TRY ... CATCH 中并返回NULL 还是有（更）优雅的处理方式？

编辑：处理使用错误密码调用此过程的人的最佳方法是什么？

【问题讨论】：

标签： sql-server sql-server-2008 stored-procedures encryption

【解决方案1】：

示例使用密钥，检查您的数据和代码：

CREATE ASYMMETRIC KEY akey WITH ALGORITHM = RSA_2048 
ENCRYPTION BY PASSWORD = 'aaa123'
GO
CREATE SYMMETRIC KEY skey WITH ALGORITHM = AES_256 ENCRYPTION BY ASYMMETRIC KEY akey
GO

DECLARE @t TABLE(plain VARCHAR(100), ciphered VARBINARY(MAX), unciphered VARCHAR(100))

INSERT @t(plain)
VALUES('11111'), ('22222'), ('33333')

OPEN SYMMETRIC KEY skey DECRYPTION BY ASYMMETRIC KEY akey WITH PASSWORD = 'aaa123'

UPDATE @t SET Ciphered = ENCRYPTBYKEY(KEY_GUID('skey'), plain)


UPDATE @t SET unciphered = CAST(DECRYPTBYKEY(ciphered) AS VARCHAR)

SELECT * FROM @t

CLOSE SYMMETRIC KEY skey
DROP SYMMETRIC KEY skey
DROP ASYMMETRIC KEY akey

为了正确记录错误的密码解密尝试尝试以下示例，使用变量@password：

CREATE ASYMMETRIC KEY akey WITH ALGORITHM = RSA_2048 
ENCRYPTION BY PASSWORD = 'aaa123'
GO
CREATE SYMMETRIC KEY skey WITH ALGORITHM = AES_256 ENCRYPTION BY ASYMMETRIC KEY akey
GO

DECLARE @t TABLE(plain VARCHAR(100), ciphered VARBINARY(MAX), unciphered VARCHAR(100))

INSERT @t(plain)
VALUES('11111'), ('22222'), ('33333')

OPEN SYMMETRIC KEY skey DECRYPTION BY ASYMMETRIC KEY akey WITH PASSWORD = 'aaa123'

UPDATE @t SET Ciphered = ENCRYPTBYKEY(KEY_GUID('skey'), plain)
CLOSE SYMMETRIC KEY skey

DECLARE @open nvarchar(200), @close nvarchar(200), @password VARCHAR(20) = 'aaa123x'
SET @open = 'OPEN SYMMETRIC KEY skey DECRYPTION BY ASYMMETRIC KEY akey WITH PASSWORD = ' + quotename(@password,'''') + ';';
SET @close = 'CLOSE SYMMETRIC KEY skey;';
BEGIN TRY 
  EXEC sp_executesql @open
  UPDATE @t SET unciphered = CAST(DECRYPTBYKEY(ciphered) AS VARCHAR)
  SELECT * FROM @t
  EXEC sp_executesql @close
END TRY BEGIN CATCH 
  SELECT 'Do whatever you want to do here with this caller. Suspicious caller: '+SUSER_SNAME()+', at: '+CAST(GETDATE() AS VARCHAR)
END CATCH

DROP SYMMETRIC KEY skey
DROP ASYMMETRIC KEY akey

【讨论】：

在使用此方法时如何更好地防止 SQL 注入有什么想法吗？
像往常一样 - 因为你不能将密码作为参数传递，所以使用自定义密码字符串检查，并在只有一个访问权限的用户下运行语句 - 从特定的读取和解密特定的列表
检查您的数据和代码 - 据我所知，请参阅所附使用密钥的示例 - 错误消息 15466，级别 16，状态 1，第 1 行解密期间发生错误。 - 表示您使用了错误的密码
是的，我知道，我的问题是关于如何最好地处理这种特定情况。抱歉没有说清楚。

【解决方案2】：

Alter PROCEDURE [dbo].[EncryptAndSaveValues]
@Value as varchar(100),
@EnKey as varchar(100)
AS
BEGIN

set nocount on

Declare @sql nvarchar(1000)

set @sql='
Create Symmetric Key SymmetricKeyforPortal

With algorithm=desx

Encryption by password=N'''+@EnKey+''''

--print @sql

exec sp_executesql @sql

set nocount off
end

https://forums.asp.net/t/1348389.aspx?Declaring+Symmetric+Key+in+Stored+procedure

【讨论】：