Encryption Catalog Views

Catalog views are a valuable tool in SQL Server, through which the metadata information of a database or an instance can be queried.

While all users in the PUBLIC server role have permissions to query catalog views, the results of the queries can differ based upon the user's ownership and permissions to the objects to which the metadata refers. If ownership or permissions are not granted to the user performing the query, the metadata for that object will not be returned.

Various categories of Catalog view are available, allowing you to query metadata for CLR assemblies, extended properties, schemas, linked servers and security, to name just a few. In the interest of securing sensitive data, we will use, in the coming chapters, some of the catalog views that fall in the security category and that are specific to encryption, which include:

• Sys.Asymmetric_Keys

• Sys.Certificates

• Sys.Credentials

• Sys.Crypt_Properties

• Sys.Cryptographic_Providers

• Sys.Key_Encryptions

• Sys.OpenKeys

• Sys.Symmetric_Keys

These catalog views can be queried, after creating their associated objects, as a means of verifying that the execution was successful, or for gleaning valuable information that can be used elsewhere in the application, such as a certificate's expiration date.

Generally, these catalog views will be used in conjunction with the EXISTS command to determine if the item already exists in the database. This information can then be used to direct the execution of CREATE and ALTER commands, accordingly. Listing 1 shows an example of using a catalog view in this manner:

Listing 1. Checking for the existence of a key.