SQL Server - Unsupported Keystore Provider MSSQL_JAVA_KEYSTORE

user_14184853 0
Viewed 669

I am working on a project where we plan to encrypt our SQL Server 2016 database using SQL Server Always Encrypted. The client apps will access data via a compatible jdbc driver.

Microsoft docs say that I can use MSSQL_JAVA_KEYSTORE as the Keystore provider.

  • Step 1: I created a KeyPair using keytool command and I have a jks file.

  • Step 2: I created a Column Master Key in SQL Server using SSMS as follows

    CREATE COLUMN MASTER KEY CMK_2
WITH
    (KEY_STORE_PROVIDER_NAME = N'MSSQL_JAVA_KEYSTORE',
     KEY_PATH = N'tp-7b679880-706e-47af-bcbe-e1cc3cc78690');

    where KEY_PATH is the alias of the key in my keystore.jks file.

  • Step 3: Now I am trying to create a Column Encryption key using SSMS wizard and it throws the following Error

    Unsupported Keystore Provider type: MSSQL_JAVA_KEYSTORE.

A bit baffled by the error - as per Microsoft docs, MSSQL_JAVA_KEYSTORE is one of the built in column master keystore providers.

What am I doing wrong?

always-encrypted sql-server
1 Answers

Unfortunately is not possible to create the ECK directly using SSMS. I hope in the future microsoft could handle this. I've used AE with Java app using JBoss EAP 7.x using this steps:

  • Keytool to creating the keys.
  • Following the guide of Microsoft SQL guide to create a java class and after an EMK and ECK with it.
  • Creating my db table objects making reference of this ECK.
  • In the jdbc, inform the keystore, its password and connection properties to the sql server.

Important:

  • MSSQL will not be able to handle the crypt data register inside the DB. It cannot read the keystore.
  • You'll need to create another class or java app with the same keystore access to be able to handle the data (CRUD) actions and troubleshooting the register inside your database.
  • If this AE keystore be exposed all your data may be at risk, Keep then safe.

Tip: With DBeaver and Squirrel I could make some select commands using the keystore, and make changes and table structure normally. But insert, update not, only using java class.

user_145872040
Related