The service master key can only be decrypted by the service account under which it was created or by a principal that has access to the machine's credentials. The DPAPI uses a key that is derived from the Windows credentials of the SQL Server service account and the computer's credentials. The SMK is encrypted by using the local computer key using the Windows Data Protection API (DPAPI). The SMK is automatically generated the first time the SQL Server instance is started and is used to encrypt a linked server password, credentials, and the database master key. SQL Server has two primary applications for keys: a service master key (SMK) generated on and for a SQL Server instance, and a database master key (DMK) used for a database.
0 kommentar(er)
