Question

I have a table TblUserLogin with columns LoginID int, Password varchar(50), LoginUserName varchar(150), Designation varchar(100).

My requirement is that whenever we are using select statement to this table we are able to see the password which is entered (which is sensitive information).

Is there any way so that we can encrypt the password column so that when ever we use select statement that information will be seen in an encrypted way and will not affect the code which is accessing the password column or inserting new password?

In simple words when “The password column shown as encrypted when it is accessed from Management Studio using select statement, but when accessed programatically it returns the actual non-encrypted password”.

Answer 1

Try this:

CREATE Procedure [dbo].[EncryptPasswd]
@user_id int,
@username varchar(255),
@passwd varchar(255)
As
Begin
Declare @res varbinary(2000)

IF NOT EXISTS(select * from sys.symmetric_keys where name='##MS_DatabaseMasterKey##')
CREATE MASTER KEY ENCRYPTION
BY PASSWORD = 'xyz@123'


IF NOT EXISTS(select * from sys.certificates where name='EncryptTestCert')
CREATE CERTIFICATE EncryptTestCert
WITH SUBJECT = 'xyz@123'

IF NOT EXISTS(select * from sys.symmetric_keys where name='TestTableKey') 
CREATE SYMMETRIC KEY TestTableKey
WITH ALGORITHM = TRIPLE_DES ENCRYPTION
BY CERTIFICATE EncryptTestCert

OPEN SYMMETRIC KEY TestTableKey DECRYPTION
BY CERTIFICATE EncryptTestCert


INSERT INTO Users(user_id,username,passwd) 
SELECT @user_id,@username,ENCRYPTBYKEY(KEY_GUID('TestTableKey'),@passwd)
END

Use this sproc whenver you insert a new user into your user table.So this will encrypt the password and insert.