Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Cannot find the symmetric key '', because it does not exist or you do not have permission

Using SQL 2005

I created a Master Key encrypted by password and then encrypted the Master Key with the Service Master Key

I then created an ASYMMETRIC_KEY which I use to encrypt my SYMMETRIC_KEY I did all this using the SA user for SQL and logged into windows server as the domain admin.

I have a user in my database that only has dbo permissions on my database and then I grant that user execute permissions on all the necessary stored procedures and I also deny view definition to those same stored procedures.

The stored procedure giving me trouble where I do the encryption is this here. Also this all worked on SQL2012 in my testing pc but now that I am creating this on production server with sql 2005 and it is failing

open symmetric key
    MYKEY_NAME_SYM decryption by Asymmetric key MYKEY_NAME_ASYM
    set @ENCRYPTVARIABLE = (select ENCRYPTBYKEY(KEY_GUID('MYKEY_NAME_SYM'), @ENCRYPTCOLUMN))    
close symmetric key MYKEY_NAME_SYM

The error I am receiving is:

Cannot find the symmetric key 'MKEY_NAME_SYM', because it does not exist or you do not have permission.

So I am guessing that the user I am using in my database does not have permissions but when I try to grant permissions

GRANT 
VIEW DEFINITION ON SYMMETRIC KEY::MKEY_NAME_SYM TO [myuser]

I get the same error cannot find the symmetric key or I don't have permissions.

like image 476
Jay Avatar asked Sep 25 '13 13:09

Jay


People also ask

How do I know if a symmetric key is open?

Information about open symmetric keys is visible in the sys. openkeys (Transact-SQL) catalog view. If the symmetric key was encrypted with another key, that key must be opened first. If the symmetric key is already open, the query is a NO_OP.

What happens if you run the queries without opening the symmetric keys?

A user need to have permission to symmetric key and certificate to decrypt data, if they still try to decrypt then they will receive null for encrypted values. However they do not receive any errors. In the below sample code I am running select in context of a user 'test' which has only read access on DB.


Video Answer


1 Answers

With an administrative user write in script console:

    --Grant View
    GRANT VIEW DEFINITION ON CERTIFICATE::[Certificate_Name] TO [user]
    GRANT VIEW DEFINITION ON SYMMETRIC KEY::[EncryptionKey_Name] TO [user]

    --Grant Control
    GRANT CONTROL ON CERTIFICATE::[Certificate_Name] TO [user]
like image 138
Mitolo Avatar answered Sep 23 '22 02:09

Mitolo