I am writing a web-app that will, at some point in the future, need to perform column-level encryption of a portion of the data it stores to our database running on SQL Server 2008 Express.

It would simplify application development to design through beta1 while recording data in plaintext, and then to add encryption between beta1 and beta2. Is this possible in SQL Server 2008 Express? Are there significant disadvantages to taking this approach?


As column level encryption is all controlled by your application, it's totally up to you about when to do this. If you plan on encrypting the data later, I'd add a column to the table which tells you what sort of encryption is in use on that row.

It could be a bit flag "IsEncrypted", or a more complex foreign key to a table which lists different certificates which could be used to encrypt the data (this way when a certificate needs to be replaced you have an easy way to identify which rows have been encrypted with what certificate).

Then add logic into the app to use this extra column to figure out how/when to encrypt/decrypt the values.

  • Did I completely misunderstand the MSDN article on column-level encryption in SQL Server 2008? This didn't seem like it was entirely an application-side thing. – Jeffrey Blake Nov 1 '11 at 21:39
  • It can be done all within the database, but the technique that you have to use as far as marking what rows are encrypted with what is exactly the same. – mrdenny Nov 1 '11 at 22:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.