Changing the database master key

Hello all,

My understanding from previous discussions was that it was not possible to
change the database master key for an MIT Kerberos KDC due to various bits
that are encrypted in the master key. However, I noticed that the
kdb5_util man page seems to indicate that it can under dump:

-mkey_convert
prompts for a new master key. This new master key will
be used to re-encrypt the key data in the dumpfile. The
key data in the database will not be changed.

-new_mkey_file mkey_file
the filename of a stash file. The master key in this
stash file will be used to re-encrypt the key data in the
dumpfile. The key data in the database will not be
changed.

Those options make it sound like I could use a technique like:

1. Create a new KDC database in a new location with an AES master key.
2. Dump the old database using -new_mkey_file pointing at the new stash.
3. Load the database dump into the new empty database.

and thereby change the database master key. Is that correct? Does this
fail for some reason? Has anyone done this?

--
Russ Allbery (rra@xxxxxxxxxxxx) <http://www.eyrie.org/~eagle/>
.

Relevant Pages

  • RE: 2005-Problem restoring database with encrypted columns to diff ser
    ... Where this did not work is when i created the intial database using SQL ... database located on a SQL Server Standard edition on a Windows 2003 Server. ... ALTER MASTER KEY ADD ENCRYPTION BY SERVICE MASTER KEY; ... > encryption by certificate test; ...
    (microsoft.public.sqlserver.security)
  • Re: Managing SQL Encryption -- Is there a Best Practice Doc?
    ... SMK was already created even before creating a database. ... I'm not sure if this certainly means "SQL Server Setup creates SMK", SMK might be created just after the installation because of some encryption needs at some point which is a mystery for me for now. ... being from the same source -, presents the text "The Service Master Key ...
    (microsoft.public.sqlserver.security)
  • 2005-Problem restoring database with encrypted columns to diff ser
    ... I need to start encrypting several fields in a database and have been doing ... OPEN MASTER KEY DECRYPTION BY PASSWORD = 'testAppleA3'; ... ALTER MASTER KEY ADD ENCRYPTION BY SERVICE MASTER KEY; ... encryption by certificate test; ...
    (microsoft.public.sqlserver.security)
  • RE: 2005-Problem restoring database with encrypted columns to diff ser
    ... On a SQL Express instance, create a database/table, Master key, ... Certificate, symmetric key and insert the record with encrypted column. ... Backup/restore to the SQL Enterprise edition instance. ... >Where this did not work is when i created the intial database using SQL ...
    (microsoft.public.sqlserver.security)
  • Re: Restoring Databases with Encrypted Data to Another Server
    ... SQL Server 2005 database. ... -- Create a Database Master Key ... ENCRYPTION BY CERTIFICATE TestCertificate; ... I backup the database and restore to another server. ...
    (microsoft.public.sqlserver.security)