Key caching

The symmetric key caching feature is used to export symmetric keys from the server and store them on the client for a limited time to perform cryptographic operations locally. Keys are cached in the memory as soon as the SQL session is started and remain there until the SQL session is closed or the time specified by Symmetric_Key_Cache_Expiry is reached. Keys cached on the client are stored in process memory only; they are not stored on disk.

This feature can improve performance, specifically, if network latency is high, encryption sizes are small, and local CPU cycles are available. Once keys are cached, the client’s cryptographic operations can continue without access to the server.

Only symmetric keys (AES, ARIA, DESede, and SEED) that have been marked Exportable may be cached. In addition, the user must have export privileges for the key. Therefore, the user must be the key owner or the key must be global. Full encryption and decryption privileges are automatically granted for all keys in the client cache; while in the cache, key permissions and authorization policies are ignored.

How it works

The following steps describe what happens when the Symmetric Key Caching feature is enabled and the client requests a key:

1. The client requests a key.

2. The client checks whether Symmetric_Key_Cache_Enabled is yes (or tcp_ok). If the feature is enabled, the client searches for the key in the key cache.

3. The client does not find the key in the cache.

4. The client requests the key from the server. If you have permission and the key is exportable, the server downloads the key to the client. The key is stored in the cache.

5. Subsequent requests for that key use the key cache until the time set in Symmetric_Key_Cache_Expiry has passed.