Key caching
The key caching feature enables you to export keys from Key Manager and store them on the client for a limited time, in order to perform cryptographic operations locally.
Keys are cached in the memory as soon as the CDP for MSSQL DLL is loaded, and remain there until the SQL server is restarted or the time specified by Symmetric_Key_Cache_Expiry has passed. Keys cached on the client are stored in process memory only; they are not stored on disk.
This feature improves performance, specifically if network latency is high, encryption sizes are small, and local CPU cycles are available. Once keys are cached, client crypto operations can continue without access to the server.
Only symmetric keys (AES, ARIA, DES, DESede, SEED, RC4) that have been marked Exportable can be cached. In addition, the NAE user must have export privileges for the key. Therefore, to export keys, any of the following criteria must be met:
You must be the key owner.
You must be part of a group with permissions on the key and should only perform those operations that have been configured for that group.
The key must be global.
Note
Authorization policies are ignored in the cache.
Caution
Your client and its connection to the CipherTrust Manager must be secure. Downloading keys over this connection and storing them on your client exposes them to possible attack. When using the symmetric key caching feature, be sure that you are using a secure method of download and that your client’s operating system is secure.
How it works
The following steps describe what happens when the Symmetric Key Caching feature is enabled and the client requests a key:
The client requests a key.
The client checks whether Symmetric_Key_Cache_Enabled is yes (or tcp_ok). If the feature is enabled, the client searches for the key in the key cache.
The client does not find the key in the cache.
The client requests the key from the server. If you have permission and the key is exportable, the server downloads the key to the client. The key is stored in the cache.
Subsequent requests for that key use the key cache until the time set in Symmetric_Key_Cache_Expiry has passed.
To use the Symmetric Key Caching feature, you must configure the required parameters. Refer to the Local Encryption Configuration Parameters.
