Digital Signatures with SEA

One of the features of SQL Encryption Assistant is providing an easy mechanism to digitally sign programmables in a SQL Server Database. For this example I have created the following

1. A table named EMPLOYEES


2. A procedure to select all rows from EMPLOYEES named getEmployees


3. Digital Certificate named CERT_01

I can now launch SQL Encryption Assistant inside Management Studio. Navigate to the certificate you wish to use for signing and right click to get to the Add Signature menu item.



From here I can sign procedures, functions, triggers, or assemblies. In the interest of keeping this simple, I will have a follow up post on counter signing on a later date.


The Add Signature window will open upon selecting the menu item. As you can see below, I have selected the procedure getEmployees to be signed. I have also entered the password that was used to protect Cert_01.



Click OK to sign the procedure. I also would like to mention that once a programmable is signed, it will show up in the dependencies window for the certificate used in the signing.

SEA Pro 1.0.5.908 Update

SQL Encryption Assistant Professional Edition 1.0.5.908 has been released.

To obtain the latest version see the FAQ post in our forum:
How do I get the latest version of SQL Encryption Assistant?

Release Details

Issue
Encrypt data by symmetric key protected by a password. Enter invalid password and click "OK". Data will be null in selected column due to incorrect decryptor.

Resolution
Encrypting and decrypting data by symmetric key protected by a password will not allow incorrect password to be entered. If an incorrect decryptor is entered the encryption or decryption process will be terminated and the data will not be null.

The mISV Toolbox

Starting a mISV is challenging on so many levels, once you have an idea, a master plan or just some molecules scribbled on a napkin, the next step becomes a litany of questions.

What platform will I develop on?
What language?
How will I deploy?
Where do I host everything?
What about e-Commerce? Marketing? Taxes?

...it goes on and on.

As a mISV we needed to take advantage of anything and everything with 'free' attached to it. One of the areas I want to focus on in this post are the tools we have found indispensable to starting, building and growing the company. While some of these do cost money they are at the lower end of the cost spectrum in that space. Also worth noting is the "build v. buy" dilemma. We have in some cases decided to build tools ourselves in order to fill in the gaps. (more on this in a later post)

First and foremost...

Microsoft BizSpark
BizSpark is uniquely designed to accelerate your success by providing fast, affordable access to current, full-featured Microsoft tools and technologies, plus production licensing for hosted solutions.

Development
DebugView
Reflector

HelpMaker
HelpMaker is RTF-based, page-layout Help Authoring tool. It generates WinHelp, HTML_Help, Website-Help and PDF.

TortoiseSVN
TortoiseSVN is a really easy to use Revision control / version control / source control software for Windows.
Since it's not an integration for a specific IDE you can use it with whatever development tools you like.

Inno Setup
Inno Setup is a free installer for Windows programs. Versatile and flexible. Love this tool.

Unfuddle
Unfuddle is a secure, hosted project management solution for software development teams.

Code Obfuscation Software($)

Media
Sizer
Allows you to resize any window to an exact, predefined size. This is extremely useful when designing web pages, as it allows you to see how the page will look when viewed at a smaller size. The utility is also handy when compiling screen-shots for documentation, using Sizer allows you to easily maintain the same window size across screen grabs.

Paint.NET
Wow! What a tool. So easy a developer can use it! We have used Paint.NET for all our graphics.

Wink
A Tutorial and Presentation creation software, primarily aimed at creating tutorials on how to use software (like a tutor for MS-Word/Excel etc). Using Wink you can capture screen shots, add explanations boxes, buttons, titles etc and generate a highly effective tutorial for your users. Very easy to use, had 2-3 demos up in a couple of hours.


Marketing
Google Analytics
Google Adwords ($)

HiStats
Adds a different view on site analytics.

ClickTale
ClickTale is an in-page web analytics tool that allows you to record your users as they browse your site. Very powerful tool for us as it has helped us to design and redesign our site several times from this "virtual feedback".

Kampyle
Online feedback app to intake user feedback. Easy to install and customize.

Squidoo
A publishing platform and community that makes it easy for you to create "lenses" online. Lenses are pages, kind of like flyers or signposts or overview articles, that gather everything you know about your topic of interest—and snap it all into focus.

eCommerce
e-Junkie ($)
E-junkie provides shopping cart and buy now button functionality for site selling products online. Great service, low cost and feature rich.

PayPal

Communication
TeamViewer
Wonderful app to communicate, share destops, remote support.

FileZilla
Messenger

Yet Another Forum.net
YetAnotherForum.NET (YAF) is a Open Source discussion forum or bulletin board system for web sites running ASP.NET.

.Blog
Open source ASP.NET blog software.

Twitter
Facebook

Misc
KeePass
Free open source password manager, something you will definitely need as you open accounts.

PADGen
PAD is the Portable Application Description, and it helps authors provide product descriptions and specifications to online sources in a standard way, using a standard data format that will allow webmasters and program librarians to automate program listings. PAD saves time for both authors and webmasters

VCdControlTool
Mount ISOimages as virtual CD drives.

SEA Pro 2008 1.0.5.908 Update

SQL Encryption Assistant Professional 2008 Edition 1.0.5.908 has been released.

To obtain the latest version see the FAQ post in our forum:
How do I get the latest version of SQL Encryption Assistant?

Release Details

Issue
Encrypt data by symmetric key protected by a password. Enter invalid password and click "OK". Data will be null in selected column due to incorrect decryptor.

Resolution
Encrypting and decrypting data by symmetric key protected by a password will not allow incorrect password to be entered. If an incorrect decryptor is entered the encryption or decryption process will be terminated and the data will not be null.

Announcing Devenius Social Connections

Here at Devenius, we want to be accessible to our customers as much as possible. To achieve this level of openness, we have created several avenues to converse with us:


Twitter


Facebook


Online Forum


Blog

Feel free to follow us, become our friend our just visit us!

---

Sincerely,
Tim Rowan
Co-Founder
Devenius, Inc.

3 New Demo Videos Added

We have added product demo videos for SQL Encryption Assistant and SQL.CLR.

The demos can be found here: Product Demos.

Check back often as we will be adding more videos!

HOW TO: Enable Transparent Data Encryption (TDE)

To enable TDE, follow these steps.

1. Create a certificate protected by the master key.
2. Create a database encryption key and protect it by the certificate.

Select the database that will implement TDE. Right-click and select 'Database Key -> Create'.



Select the certificate created in step 2.

3. Enable TDE by selecting the database, right-click and select 'TDE -> Enable'

HOW TO: Encrypt data with SQL Encryption Assistant

1. First let's setup a sample table in the database. This table will have 4 columns:

Code:
CREATE TABLE [dbo].[CUSTOMER_DATA](
[CUS_ID] [int] IDENTITY(1,1) NOT NULL,
[CUS_Name] [varchar](50) COLLATE SQL_Latin1_General_CP1_CI_AS NULL,
[CUS_SSN] [nvarchar](MAX) COLLATE SQL_Latin1_General_CP1_CI_AS NULL,
[CUS_DOB] [nvarchar](MAX) COLLATE SQL_Latin1_General_CP1_CI_AS NULL,
CONSTRAINT [PK_CUSTOMER_DATA] PRIMARY KEY CLUSTERED
(
[CUS_ID] ASC
)WITH (IGNORE_DUP_KEY = OFF) ON [PRIMARY]
) ON [PRIMARY]

2. Prime the table with some data.

3. Open SQL Encryption Assistant.

4. Create a symmetric key named 'EncryptKey', protected by a password.

5. Select the key created in step 4, right-click and select Tasks -> Encrypt Data



6. Choose 'Password' for the key decryption and enter the key's password.

7. In the 'Select Table' group box, select the table created in step 1, 'TEST'.

8. Select the column 'TST_Data' and click '>>'. This is the data we will encrypt.

9. Click 'Ok'.

The data is now encrypted using a symmetric key.

Certificate or Asymmetric Key?

One of the first questions regarding the security objects in SQL Server is what is the difference between certificates and asymmetric keys.

Similarily, certificates and asymmetric keys both encapsulate RSA keys. Certificates offer more flexibility, in that they may be imported from external sources. For example, a .CER file. Once the certificate or asymmetric key is available from within the database, the range of implementation options is essentially the same.

Certificates in SQL Server 2005

The most common uses for certiciates in SQL Server are to sign code, encrypt symmetric keys or encrypt data. The most compelling reason to use certificates for encrypting keys, is that they can be backed up and restored.