Transparent data encryption, should the master key be communicated?

Question

Say I want to send a database to a third party.

I create a certificate for them, encrypt a database, backup the certificate using the following:

BACKUP CERTIFICATE ServerEncriptionCert TO FILE = 'c:\encryptcert'
WITH PRIVATE KEY 
	(
	FILE = 'c:\encryptkey',
	ENCRYPTION BY PASSWORD = '<a password I communicate to thrid party>'
	);

Then I send them the certificate and private key generated in the process as well as the password (statement) used to restore the certificate:

CREATE CERTIFICATE ServerEncriptionCert  
FROM FILE = 'c:\encryptcert'
WITH PRIVATE KEY (FILE = 'c:\encryptkey', 
DECRYPTION BY PASSWORD = '<a password I communicate to thrid party>')

Now when they try to restore, they receive the following:

"Please create a master key in the database or open the master key in the session before performing this operation."

What I am trying to confirm is this:  The third party needs a master key but this does not need to be mine right.  As long as they use the password I used to encrypt the certificate and private key, the password for the master key does not need to correspond.

Am I right?  All exemple I see are situations where poeple create the master key with the same password on every server.  Surely this is not recommended nor necessary when transfering to a third party?

Answer 1

Hi Antoine F,

Yes, you are right. The password of master key on the target instance is not required to be as the same as source instance. The premise to restore the certificate and database with TDE enabled is to have a master key, and the password for this master key doesn’t matter.

---

Stephanie Lv

TechNet Community Support

Answer 2

Thank you Stephanie.  With all those blogs and exemples using a single encryption key all over, I was starting to doubt.