Sql-server – TDE using EKM device

sql serversql server 2014transparent-data-encryption

We use an external HSM device to create and store keys and use it for TDE.
Our auditors are asking questions about where the keys are store. So obviously the key is stored in the external HSM device.

In this link, under step 5, 

USE master ;  
GO  
CREATE ASYMMETRIC KEY ekm_login_key   
FROM PROVIDER [EKM_Prov]  
WITH ALGORITHM = RSA_512,  
PROVIDER_KEY_NAME = 'SQL_Server_Key' ;  
GO
  • Does this create a copy of the key in master DB also?
  • In case of TDE, how often does SQL Server has to contact the EKM device? Does it have to contact the ekm device veytime while reading
    data file from disk?

Best Answer

Does this create a copy of the key in master DB also?

AFAIK, no.

In case of TDE, how often does SQL Server has to contact the EKM device? Does it have to contact the ekm device veytime while reading data file from disk?

This depends on the HSM, the driver they provide which you need to have installed and loaded into the SQL Server process space but generally it will be cached for an undetermined period of time.

Related Question