CREATE ASYMMETRIC KEY (Transact-SQL)
Creates an asymmetric key in the database.
CREATE ASYMMETRIC KEY Asym_Key_Name
[ AUTHORIZATION database_principal_name ]
{
[ FROM <Asym_Key_Source> ]
|
WITH <key_option>
[ ENCRYPTION BY <encrypting_mechanism> ]
<Asym_Key_Source>::=
FILE = 'path_to_strong-name_file'
|
EXECUTABLE FILE = 'path_to_executable_file'
|
ASSEMBLY Assembly_Name
|
PROVIDER Provider_Name
<key_option> ::=
ALGORITHM = <algorithm>
|
PROVIDER_KEY_NAME = 'key_name_in_provider'
|
CREATION_DISPOSITION = { CREATE_NEW | OPEN_EXISTING }
<algorithm> ::=
{ RSA_512 | RSA_1024 | RSA_2048 }
<encrypting_mechanism> ::=
PASSWORD = 'password'
An asymmetric key is a securable entity at the database level. In its default form, this entity contains both a public key and a private key. When executed without the FROM clause, CREATE ASYMMETRIC KEY generates a new key pair. When executed with the FROM clause, CREATE ASYMMETRIC KEY imports a key pair from a file or imports a public key from an assembly.
By default, the private key is protected by the database master key. If no database master key has been created, a password is required to protect the private key. If a database master key does exist, the password is optional.
The private key can be 512, 1024, or 2048 bits long.
Requires CREATE ASYMMETRIC KEY permission on the database. If the AUTHORIZATION clause is specified, requires IMPERSONATE permission on the database principal, or ALTER permission on the application role. Only Windows logins, SQL Server logins, and application roles can own asymmetric keys. Groups and roles cannot own asymmetric keys.
A. Creating an asymmetric key
The following example creates an asymmetric key named PacificSales09 by using the RSA_2048 algorithm, and protects the private key with a password.
CREATE ASYMMETRIC KEY PacificSales09
WITH ALGORITHM = RSA_2048
ENCRYPTION BY PASSWORD = '<enterStrongPasswordHere>';
GO
B. Creating an asymmetric key from a file, giving authorization to a user
The following example creates the asymmetric key PacificSales19 from a key pair stored in a file, and then authorizes user Christina to use the asymmetric key.
CREATE ASYMMETRIC KEY PacificSales19 AUTHORIZATION Christina
FROM FILE = 'c:\PacSales\Managers\ChristinaCerts.tmp'
ENCRYPTION BY PASSWORD = '<enterStrongPasswordHere>';
GO
C. Creating an asymmetric key from an EKM provider
The following example creates the asymmetric key EKM_askey1 from a key pair stored in a file. It then encrypts it using an Extensible Key Management provider called EKMProvider1, and a key on that provider called key10_user1.
CREATE ASYMMETRIC KEY EKM_askey1
FROM PROVIDER EKM_Provider1
WITH
ALGORITHM = RSA_512,
CREATION_DISPOSITION = CREATE_NEW
, PROVIDER_KEY_NAME = 'key10_user1' ;
GO
