Alters an encryption key and certificate that is used for transparently encrypting a database. For more information about transparent database encryption, see Transparent Data Encryption (TDE).
ALTER DATABASE ENCRYPTION KEY
REGENERATE WITH ALGORITHM = { AES_128 | AES_192 | AES_256 | TRIPLE_DES_3KEY }
|
ENCRYPTION BY SERVER
{
CERTIFICATE Encryptor_Name |
ASYMMETRIC KEY Encryptor_Name
}
[ ; ]
The certificate or asymmetric key that is used to encrypt the database encryption key must be located in the master system database.
The database encryption key does not have to be regenerated when a database owner (dbo) is changed.
After a database encryption key has been modified twice, a log backup must be performed before the database encryption key can be modified again.
Requires CONTROL permission on the database and VIEW DEFINITION permission on the certificate or asymmetric key that is used to encrypt the database encryption key.
The following example alters the database encryption key to use the AES_256 algorithm.
USE AdventureWorks2012; GO ALTER DATABASE ENCRYPTION KEY REGENERATE WITH ALGORITHM = AES_256; GO