How to encrypt and decrypt highly sensitive information in a SQL Server database using ASP Classic?

Question

I check various questions about stackoverflow and, of course, google, but I cannot find a concrete solution on this:

How to create a function in ASP Classic to encrypt and decrypt highly sensitive information in a SQL Server database? Like fx. social security number or something like that?

(Or can this be done in my SQL string?)

And yes, I know how to create a function with ASP;)

And no, I just can’t hash information with SHA or MD5, because they work in only one direction. I need him to work in both directions!

The more security, the more fun! :)

EDIT:
Subsequently, I found this:

http://www.4guysfromrolla.com/webtech/010100-1.shtml

But I really don't know if it is safe enough and will be? From what I see, this comes in both directions?

Answer 1

It might be useful to allow SQL Server to handle encryption / decryption using Keys / Certificates. Thus, you do not need to minimize your own ASP, and control of this system is kept where the data is. In addition, you do not need to update this process if you decide to switch to another platform.

This is a simple process of creating Keys on the server and using them after this point is also simple, for example:

Encryption;

OPEN SYMMETRIC KEY mykey DECRYPTION BY CERTIFICATE [mycert] UPDATE table SET number = EncryptByKey(Key_GUID('mykey'), @number) 

Decrypt

  OPEN SYMMETRIC KEY mykey DECRYPTION BY CERTIFICATE [mycert] SELECT CONVERT(varchar, DecryptByKey(number)) AS number FROM TABLE 

A good overview of this can be found here. Introduction to SQL Server Encryption

Answer 2

You can successfully use the Rinjdael cipher in VBScript with this library . Key functions are EncryptData () and DecryptData ().

I think it's safe enough for me. Obviously, you will want to keep your key a secret. The application variable in global.asa can be a good place to store it (as usual, where there are connection strings, etc.).