Someone needs to tell the BOL writers to update the page on this then. It
currently indicates that EncryptByCert can return a varbinary up to 8,000
bytes in length, which is ludicrous if the input is really limited to 421
bytes and the output is limited to 432 bytes. I'm not advocating using
certificates and asymmetric keys to encrypt all data. I am advocating
accurate documentation of system limitations.
I'll ask for an update of these BOL topics to mention the restrictions
related to the key lenghts. If you access BOL online, you can also rate the
articles and submit feedback directly. Here are the links for the topics we
discussed:
http://msdn2.microsoft.com/en-us/library/ms188061.aspx
http://msdn2.microsoft.com/en-us/library/ms186950.aspx
Thanks

Signature
Laurentiu Cristofor [MSFT]
Software Design Engineer
SQL Server Engine
http://blogs.msdn.com/lcris/
This posting is provided "AS IS" with no warranties, and confers no rights.
> Someone needs to tell the BOL writers to update the page on this then. It
> currently indicates that EncryptByCert can return a varbinary up to 8,000
[quoted text clipped - 44 lines]
>>>
>>> Thanks
Mike C# - 24 Aug 2006 21:53 GMT
Thanks. I wanted to get verification and make sure it wasn't a problem with
my installation or how I was using the functions before I claimed errors in
either the application or the documentation.
> I'll ask for an update of these BOL topics to mention the restrictions
> related to the key lenghts. If you access BOL online, you can also rate
[quoted text clipped - 54 lines]
>>>>
>>>> Thanks
Laurentiu Cristofor [MSFT] - 24 Aug 2006 21:59 GMT
Also, in the meantime, you may want to use the following reference:
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/seccrypto/secur
ity/cryptencrypt.asp
The relevant paragraph extracted from above is:
The Microsoft Enhanced Cryptographic Provider supports direct encryption
with RSA public keys and decryption with RSA private keys. The encryption
uses PKCS #1 padding. On decryption, this padding is verified. The length of
plaintext data that can be encrypted with a call to CryptEncrypt with an RSA
key is the length of the key modulus minus eleven bytes. The eleven bytes is
the chosen minimum for PKCS #1 padding. The ciphertext is returned in
little-endian format.
Thanks

Signature
Laurentiu Cristofor [MSFT]
Software Design Engineer
SQL Server Engine
http://blogs.msdn.com/lcris/
This posting is provided "AS IS" with no warranties, and confers no rights.
> I'll ask for an update of these BOL topics to mention the restrictions
> related to the key lenghts. If you access BOL online, you can also rate
[quoted text clipped - 54 lines]
>>>>
>>>> Thanks