What does CONTROL permissions give on asymmetric key?

I am trying to determine if granting CONTROL permission on an asymmetric key
is a good or bad thing?

What does CONTROL mean in the context of the key? I want to assign it to a
database role that is used by typical users. I need to do this to use the
DecryptByKeyAutoAsymKey function in table functions, etc.

Thanks for any insight.

MDC

MDC (MDC@discussions.microsoft.com) writes:
> I am trying to determine if granting CONTROL permission on an asymmetric
> key is a good or bad thing?
>
> What does CONTROL mean in the context of the key? I want to assign it
> to a database role that is used by typical users. I need to do this to
> use the DecryptByKeyAutoAsymKey function in table functions, etc.

CONTROL means that you can do everything with the object that sysadmin cxan
do. Thus, with this permission, the users can drop the key and to all sorts
of things to it.

An alternative may be to sign the modules where you need to use DecryptByKey
with a certificate, and the grant a user created from the certificate
CONTROL permission on the key.

I have an article on my web site that describes this in detail:
http://www.sommarskog.se/grantperm.html.


--
Erland Sommarskog, SQL Server MVP, esquel RemoveThis @sommarskog.se

Links for SQL Server Books Online:
SQL 2008: http://msdn.microsoft.com/en-us/sqlserver/cc514207.aspx
SQL 2005: http://msdn.microsoft.com/en-us/sqlserver/bb895970.aspx
SQL 2000: http://www.microsoft.com/sql/prodinfo/previousversions/books.mspx