EKC Encryption Key Copy Filter and ddlgen

The ddlgen utility supports the EKC (encryption key copy) extended type for its -F filter argument, to suppress the generation of key copies for encryption keys.

This example uses -FEKC to avoid creating DDL for key copies when generating DDL for the “ssn_key” encryption key:

ddlgen -Usa -P -Sserver -TEK -NSampleKeysDB.dbo.ssn_key -FEKC

The output from ddlgen would look like:

--------------------------------------------------------------------------
-- DDL for EncryptedKey 'ssn_key'
--------------------------------------------------------------------------
print 'ssn_key'

--The DDL is generated with a default password – 'password' as 
--a password was specified when this key was created.

create encryption key SampleKeysDB.dbo.ssn_key for AES
with keylength 128 
passwd 'password'
init_vector random 
go