除SAP ASE外，是否还有其他数据库支持密钥托管人（Key Custodian）机制？

Great question! While SAP Sybase ASE is widely recognized for its explicit Key Custodian mechanism, several other databases offer equivalent split-trust models for encryption key management—though they might not use the exact "Key Custodian" label. Let’s break this down:

SAP ASE’s Key Custodian Basics #

First, to recap how this works in SAP Sybase ASE:

• It splits critical permissions between two distinct roles: the Database Administrator (DBA) and the Key Custodian.
  • The DBA handles core database tasks: creating user accounts, assigning table access, and managing general account permissions.
  • The Key Custodian’s sole responsibility is managing encryption keys—creating them, and assigning them to users who need access to encrypted data.
• This separation is intentional: neither role alone can generate the full credentials needed to access encrypted data. A DBA can grant access to tables, but can’t create or assign encryption keys; a Key Custodian can manage keys, but can’t grant table access. This reduces the risk of unauthorized access if one role is compromised.

Other Databases with Split-Trust Key Management #

Here are some examples of databases that support similar role-separated key management:

• Oracle Database: You can split key management from DBA duties using roles like ADMINISTER KEY MANAGEMENT (for key custodian-like tasks) and separate DBA roles. With Oracle Key Vault, you can even offload key management to a dedicated team entirely, ensuring DBAs never have access to encryption keys—only the ability to grant data access.
• Microsoft SQL Server: Using Extensible Key Management (EKM) or Azure Key Vault (for cloud instances), you can assign key management to a dedicated role separate from DBAs. For example, a user with ALTER ANY CREDENTIAL and permissions to manage the external key store handles keys, while DBAs manage user accounts and object permissions. Neither role can access encrypted data alone.
• PostgreSQL: With the pgcrypto extension and strict role-based access control (RBAC), you can create a dedicated key_custodian role. This role would have permissions to create and manage encryption keys, but no access to underlying data tables. DBAs, meanwhile, manage user accounts and table permissions but can’t access or modify encryption keys.

内容的提问来源于stack exchange，提问作者Sebastian Probst Eide