Encryption permissions

[djj55]

Hello, SQL 2008R2
I created a test using MS How to: Encrypt a Column of Data
This went well. I wanted to test the key/certificate so I got a user to try and run:

USE AdventureWorks2008R2;
GO
 
OPEN SYMMETRIC KEY SSN_Key_01
   DECRYPTION BY CERTIFICATE HumanResources037;
GO
 
SELECT NationalIDNumber
	, EncryptedNationalIDNumber AS 'Encrypted ID Number'
	, CONVERT(nvarchar, DecryptByKey(EncryptedNationalIDNumber)) AS 'Decrypted ID Number'
    FROM HumanResources.Employee;
GO
 
CLOSE SYMMETRIC KEY SSN_Key_01

They can access the database and even run a select statement getting the encrypted value. However, when they execute the OPEN command they get an error.

Msg 15151, Level 16, State 1, Line 2
Cannot find the certificate 'HumanResources037', because it does not exist or you do not have permission.

So I executed

USE AdventureWorks2008R2;
GO
GRANT REFERENCES ON SYMMETRIC KEY::SSN_Key_01 TO PUBLIC;
GO
GRANT REFERENCES ON CERTIFICATE::HumanResources037 TO PUBLIC; 
GO

But they still code not access the certificate.

Then I found a blog that suggested using GRANT CONTROL of the cert.

This worked.

Does this open the data to too many?

Thanks


djj
The Lord is my shepherd (Psalm 23) - I need someone to lead me!