Decrypt by key not working ASP.NET sql command - asp.net

Question

I have the following problem:
I have encrypted a column in my SQL Database by using a Symmetric Key. Now I have the encrypted value in the database and when I open the key and execute the query:
SELECT Convert(varchar, DECRYPTBYKEY(ColumnName)) as ClientSecret
FROM dbo.Sample
In Management Studio query editor it is ok and it returns the decrypted value.
But when I try to execute the same thing as a SqlCommand from my ASP.NET application it returns null.
Code:
string query = "SELECT Convert(varchar, DECRYPTBYKEY(ColumnName)) as ClientSecret FROM dbo.Sample";
var con = ConfigurationManager.ConnectionStrings["connectionName"].ConnectionString;
using (SqlConnection connection = new SqlConnection(con))
{
SqlCommand command = new SqlCommand(query, connection);
connection.Open();
SqlDataReader reader = command.ExecuteReader();
try
{
while (reader.Read())
{
//the value of client secret here is null
var readerTest = reader["ClientSecret"];
}
}
finally
{
// Always call Close when done reading.
reader.Close();
}
}
My questions are the following:
First, why this does not work?
Second, is there a better way to decrypt the value of the column in the application (not by asking the server to do it) by using its encryption algorithm?

Answer 1

The only explanation that makes sense is that you already have the key open in SQL Server Management Studio since DecryptByKey requires the symmetric key to be open prior to decryption. To check which keys are open, execute the sql below just prior to selecting the data.
select * from sys.openkeys
If your intent is to combine opening the key with decrypting the data, then DECRYPTBYKEYAUTOCERT would be a good function to use. If you want to encrypt and decrypt data at the client instead of the server, you should look at SQL Server 2016 Always Encrypted. Be careful how it is configured because using deterministic encryption with a data set having low cardinality could result in the ability for a bad actor to create a hash table to indirectly decrypt the data. Also, generally clients are more prone to attack than servers.