Love to code, although it bugs me.

SQL Server 2016: Always Encrypted feature

No comments

So, I was going through the documentation for SQL Server 2016 Always Encrypted feature and I read this paragraph:

The driver encrypts the data in sensitive columns before passing the data to SQL Server, and automatically rewrites queries so that the semantics to the application are preserved.

We’ll still be able to get the execution plan for the query from the server, but regarding optimization, similar issues to the ones that arise from ORM frameworks might pop-out.

Anyway, going further down the same documentation, you get the feature constraints, like:

  • Queries can perform equality comparison on columns encrypted using deterministic encryption, but no other operations
  • Indexing columns encrypted using randomized encryption is not supported.
  • Query parameters that map to encrypted columns must be passed as driver-level parameters.

Also, you have some characteristics that disallow the use of encryption, like:

  • Columns that are referenced by statistics
  • Columns using alias type
  • Partitioning columns
  • Columns with default constraints

The case is clear that it’s a wonderful

security-wise

feature. Before adopting it on your business driven development, make sure it won’t become a source for technical debt for your current code base and future developments.

No comments :

Post a Comment