Getting To Know SQL Server Encryption Capabilities
summary
TDE encrypts data at rest and does not protect data in transit, so use SSL/TLS (SQL Server supports TLS 1.2) for channel encryption. Symmetric keys are fast but require an authenticator to prevent whole-value substitution attacks. The demo shows hash-bucket partitioning reduces a 110,000-row encrypted credit card search from ~1.2s and 2,731 reads to 2ms and 387 reads by indexing the hash. Always Encrypted uses AEAD AES-256-CBC-HMAC-SHA256 and keeps column master keys off-server (client-held).
AI-written summary · about
chapters (9)
- 0:00Introduction
- 0:35Terminology Refresher
- 6:09Transparent Data Encryption
- 8:52Secure Connections
- 13:15Asymmetric Encryption
- 20:54Demo
- 25:45Hash Groups
- 30:12Always Encrypted
- 36:47Demonstration
related talks
51mWhere should I be encrypting my data
47mData at Rest Encryption Going Beyond the Basics to Address Modern Attacks
48mProtecting the confidentiality and integrity of your high value data with Azure SQL and SQL Server 2- 51mWhere should I be encrypting my data
56mHacking Exposé Too: Just How Transparent is TDE?
32mDesigning secure Azure SQL Database solutions
40mUnderstanding the cryptographic controls in Azure SQL Database
43mConfidential development with Always Encrypted using enclaves