Always encrypted + Entity Framework + Azure

[JerryMungo]

Has anyone successfully implemented solutions using all 3 of the above?
We're having some hassles getting it to work and there are articles out there that cover two of those three but I'm struggling to find anything that covers all 3.

Any help would be appreciated.

 

[Traq]

Database first or code first implementation?

 

[JerryMungo]

Database first or code first implementation?

Code first :/

 

[Traq]

In a code first design I can't comment, however we do use it with a database first design.

 

[JerryMungo]

In a code first design I can't comment, however we do use it with a database first design.

No worries, thanks!

 

[Spacerat]

In a code first design I can't comment, however we do use it with a database first design.

Not a fan of EF, but why should it matter if CF or DBF?

 

[Traq]

Not a fan of EF, but why should it matter if CF or DBF?

EF is not aware of encrypted columns when using a code first design. You will need to write the SQL as additional statements in your code. It also does not work with initialisation.

In DB first, then the encryption layer is abstracted from the application where you only need to make minor changes, and ensure that you update the connection string accordingly (column encryption setting = enabled).

This will also support scenarios where you are using Azure Keyvault for storing the certificates.

 

[Spacerat]

EF is not aware of encrypted columns when using a code first design. You will need to write the SQL as additional statements in your code. It also does not work with initialisation.

In DB first, then the encryption layer is abstracted from the application where you only need to make minor changes, and ensure that you update the connection string accordingly (column encryption setting = enabled).

This will also support scenarios where you are using Azure Keyvault for storing the certificates.

Ok i see. Thanks

For encrypted columns and using an ORM I prefer the ORM to do the encryption work. The lower you push the encrypt/decrypt the safer it tends to be. But then you have open data across the wire...