Repository navigation
Feature | Async friendly Always Encrypted support #3672
Description
Always Encrypted types today don't support async APIs in base class as well as in implementations, leading to sync-over-async in Async workflows. This gap is important to fill for a true async workflow experience when executing commands where encryption/decryption is needed to be performed.
This will be covered in following tasks:
- Introduce Async API counterparts for AE base class #3673
- Implement async APIs in Always Encrypted Azure Key Vault provider #4540
- Add async counterparts to the enclave provider hierarchy (Phase 3, partial) #4541
- Implement async counterparts in all Enclave provider implementations (Add async counterparts to the enclave provider hierarchy (Phase 3, partial) #4541):
- NoneAttestationEnclaveProvider
- AzureAttestationEnclaveProvider
- VirtualizationBasedSecurityEnclaveProviderBase
- Implement Async API usage in Async code paths
- Testing and code coverage
Implementation PRs
-
Use the async Always Encrypted key store APIs on async execution paths #4585 — Async key-store API usage in execution paths (open, draft).
-
Add asynchronous enclave delegate operations #4886 — Async enclave-delegate operations (open, ready for review).
-
Await enclave attestation in asynchronous command execution #4887 — Async enclave attestation in command execution, stacked on Add asynchronous enclave delegate operations #4886 (open, ready for review).
Async call-path integration PRs are open. End-to-end enclave-server validation and overall test coverage remain incomplete.
Remaining integration gaps
- Wire async key decryption into
SqlBulkCopyasync execution (CopyBatchesAsync→TdsParser.LoadColumnEncryptionKeyscurrently calls synchronousDecryptSymmetricKey). This pre-existing path is outside Use the async Always Encrypted key store APIs on async execution paths #4585 and remains follow-up work. - Run enclave-specific retry/reuse integration coverage with enclave-enabled server configuration; these cases were skipped in Use the async Always Encrypted key store APIs on async execution paths #4585 build 184898.
Metadata
Metadata
Assignees
Type
Projects
- Status
Activity
8 remaining items
Implement async APIs in Always Encrypted Azure Key Vault provider (#4540
priyankatiwari08 commentedon Sep 17, 2026
/triage
github-actions commentedon Sep 17, 2026
🔍 Triage Summary (on-demand re-triage)
Area\AKV Provider(Always Encrypted enclave providers and encryption/decryption async path)Analysis
This is a milestone-tracked (8.0.0) feature/epic issue to eliminate sync-over-async behavior in Always Encrypted (AE) workflows by adding true async counterparts across the base classes, key store providers, and enclave provider implementations (
NoneAttestationEnclaveProvider,AzureAttestationEnclaveProvider,VirtualizationBasedSecurityEnclaveProviderBase). Two of the linked sub-tasks (#3673, #4540, #4541) are already merged/closed, and the remaining work is enclave provider async implementations, wiring async APIs into async code paths, and adding test coverage. This is a design-sensitive, internally-maintained effort (per@mdaigle's comment) — not yet open to external contribution. Severity: P2 (planned engineering improvement, not a defect).Next Steps
@mdaigle's earlier comment; external contribution (e.g. from@RutulPatel8) should wait until the internal design discussion for enclave provider async support concludes, to avoid conflicting approaches toTask.FromResult-based fallbacks vs. true async implementations.NoneAttestationEnclaveProvider/AzureAttestationEnclaveProvider/VirtualizationBasedSecurityEnclaveProviderBase— sequencing these two efforts (refactor vs. async support) could reduce merge conflicts and duplicated work.Bump Microsoft.Data.SqlClient from 6.1.6 to 7.1.0 (#66)
Bump the microsoft group with 11 updates (#1370)
Bump the nuget-ecosystem group with 6 updates (#16)