Where does Always Encrypted, SQL Server type encryption actually occur? How does it actually work?

Question

Your documentation indicates the following:

"Encryption and decryption take place in the client driver, so that the process is transparent to client applications."

Your question is worded as follows:

"If data is encrypted using Always Encrypted, when will the data be decrypted?"

The accepted answer is phrased:

"In the client application"

To me, the definitions of application and driver are quite different. Please correct the document or question and please provide additional clarity how this works.

This question is related to the following Learning Module

Answer 1

Hi Wisneski, Jeffrey,

Thank you for contacting us from the Microsoft Q&A forum.; we appreciate your questions about the SQL Server Always Encrypted feature as well as a good eye toward how this works.

You are correct in noting that the encryption and decryption processes occur in the client driver, which is an integral part of the client application. The documentation aims to convey that the encryption and decryption processes are handled transparently by the client driver, allowing client applications to interact with the encrypted data without needing to manage the encryption details directly.

To clarify further, when data is encrypted using Always Encrypted, it is indeed the client application (through the client driver) that performs the decryption when the data is retrieved. This means that the application can work with the data as if it were unencrypted, while the actual encryption and decryption processes are managed by the driver.

Thank you very much for letting us know how best to phrase some of the documentation. We will consider your input for future updates to make it clearer. If you have any more questions or need further assistance, please do not hesitate to contact us.

If you have found the answer provided to be helpful, please click on the "Upvote and Accept Answer" button so that it is useful for other members in the Microsoft Q&A community.