Azure SQL Always Encrypted: running range queries on data the database can't read
adnan_hashmi · x · 2026-11-13
Microsoft's Azure SQL team explains how Always Encrypted lets SQL Server run real queries—including range comparisons and LIKE patterns—against data it never holds keys for. Encryption at rest only stops someone stealing the disk; it does nothing against administrators of the running server, since databases decrypt data into memory to operate. That gap matters greatly for health records and financial data where the cloud operator is in the threat model. The SIGMOD 2020 paper bluntly claimed SQL Server was the first and only industrial-strength database offering this protection.
More from Infra
- Michael Burry says 'get out' of Nvidia, citing hidden debt and leveraged customer financing — SumitGup · 2026-11-13
- Nvidia's $500B financing backstop with six asset managers has produced zero deals in months — GaryMarcus · 2026-11-13
- After Microsoft outage, open-weight model torrent seeders hit record 30,000 — WolframRvnwlf · 2026-11-13
- AWS disputes outage reports: services 'have been fine', check Health Dashboard — Kyrannio · 2026-11-13
- The math says GPU export controls are working: only a sliver of Nvidia output leaks — bookwormengr · 2026-11-13
- NIDO ships fully offline open-source Android AI assistant with encrypted local RAG and E2EE mesh — NIDO_007 · 2026-11-13