Support for client side encryption

[mshiels]

Not sure if it's possible, but it would sure be nice to support the client side encryption available in the normal Azure storage SDK. Since most of the encryption stuff has fixed size result blocks it should be mathematically doable just very unsure how you would hook it all together for parallel type operations.

[blueww]

Thanks for the suggestion!
DMlib currently don't support this feature, we have opened a task to track it.

[drocx]

We need client side encryption for one of our products (Azure Key Vault).

Will BlobEncryptionPolicy and BlobRequestOptions be supported by the libary in the near feature?

[blueww]

As discussed with @EmmaZhu , she will help to follow up.

[EmmaZhu]

Hi @drocx ,

We do want to support BlobRequestOptions, but don't have a valid solution for now. It's already in our backlog, only without definite plan for now,

Thanks
Emma

[EmmaZhu]

Hi @drocx ,

Sorry for misleading before.

BlobEncryptionPolicy only works in interfaces to uploading/downloading a whole file/stream in Azure Storage Client Library, but DMLib leverages Azure Storage Client Library's interfaces to uploading/downloading chunks of blobs which BlobEncryptionPolicy does not apply to. So client side encryption in Azure Storage Client Library won't work in DMLib, even if DMLib exposes setting BlobRequestOptions.

Could you share some details on your scenarios? Would you want to upload/download single file with client side encryptions, or would you want to upload/download a directory with client side encryptions? If you only need to upload/download single files, maybe directly calling Azure Storage Client Library is a better solution. If you'd need to upload/download a directory, DMLib may need to consider to support client side encryption by itself.

Thanks
Emma

[drocx]

@EmmaZhu
Hello and sorry for my late response.
Here is our scenario:
We upload large customer database backups to azure blob storage. All files are encrypted on the client using azure key vault because the database contains sensitive data.
After the upload is complete our support teams downloads and decryt the database to reproduce errors.

In performance testing with unencrypted data, this library had a significant performance boost and better visual feedback for our customer.

[vaibhavramdasi]

@EmmaZhu We are also in need of Client side support for enc/dec. We want to download several asymmetrically encrypted files using BlobEncryptionPolicy and create Zip Archive of those files.