Cleanup | Always Encrypted cryptographic algorithm factories#4138
Merged
cheenamalhotra merged 6 commits intodotnet:mainfrom Apr 24, 2026
Merged
Conversation
This implemented theoretical support for allowing clients to register their own cryptographic algorithms. This was never used, so has been replaced with a static mapping. Placed its replacement into the AlwaysEncrypted namespace.
Moved into the AlwaysEncrypted namespace, enabled nullability annotations, renamed
This includes: * Rename to AeadAes256CbcHmac256Factory. * Enable nullability annotations. * Whitespace/comment changes. * Move the version constant into the algorithm itself (and out of the factory.) * Minor improvement to StringBuilder concatenation.
paulmedynski
added
the
Code Health 💊
Contributor
|
/azp run |
|
Azure Pipelines successfully started running 2 pipeline(s). |
paulmedynski
requested changes
Apr 13, 2026
github-project-automation
Bot
moved this from In review
to In progress
in SqlClient Board
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #4138 +/- ##
==========================================
- Coverage 74.17% 64.29% -9.89%
==========================================
Files 279 272 -7
Lines 42983 65784 +22801
==========================================
+ Hits 31884 42295 +10411
- Misses 11099 23489 +12390
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
Promoted AeadAes256CbcHmac256Factory to a real singleton class. Removed references to its constructor in the ExceptionsAlgorithmErrors tests and in EnclaveDelegate.
paulmedynski
approved these changes
Apr 16, 2026
Member
|
/azp run |
|
Azure Pipelines successfully started running 2 pipeline(s). |
cheenamalhotra
approved these changes
Apr 24, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This PR continues some Always Encrypted cleanup and modernization work. It moves more of the internal AE-related classes into the new AlwaysEncrypted namespace, tidying them up as the PR proceeds.
We moved and modernized the public providers which decrypt/encrypt the column master keys in v7.0 GA, and now we proceed to the next stage: the factories which convert a cryptographic algorithm's name to its implementation.
Classes in question:
SqlClientEncryptionAlgorithmFactoryList: after being moved to the new namespace, I've simplified the name toEncryptionAlgorithmFactoryList. This class was slightly more complex than it needed to be: it allowed the provider to register its own cryptographic algorithm into aConcurrentDictionary. This registration process was only ever used to build a static list of one entry, and was never exposed. I've thus replaced it with a simpleswitchblock.SqlClientEncryptionAlgorithmFactory: renamed toEncryptionAlgorithmFactory. No changes beyond comments, this was only ever a base class.SqlAeadAes256CbcHmac256Factory: renamed toAeadAes256CbcHmac256Factory. These are largely just style, comment and whitespace changes. I've also sealed the class and moved the floatingAlgorithmVersionconstant into the actual algorithm's class.I'm keeping the column encryption key handling in a separate PR so that any security review can be done on its own. I think these can provide a measurable improvement to Always Encrypted's memory usage.
Issues
None.
Testing
There were a few tests which referred to this using reflection; I've caught those, and they continue to pass. We've got reasonable test coverage for Always Encrypted so I've not added anything else.