You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
|`Name`|The name of the keystore provider. It must not be the same as any other keystore provider previously loaded by the driver or present in this library. Null-terminated, wide-character* string.|
84
-
|`Init`|Initialisation function. If an initialisation function is not required, this field may be null.|
84
+
|`Init`|Initialization function. If an initialization function is not required, this field may be null.|
85
85
|`Read`|Provider read function. May be null if not required.|
86
86
|`Write`|Provider write function. Required if Read is not null. May be null if not required.|
87
87
|`DecryptCEK`|ECEK decryption function. This function is the reason for existence of a keystore provider, and must not be null.|
@@ -93,7 +93,7 @@ With the exception of Free, the functions in this interface all have a pair of p
93
93
```
94
94
int Init(CEKEYSTORECONTEXT *ctx, errFunc onError);
95
95
```
96
-
Placeholder name for a provider-defined initialization function. The driver calls this function once, after a provider has been loaded, but before the first time it needs it to perform ECEK decryption or Read()/Write() requests. Use this function to perform any initialisation it needs.
96
+
Placeholder name for a provider-defined initialization function. The driver calls this function once, after a provider has been loaded, but before the first time it needs it to perform ECEK decryption or Read()/Write() requests. Use this function to perform any initialization it needs.
97
97
98
98
|Argument|Description|
99
99
|:--|:--|
@@ -141,7 +141,7 @@ Placeholder name for a provider-defined ECEK decryption function. The driver cal
141
141
|`alg`|[Input] The value of the [ALGORITHM](../../t-sql/statements/create-column-encryption-key-transact-sql.md) metadata attribute for the given ECEK. Null-terminated wide-character* string. This is intended to identify the encryption algorithm used to encrypt the given ECEK.|
142
142
|`ecek`|[Input] Pointer to the ECEK to be decrypted.|
143
143
|`ecekLen`|[Input] Length of the ECEK.|
144
-
|`cekOut`|[Output] The provider shall allocate memory for the decrypted ECEK and write its address to the pointer pointed to by cekOut. It must be possible to free this block of memory using the [LocalFree](https://msdn.microsoft.com/en-us/library/windows/desktop/aa366730(v=vs.85).aspx) (Windows) or free (Linux/Mac) function. If no memory was allocated due to an error or otherwise, the provider shall set *cekOut to a null pointer.|
144
+
|`cekOut`|[Output] The provider shall allocate memory for the decrypted ECEK and write its address to the pointer pointed to by cekOut. It must be possible to free this block of memory using the [LocalFree](https://msdn.microsoft.com/library/windows/desktop/aa366730(v=vs.85).aspx) (Windows) or free (Linux/Mac) function. If no memory was allocated due to an error or otherwise, the provider shall set *cekOut to a null pointer.|
145
145
|`cekLen`|[Output] The provider shall write to the address pointed to by cekLen the length of the decrypted ECEK that it has written to **cekOut.|
146
146
|`Return Value`|Return nonzero to indicate success, or zero to indicate failure.|
147
147
@@ -158,7 +158,7 @@ Placeholder name for a provider-defined CEK encryption function. The driver does
158
158
|`alg`|[Input] The value of the [ALGORITHM](../../t-sql/statements/create-column-encryption-key-transact-sql.md) metadata attribute for the given ECEK. Null-terminated wide-character* string. This is intended to identify the encryption algorithm used to encrypt the given ECEK.|
159
159
|`cek`|[Input] Pointer to the CEK to be encrypted.|
160
160
|`cekLen`|[Input] Length of the CEK.|
161
-
|`ecekOut`|[Output] The provider shall allocate memory for the encrypted CEK and write its address to the pointer pointed to by ecekOut. It must be possible to free this block of memory using the [LocalFree](https://msdn.microsoft.com/en-us/library/windows/desktop/aa366730(v=vs.85).aspx) (Windows) or free (Linux/Mac) function. If no memory was allocated due to an error or otherwise, the provider shall set *ecekOut to a null pointer.|
161
+
|`ecekOut`|[Output] The provider shall allocate memory for the encrypted CEK and write its address to the pointer pointed to by ecekOut. It must be possible to free this block of memory using the [LocalFree](https://msdn.microsoft.com/library/windows/desktop/aa366730(v=vs.85).aspx) (Windows) or free (Linux/Mac) function. If no memory was allocated due to an error or otherwise, the provider shall set *ecekOut to a null pointer.|
162
162
|`ecekLen`|[Output] The provider shall write to the address pointed to by ecekLen the length of the encrypted CEK that it has written to **ecekOut.|
163
163
|`Return Value`|Return nonzero to indicate success, or zero to indicate failure.|
164
164
@@ -167,7 +167,8 @@ void (*Free)();
167
167
```
168
168
Placeholder name for a provider-defined termination function. The driver may call this function upon normal termination of the process.
169
169
170
-
*NB: Wide-character strings are 2-byte characters (UTF-16) due to how SQL Server stores them.*
170
+
> [!NOTE]
171
+
> *Wide-character strings are 2-byte characters (UTF-16) due to how SQL Server stores them.*
171
172
172
173
173
174
### Error Handling
@@ -183,7 +184,7 @@ The **onError** parameter points to an error-reporting function, with the follow
183
184
|Argument|Description|
184
185
|:--|:--|
185
186
|`ctx`|[Input] The context to report the error on.|
186
-
|`msg`|[Input] The error message to report. Null-terminated wide-character string. To allow parameterized information to be present, this string may contain insert-formatting sequences of the form accepted by the [FormatMessage](https://msdn.microsoft.com/en-us/library/windows/desktop/ms679351(v=vs.85).aspx) function. Extended functionality may be specified by this parameter as described below.|
187
+
|`msg`|[Input] The error message to report. Null-terminated wide-character string. To allow parameterized information to be present, this string may contain insert-formatting sequences of the form accepted by the [FormatMessage](https://msdn.microsoft.com/library/windows/desktop/ms679351(v=vs.85).aspx) function. Extended functionality may be specified by this parameter as described below.|
187
188
|...|[Input] Additional variadic parameters to fit format specifiers in msg, as appropriate.|
188
189
189
190
To report when an error has occurred, the provider calls onError, supplying the context parameter passed into the provider function by the driver and an error message with optional additional parameters to be formatted in it. The provider may call this function multiple times to post multiple error messages consecutively within one provider-function invocation. For example:
Once enabled for the connection, the behaviour of Always Encrypted may be adjusted for individual queries. See [Controlling the Performance Impact of Always Encrypted](#controlling-the-performance-impact-of-always-encrypted) below for more information.
43
+
Once enabled for the connection, the behavior of Always Encrypted may be adjusted for individual queries. See [Controlling the Performance Impact of Always Encrypted](#controlling-the-performance-impact-of-always-encrypted) below for more information.
44
44
45
45
Note that enabling Always Encrypted is not sufficient for encryption or decryption to succeed; you also need to make sure that:
46
46
@@ -280,7 +280,7 @@ This section describes the built-in performance optimizations in the ODBC Driver
280
280
281
281
If Always Encrypted is enabled for a connection, the ODBC Driver 13.1 for SQL Server will, by default, call [sys.sp_describe_parameter_encryption](https://msdn.microsoft.com/library/mt631693.aspx) for each parameterized query, passing the query statement (without any parameter values) to SQL Server. This stored procedure analyzes the query statement to find out if any parameters need to be encrypted, and if so, returns the encryption-related information for each parameter to allow the driver to encrypt them. The above behavior ensures a high-level of transparency to the client application: The application (and the application developer) does not need to be aware of which queries access encrypted columns, as long as the values targeting encrypted columns are passed to the driver in parameters.
282
282
283
-
### Per-Statement Always Encrypted Behaviour
283
+
### Per-Statement Always Encrypted Behavior
284
284
285
285
To control the performance impact of retrieving encryption metadata for parameterized queries, you can alter the Always Encrypted behavior for individual queries if it has been enabled on the connection. This way, you can ensure that `sys.sp_describe_parameter_encryption` is invoked only for queries that you know have parameters targeting encrypted columns. Note, however, that by doing so, you reduce transparency of encryption: if you encrypt additional columns in your database, you may need to change the code of your application to align it with the schema changes.
286
286
@@ -320,7 +320,8 @@ If SQL Server informs the driver that the parameter does not need to be encrypte
320
320
321
321
To reduce the number of calls to a column master key store to decrypt column encryption keys, the driver caches the plaintext CEKs in memory. After receiving the ECEK from database metadata, the driver first tries to find the plaintext CEK corresponding to the encrypted key value in the cache. The driver calls the key store containing the CMK only if it cannot find the corresponding plaintext CEK in the cache.
322
322
323
-
**Note:** In the ODBC Driver 13.1 for SQL Server, the entries in the cache are evicted after a two hour timeout. This means that for a given ECEK, the driver contacts the key store only once during the lifetime of the application or every two hours, whichever is less.
323
+
> [!NOTE]
324
+
> In the ODBC Driver 13.1 for SQL Server, the entries in the cache are evicted after a two hour timeout. This means that for a given ECEK, the driver contacts the key store only once during the lifetime of the application or every two hours, whichever is less.
324
325
325
326
## Working with Column Master Key Stores
326
327
@@ -416,13 +417,15 @@ The driver attempts to load the library identified by the ValuePtr parameter usi
416
417
417
418
`SQLSetConnectAttr` returns the usual error or success values, and additional information is available for any errors which occurred via the standard ODBC diagnostic mechanism.
418
419
419
-
NOTE: The application programmer must ensure that any custom providers are loaded before any query requiring them is sent over any connection. Failure to do so results in the error:
420
+
> [!NOTE]
421
+
> The application programmer must ensure that any custom providers are loaded before any query requiring them is sent over any connection. Failure to do so results in the error:
420
422
421
423
| Error | Description |
422
424
|:--|:--|
423
425
|`CE200`|Keystore provider %1 not found. Ensure that the appropriate keystore provider library has been loaded.|
424
426
425
-
NOTE: Keystore provider implementors should avoid the use of `MSSQL` in the name of their custom providers. This term is reserved exclusively for Microsoft use and may cause conflicts with future built-in providers. Using this term in the name of a custom provider may result in an ODBC warning.
427
+
> [!NOTE]
428
+
> Keystore provider implementors should avoid the use of `MSSQL` in the name of their custom providers. This term is reserved exclusively for Microsoft use and may cause conflicts with future built-in providers. Using this term in the name of a custom provider may result in an ODBC warning.
426
429
427
430
#### Getting the List of Loaded Providers
428
431
@@ -445,7 +448,8 @@ To allow retrieving the entire list, every Get operation returns the current pro
445
448
446
449
The `SQL_COPT_SS_CEKEYSTOREDATA` connection attribute enables a client application to communicate with loaded keystore providers for configuring additional parameters, keying material, etc. The communication between a client application and a provider follows a simple request-response protocol, based on Get and Set requests using this connection attribute. Communication is initiated only by the client application.
447
450
448
-
NOTE: Due to the nature of the ODBC calls CEKeyStoreProvider’s respond to (SQLGet/SetConnectAttr), the ODBC interface only supports setting data at the resolution of the connection context.
451
+
> [!NOTE]
452
+
> Due to the nature of the ODBC calls CEKeyStoreProvider’s respond to (SQLGet/SetConnectAttr), the ODBC interface only supports setting data at the resolution of the connection context.
449
453
450
454
The application communicates with keystore providers through the driver via the CEKeystoreData structure:
Additional detailed error information may be obtained via [SQLGetDiacRec](https://msdn.microsoft.com/library/ms710921(v=vs.85).aspx).
479
483
480
-
NOTE: The provider can use the connection handle to associate the written data to a specific connection, if it so desires. This is useful for implementing per-connection configuration. It may also ignore the connection context and treat the data identically regardless of the connection used to send the data. See [Context Association](../../connect/odbc/custom-keystore-providers.md#context-association) for more information.
484
+
> [!NOTE]
485
+
> The provider can use the connection handle to associate the written data to a specific connection, if it so desires. This is useful for implementing per-connection configuration. It may also ignore the connection context and treat the data identically regardless of the connection used to send the data. See [Context Association](../../connect/odbc/custom-keystore-providers.md#context-association) for more information.
0 commit comments