EntityFrameworkCore.Crypto.DataEncryption 10.7.0

• net10.0

  • MailKit (>= 4.18.2)
  • Microsoft.EntityFrameworkCore (>= 10.0.14)
  • Microsoft.Extensions.Caching.Memory (>= 10.0.14)
  • Microsoft.Extensions.Hosting.Abstractions (>= 10.0.14)
  • Microsoft.Extensions.Http (>= 10.0.14)
  • Microsoft.Extensions.Options.DataAnnotations (>= 10.0.14)
  • Microsoft.ML (>= 5.0.1)
  • Microsoft.ML.TimeSeries (>= 5.0.1)

Version 10.7.0 for .NET 10 and EF Core 10

Field-level encryption for EF Core that your application, your team and your auditors can rely on: searchable, fast, safe under load, and now for every .NET language.

WHAT'S NEW
- F# and Visual Basic, first class. Use the library from C#, F# or Visual Basic, with examples for each in the documentation. Write your own encryption provider in any of them with the new EncryptionCryptoProviderBase class: override Encrypt and Decrypt and you are done.
- Accent-insensitive search. HasSearchIndex(caseInsensitive: true, accentInsensitive: true) and a search for "jose" finds "José", "nguyen" finds "Nguyễn". Your stored data keeps its accents.
- Typo-tolerant search. WhereSimilar(c => c.Name, "Jhon Smith", maxEdits: 1) finds "John Smith". Results are exact: nothing that matches is missed, nothing that doesn't is returned.
- AnyAsync and FirstOrDefaultAsync on encrypted searches. They stop at the first confirmed match instead of loading every row.
- SearchIndexBackfill.RebuildAsync. Re-index a table after changing the index key or search options, in batches, safely resumable, touching only the rows that change.
- A smarter query guard. It now also catches GroupBy, Join, Distinct, Equals and aggregates on encrypted columns, and the comparison operators Visual Basic generates. Queries that cannot work on ciphertext fail fast with a clear message instead of quietly returning the wrong answer.

FASTER
- Search indexing: 2x faster, 16x less memory per value.
- Search queries and fuzzy matching: 2x to 2.7x faster.
- Blind-index lookups: 35% faster, 60% less memory.
- Reading legacy AES-CBC data: 12x faster.
- One shared AES-GCM provider now handles 5.5 million encrypt-and-decrypt operations per second across 12 cores, up from 3.4 million.
- SaveChanges does less work per entity, and index backfill keeps the same speed from the first row to the last, however large the table.

BUILT FOR PRODUCTION LOAD
- One provider instance is safe to share across every thread, on Windows and on Linux and in containers. Register it once and use it everywhere.
- Important for Linux and container deployments: in earlier versions, a single AES-GCM provider used by many threads at the same moment on Linux could fail, and in rare cases return incorrect data. This release fixes it. If you run on Linux or in containers, upgrade.
- Clearer errors: the AES-CBC migration provider now says why a value cannot be decrypted, and a failed rollback during key rotation can no longer hide the original error.
- Search index keys are held more tightly: no second copy of the key in memory, and buffers that held plaintext are wiped after use.

ALSO INCLUDED
- Exact Contains, StartsWith and EndsWith search on encrypted columns, with the key never sent to the database.
- In-application sorting of encrypted columns with culture and null ordering, protected by a row limit that never silently truncates.
- Blind-index equality and IN-list lookups (WhereBlindEquals, WhereBlindIn) and per-column normalization.
- EncryptionRotator: verified, resumable re-encryption for key rotation and AES-CBC to AES-GCM migration, with no downtime.
- Tolerant decryption: optionally read an unreadable value as null, log it without any data, and keep the query running.
- Cloud key management (Azure Key Vault, AWS KMS, HashiCorp Vault), convention-based auto-encryption, health checks and OpenTelemetry metrics.
- Enterprise: ML-powered PII discovery, Crypto Sentinel exfiltration detection, email and webhook alerts, decryption audit trail, and GDPR / DPDP compliance reports.

UPGRADING
- Drop-in upgrade: no public API was removed or changed, and no data migration is needed. Everything already encrypted, and every existing search and blind index, keeps working as it is.
- The query guard is stricter. If a query now raises EncryptedQueryNotSupportedException, it was returning wrong results before; the message tells you which method to use instead.
- Visual Basic users: comparing an encrypted column with =, <> or Like in a query now raises a clear error instead of silently returning no rows. Switch those queries to WhereBlindEquals, WhereContains or the other search methods.
- Turning on accent-insensitive search for existing data: run SearchIndexBackfill.RebuildAsync once.
- Requires .NET 10 and Microsoft.EntityFrameworkCore 10.0.14 or later.

LICENSING
- Free Community edition for projects under $2,000 annual revenue: field encryption, key rotation, cloud KMS, blind indexing, search and auto-encryption.
- Enterprise adds ML PII discovery, Crypto Sentinel, alerting, the audit trail and compliance reports, with unlimited developers and projects: Annual $2,999, 3-Year $5,999, 5-Year $6,999.
- Develop freely: on a developer machine every feature works without a key and nothing nags you. Deployed environments validate the key at startup, fully offline. See https://efcore-encryption.com/#plans

Documentation: https://efcore-encryption.com/docs