Always Encrypted | Align reads of CekMdVersion and EkValueCount with TDS specification

[edwardneal]

Description

SqlClient contains a the structure of a table of CIPHER_INFO entries. The table is represented as a SqlTceCipherInfoTable and each entry is represented as a SqlTceCipherInfoEntry instance. This corresponds to an EK_INFO structure in the TDS specification. A table of EK_INFO entries appears in the COLMETADATA structure.

In the TDS specification, the EK_INFO structure's CekMdVersion field is defined as a ULONGLONG and the COLMETADATA structure's EkValueCount field is defined as a USHORT.

This PR aligns SqlClient with these type definitions. The cekMdVersion field on SqlTceCipherInfoTable is currently defined as an eight byte array, and is redefined as a ulong. This eliminates one allocation, so it technically improves performance (marginally.) The tableSize is currently defined a short, and is redefined as a ushort. This is a correctness improvement and a bugfix in an edge case where the same column is encrypted with an unreasonably large number of encryption keys.

One slight edge case lies in SqlCommand.Encryption.cs, where we read the CekMdVersion from a byte array as a little-endian ulong. This byte array is the result of reading the column_encryption_key_metadata_version column from the first result set of sp_describe_parameter_encryption, and this column is declared as binary(8). I've used BinaryPrimitives.ReadUInt64LittleEndian to bridge this gap between the stored procedure's result set and the TDS specification.

Issues

None.

Testing

Automated Always Encrypted tests continue to pass.

[cheenamalhotra]

/azp run

[azure-pipelines]

Azure Pipelines successfully started running 2 pipeline(s).

[apoorvdeshmukh]

/azp run

[azure-pipelines]

Azure Pipelines successfully started running 2 pipeline(s).

[Copilot]

Pull request overview

This PR aligns Always Encrypted metadata parsing/serialization with the MS-TDS specification by treating CekMdVersion as an 8-byte ULONGLONG (ulong) and EkValueCount/CEK table size as USHORT (ushort). This improves correctness for large key tables and removes unnecessary allocations by avoiding intermediate byte-array representations.

Changes:

• Update CEK metadata version handling from byte[8]/byte[] to ulong across the Always Encrypted metadata flow.
• Read CEK table size as ushort (instead of short) when processing COLMETADATA cipher info tables.
• Adjust functional Always Encrypted tests/utilities to match the updated internal signatures and representations.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
src/Microsoft.Data.SqlClient/tests/FunctionalTests/AlwaysEncryptedTests/Utility.cs	Updates test reflection helper signature to pass CEK metadata version as ulong.
src/Microsoft.Data.SqlClient/tests/FunctionalTests/AlwaysEncryptedTests/ExceptionsAlgorithmErrors.cs	Updates test calls to the helper to provide CEK metadata version as a numeric ulong value.
src/Microsoft.Data.SqlClient/src/Microsoft/Data/SqlClient/TdsParser.cs	Reads CekMdVersion as 8-byte integer and reads CEK table size as ushort; updates bulk-copy serialization to write ulong.
src/Microsoft.Data.SqlClient/src/Microsoft/Data/SqlClient/SqlCommand.Encryption.cs	Converts binary(8) metadata version from sp_describe_parameter_encryption into a ulong using BinaryPrimitives.
src/Microsoft.Data.SqlClient/src/Microsoft/Data/SqlClient/ColumnEncryptionKeyInfo.cs	Stores/serializes key metadata version as ulong and writes it as little-endian bytes.
src/Microsoft.Data.SqlClient/src/Microsoft/Data/SqlClient/AlwaysEncryptedHelperClasses.cs	Propagates ulong CEK metadata version through cipher info structures and serialized parameter wire format.