Does SQL Server TDE decrypts when it enters the buffer pool and encrypts when it leaves

Question

Been searching but no clear understand. TDE encrypts at rest not in flight. But does in flight refer to only between server and client or also between server and SAN storage.

When a database uses TDE, does a page, when it is written to the disk, leave the buffer pool encrypted. So if somebody were to sniff the wire between the DB server and the SAN see only encrypted data. Or does it flow unencryted to the SAN and then is encrypted as its being saved. Same when is it decrypted, when it reaches the buffer pool or when it leaves the SAN? (note I understand when it goes to the client it is not encrypted)

This link was related to backups Is network traffic encrypted when writing remote backups using SQL Server TDE? Does it apply to data also?

Reference to docs would be great.

Answer 1

Yes, it is encrypted both "at rest" on disk, and also "in flight" between disk and SQL server.

https://learn.microsoft.com/en-us/sql/relational-databases/security/encryption/transparent-data-encryption

TDE performs real-time I/O encryption and decryption of the data and log files. The encryption uses a database encryption key (DEK), which is stored in the database boot record for availability during recovery. The DEK is a symmetric key secured by using a certificate stored in the master database of the server or an asymmetric key protected by an EKM module. TDE protects data "at rest", meaning the data and log files.

In other words, the data isn't decrypted until it gets to the SQL server.

Think of it this way: for it to be decrypted in-flight, the SAN itself would have to decrypt it before fulfilling the request and sending the data to SQL. And we know it isn't doing that, it is SQL that is encrypting/decrypting.