{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-385-measure-encrypted-queue-storage-messages-after-their-envelope-is-encoded/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-385-measure-encrypted-queue-storage-messages-after-their-envelope-is-encoded/", "slug": "dse-20260909-385-measure-encrypted-queue-storage-messages-after-their-envelope-is-encoded", "url": "https://update.dsesecurity.com/updates/dse-20260909-385-measure-encrypted-queue-storage-messages-after-their-envelope-is-encoded/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-385-measure-encrypted-queue-storage-messages-after-their-envelope-is-encoded.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-385-measure-encrypted-queue-storage-messages-after-their-envelope-is-encoded/" }, "title": "Measure encrypted Queue Storage messages after their envelope is encoded", "summary": "The queue's message limit applies to encryption metadata and encoded content, not just the original application payload.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:25:31+00:00", "modified_at": "2026-09-10T02:01:56+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 249, "potentially_affected": "Azure Queue Storage applications using supported .NET or Python client-side encryption.", "dse_recommendation": "Validate the final encoded envelope size and consumer compatibility with representative payloads.", "primary_source": { "name": "Client-side encryption for queues - Azure Storage | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/storage/queues/client-side-encryption", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Client-side Queue Storage encryption adds encryption metadata that counts toward the 64 KB message limit. The encrypted message is Base64-encoded, which expands the transmitted content. A plaintext-size check therefore does not establish that the completed encrypted message fits.

\n

Microsoft no longer recommends client-side encryption v1 because of a CBC implementation vulnerability. Migration requires a v2-capable client. For short-lived queue messages, Microsoft says separate decryption and re-encryption should not be necessary: older messages rotate through normal consumption. For most scenarios, Microsoft recommends service-side encryption for simpler operation. Microsoft Learn.

\n

Applicability

\n

Identify why client-side encryption is required, the producer and consumer library versions, and the actual message format. This brief does not recommend introducing legacy encryption or invent a universal safe plaintext limit.

\n

DSE recommendation

\n

DSE recommends validating the complete encoded envelope before sending a message. Test realistic payload variation and establish explicit handling for oversized messages rather than relying on a fixed estimate of overhead. Coordinate v2-capable producer and consumer changes, and review older messages’ normal consumption rather than assuming a separate bulk-conversion step is required.

\n

Verification

\n

In an approved test queue, send harmless representative messages around the application’s intended size boundary using the actual supported library. Confirm both service acceptance and successful consumer decryption. Record encoded size, library version and result without logging plaintext secrets or key material. Treat rejection or decryption failure as an unresolved contract mismatch before increasing the production payload allowance.

\n

Official references

\n

Microsoft Learn: Client-side encryption for queues. Source retrieved September 9, 2026.

", "content_text": "Source facts\nClient-side Queue Storage encryption adds encryption metadata that counts toward the 64 KB message limit. The encrypted message is Base64-encoded, which expands the transmitted content. A plaintext-size check therefore does not establish that the completed encrypted message fits.\nMicrosoft no longer recommends client-side encryption v1 because of a CBC implementation vulnerability. Migration requires a v2-capable client. For short-lived queue messages, Microsoft says separate decryption and re-encryption should not be necessary: older messages rotate through normal consumption. For most scenarios, Microsoft recommends service-side encryption for simpler operation. Microsoft Learn.\nApplicability\nIdentify why client-side encryption is required, the producer and consumer library versions, and the actual message format. This brief does not recommend introducing legacy encryption or invent a universal safe plaintext limit.\nDSE recommendation\nDSE recommends validating the complete encoded envelope before sending a message. Test realistic payload variation and establish explicit handling for oversized messages rather than relying on a fixed estimate of overhead. Coordinate v2-capable producer and consumer changes, and review older messages’ normal consumption rather than assuming a separate bulk-conversion step is required.\nVerification\nIn an approved test queue, send harmless representative messages around the application’s intended size boundary using the actual supported library. Confirm both service acceptance and successful consumer decryption. Record encoded size, library version and result without logging plaintext secrets or key material. Treat rejection or decryption failure as an unresolved contract mismatch before increasing the production payload allowance.\nOfficial references\nMicrosoft Learn: Client-side encryption for queues. Source retrieved September 9, 2026.", "content_markdown": "## Source facts\n\nClient-side Queue Storage encryption adds encryption metadata that counts toward the 64 KB message limit. The encrypted message is Base64-encoded, which expands the transmitted content. A plaintext-size check therefore does not establish that the completed encrypted message fits.\n\nMicrosoft no longer recommends client-side encryption v1 because of a CBC implementation vulnerability. Migration requires a v2-capable client. For short-lived queue messages, Microsoft says separate decryption and re-encryption should not be necessary: older messages rotate through normal consumption. For most scenarios, Microsoft recommends service-side encryption for simpler operation. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/storage/queues/client-side-encryption).\n\n## Applicability\n\nIdentify why client-side encryption is required, the producer and consumer library versions, and the actual message format. This brief does not recommend introducing legacy encryption or invent a universal safe plaintext limit.\n\n## DSE recommendation\n\nDSE recommends validating the complete encoded envelope before sending a message. Test realistic payload variation and establish explicit handling for oversized messages rather than relying on a fixed estimate of overhead. Coordinate v2-capable producer and consumer changes, and review older messages’ normal consumption rather than assuming a separate bulk-conversion step is required.\n\n## Verification\n\nIn an approved test queue, send harmless representative messages around the application’s intended size boundary using the actual supported library. Confirm both service acceptance and successful consumer decryption. Record encoded size, library version and result without logging plaintext secrets or key material. Treat rejection or decryption failure as an unresolved contract mismatch before increasing the production payload allowance.\n\n## Official references\n\n[Microsoft Learn: Client-side encryption for queues](https://learn.microsoft.com/en-us/azure/storage/queues/client-side-encryption). Source retrieved September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-385-measure-encrypted-queue-storage-messages-after-their-envelope-is-encoded/", "url": "https://update.dsesecurity.com/updates/dse-20260909-385-measure-encrypted-queue-storage-messages-after-their-envelope-is-encoded/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-385-measure-encrypted-queue-storage-messages-after-their-envelope-is-encoded/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Measure encrypted Queue Storage messages after their envelope is encoded", "item": "https://update.dsesecurity.com/updates/dse-20260909-385-measure-encrypted-queue-storage-messages-after-their-envelope-is-encoded/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-385-measure-encrypted-queue-storage-messages-after-their-envelope-is-encoded/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-385-measure-encrypted-queue-storage-messages-after-their-envelope-is-encoded/", "url": "https://update.dsesecurity.com/updates/dse-20260909-385-measure-encrypted-queue-storage-messages-after-their-envelope-is-encoded/", "headline": "Measure encrypted Queue Storage messages after their envelope is encoded", "description": "The queue's message limit applies to encryption metadata and encoded content, not just the original application payload.", "abstract": "The queue's message limit applies to encryption metadata and encoded content, not just the original application payload.", "articleBody": "Source facts\nClient-side Queue Storage encryption adds encryption metadata that counts toward the 64 KB message limit. The encrypted message is Base64-encoded, which expands the transmitted content. A plaintext-size check therefore does not establish that the completed encrypted message fits.\nMicrosoft no longer recommends client-side encryption v1 because of a CBC implementation vulnerability. Migration requires a v2-capable client. For short-lived queue messages, Microsoft says separate decryption and re-encryption should not be necessary: older messages rotate through normal consumption. For most scenarios, Microsoft recommends service-side encryption for simpler operation. Microsoft Learn.\nApplicability\nIdentify why client-side encryption is required, the producer and consumer library versions, and the actual message format. This brief does not recommend introducing legacy encryption or invent a universal safe plaintext limit.\nDSE recommendation\nDSE recommends validating the complete encoded envelope before sending a message. Test realistic payload variation and establish explicit handling for oversized messages rather than relying on a fixed estimate of overhead. Coordinate v2-capable producer and consumer changes, and review older messages’ normal consumption rather than assuming a separate bulk-conversion step is required.\nVerification\nIn an approved test queue, send harmless representative messages around the application’s intended size boundary using the actual supported library. Confirm both service acceptance and successful consumer decryption. Record encoded size, library version and result without logging plaintext secrets or key material. Treat rejection or decryption failure as an unresolved contract mismatch before increasing the production payload allowance.\nOfficial references\nMicrosoft Learn: Client-side encryption for queues. Source retrieved September 9, 2026.", "datePublished": "2026-09-10T00:25:31+00:00", "dateModified": "2026-09-10T02:01:56+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-385-measure-encrypted-queue-storage-messages-after-their-envelope-is-encoded/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-385-measure-encrypted-queue-storage-messages-after-their-envelope-is-encoded/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Measure encrypted Queue Storage messages after their envelope is encoded" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 249, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Client-side encryption for queues - Azure Storage | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/storage/queues/client-side-encryption" } } ] } }