Working with Encryption
1. Using Encryption at Rest
| Aspect | Detail |
|---|---|
| Edition | Enterprise / Atlas |
| Engine | WiredTiger AES-256 |
| Config | security.enableEncryption: true + encryptionKeyFile or KMIP |
2. Configuring KMIP for Key Management
| Setting | Detail |
|---|---|
| security.kmip.serverName | KMIP server host |
| security.kmip.clientCertificateFile | Auth cert |
| security.kmip.keyIdentifier | Existing key (optional) |
3. Understanding Client-Side Field Encryption
| Mode | Detail |
|---|---|
| CSFLE | Encrypts fields before sending to server |
| Keys | DEKs in __keyVault, wrapped by CMK (KMS) |
| Server visibility | Encrypted blobs only |
4. Creating Data Encryption Keys
const clientEnc = client.getClientEncryption();
const keyId = await clientEnc.createDataKey("aws", { masterKey: { region:"us-east-1", key:"arn:..." } });5. Encrypting Specific Fields
| Algorithm | Use |
|---|---|
| AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic | Equality queryable |
| ...Random | Stronger; not queryable |
6. Decrypting Encrypted Fields
| Aspect | Detail |
|---|---|
| Automatic | Driver reads schema and decrypts |
| Explicit | clientEnc.decrypt(value) |
7. Using Automatic Encryption
| Requirement | Detail |
|---|---|
| mongocryptd / shared lib | Performs schema-based redaction |
| Schema | JSON schema with encrypt keyword |
8. Using Explicit Encryption
| API | Detail |
|---|---|
| clientEnc.encrypt(value, opts) | Per-field encrypt |
| Use | When schema not feasible |
9. Rotating Encryption Keys
| Level | Method |
|---|---|
| CMK | Re-wrap DEKs via clientEnc.rewrapManyDataKey() |
| DEK | Create new key + re-encrypt fields |
10. Configuring Queryable Encryption 7.0 GA
| Capability | Detail |
|---|---|
| Server-side queries | Equality, range (preview) on encrypted fields |
| Config | encryptedFields per collection |
| Benefit | Server never sees plaintext |