Mongo ClientSideFieldLevel Encrytion

Chaitanya_Chettipalli · 2024-02-15T03:30:35.914Z

Hello,

 We are using mongodb-crypt library for field level encryption on Azure.

We are able to encrypt & decrypt data properly.

However we faced issue with our Cloud provider due to which KeyVault was unavailable for certain period of time. During this time our encryution/decryption process errored as the internal C library “libmongocrypt” tries to fetch the masterkey every 1 minute.

Right now this is not configurable, please suggest options to avoid this situation by either increasing the time interval to query the KMS or reuse the existing masterKey if the KeyVault fails.

Found following documentation from “libmongocrypt”
libmongocrypt: Data key caching

Data keys are cached in libmongocrypt for one minute. This is not
configurable, and there is no maximum number of keys in the cache. The
data key material is stored securely. It will not be paged to disk and
the memory will be properly zero’ed out after freeing.

Thanks,
Chaitanya.

Rishabh_Bisht · 2024-02-15T13:23:04.518Z

Hi @Chaitanya_Chettipalli

Thanks for sharing your experience. DRIVERS-2781 proposes to make the cache window configurable. Your request helps in taking an informed decision. We will consider this ticket for a future quarter.
Kindly watch the jira ticket for future updates.

Chaitanya_Chettipalli · 2024-02-15T19:58:03.954Z

Hi @Rishabh_Bisht , thanks for the quick response.

Can u provide the timeline for this configuration change in the Driver.
From the Jira shared, it looks like its planned for FY25Q2, Q3.
We wanted to check if an earlier time frame is possible.

With the KeyVault issue we faced last time, it was a 100% outage for us and we do
not want to end up in that kind of situation again.

Please suggest if there are any other alternatives possible for this problem.

Thank you.

Rishabh_Bisht · 2024-02-16T10:05:51.058Z

Yes, the ticket I shared is tentatively planned for Q2/Q3 this year. We also have another retryability work planned for current quarter which may address some of the issues experienced with transient errors with KMS - MONGOCRYPT-599.

Chaitanya_Chettipalli · 2024-05-29T18:27:48.738Z

Hi @Rishabh_Bisht wanted to check if there is any update on the ticket DRIVERS-2781 . Is there a planned date for this new release?

Thanks,
Chaitanya.

Rishabh_Bisht · 2024-05-30T09:12:44.258Z

Hi @Chaitanya_Chettipalli

It’s in consideration but can’t share any commitments on release dates yet.

Joel_Odom · 2025-03-25T14:03:27.864Z

This feature is now being rolled out in the drivers and is already available in many of them. Java will be available in the next month or so.