Client-Side Field Level Encryption (CSFLE) in MongoDB with Golang

1
brew install mongodb/brew/libmongocrypt

1
package main
2
3
import (
4
    "context"
5
    "crypto/rand"
6
    "fmt"
7
    "io/ioutil"
8
    "log"
9
    "os"
10
11
    "go.mongodb.org/mongo-driver/bson"
12
    "go.mongodb.org/mongo-driver/mongo"
13
    "go.mongodb.org/mongo-driver/mongo/options"
14
)
15
16
var (
17
    ctx          = context.Background()
18
    kmsProviders map[string]map[string]interface{}
19
    schemaMap    bson.M
20
)
21
22
func createDataKey() {}
23
func createEncryptedClient() *mongo.Client {}
24
func readSchemaFromFile(file string) bson.M {}
25
26
func main() {}

1
func createDataKey() {
2
    kvClient, err := mongo.Connect(ctx, options.Client().ApplyURI(os.Getenv("ATLAS_URI")))
3
    if err != nil {
4
        log.Fatal(err)
5
    }
6
    clientEncryptionOpts := options.ClientEncryption().SetKeyVaultNamespace("keyvault.datakeys").SetKmsProviders(kmsProviders)
7
    clientEncryption, err := mongo.NewClientEncryption(kvClient, clientEncryptionOpts)
8
    if err != nil {
9
        log.Fatal(err)
10
    }
11
    defer clientEncryption.Close(ctx)
12
    _, err = clientEncryption.CreateDataKey(ctx, "local", options.DataKey().SetKeyAltNames([]string{"example"}))
13
    if err != nil {
14
        log.Fatal(err)
15
    }
16
}

1
func main() {
2
    localKey := make([]byte, 96)
3
    if _, err := rand.Read(localKey); err != nil {
4
        log.Fatal(err)
5
    }
6
    kmsProviders = map[string]map[string]interface{}{
7
        "local": {
8
            "key": localKey,
9
        },
10
    }
11
    createDataKey()
12
}

1
{
2
    "_id": UUID("27a51d69-809f-4cb9-ae15-d63f7eab1585"),
3
    "keyAltNames": [
4
        "example"
5
    ],
6
    "keyMaterial": Binary("oJ6lEzjIEskHFxz7zXqddCgl64EcP1A7E/r9zT+OL19/ZXVwDnEjGYMvx+BgcnzJZqkXTFTgJeaRYO/fWk5bEcYkuvXhKqpMq2ZO", 0),
7
    "creationDate": 2020-11-05T23:32:26.466+00:00,
8
    "updateDate": 2020-11-05T23:32:26.466+00:00,
9
    "status": 0,
10
    "masterKey": {
11
        "provider": "local"
12
    }
13
}

1
{
2
    "fle-example.people": {
3
        "encryptMetadata": {
4
            "keyId": "/keyAltName"
5
        },
6
        "properties": {
7
            "ssn": {
8
                "encrypt": {
9
                    "bsonType": "string",
10
                    "algorithm": "AEAD_AES_256_CBC_HMAC_SHA_512-Random"
11
                }
12
            }
13
        },
14
        "bsonType": "object"
15
    }
16
}

1
{
2
    "fle-example.people": {
3
        "properties": {
4
            "ssn": {
5
                "encrypt": {
6
                    "keyId": "/keyAltName",
7
                    "bsonType": "string",
8
                    "algorithm": "AEAD_AES_256_CBC_HMAC_SHA_512-Random"
9
                }
10
            }
11
        },
12
        "bsonType": "object"
13
    }
14
}

1
func readSchemaFromFile(file string) bson.M {
2
    content, err := ioutil.ReadFile(file)
3
    if err != nil {
4
        log.Fatal(err)
5
    }
6
    var doc bson.M
7
    if err = bson.UnmarshalExtJSON(content, false, &doc); err != nil {
8
        log.Fatal(err)
9
    }
10
    return doc
11
}

1
func createEncryptedClient() *mongo.Client {
2
    schemaMap = readSchemaFromFile("schema.json")
3
    mongocryptdOpts := map[string]interface{}{
4
        "mongodcryptdBypassSpawn": true,
5
    }
6
    autoEncryptionOpts := options.AutoEncryption().
7
        SetKeyVaultNamespace("keyvault.datakeys").
8
        SetKmsProviders(kmsProviders).
9
        SetSchemaMap(schemaMap).
10
        SetExtraOptions(mongocryptdOpts)
11
    mongoClient, err := mongo.Connect(ctx, options.Client().ApplyURI(os.Getenv("ATLAS_URI")).SetAutoEncryptionOptions(autoEncryptionOpts))
12
    if err != nil {
13
        log.Fatal(err)
14
    }
15
    return mongoClient
16
}

1
func main() {
2
    localKey := make([]byte, 96)
3
    if _, err := rand.Read(localKey); err != nil {
4
        log.Fatal(err)
5
    }
6
    kmsProviders = map[string]map[string]interface{}{
7
        "local": {
8
            "key": localKey,
9
        },
10
    }
11
    // createDataKey()
12
    client := createEncryptedClient()
13
    defer client.Disconnect(ctx)
14
    collection := client.Database("fle-example").Collection("people")
15
    if _, err := collection.InsertOne(context.TODO(), bson.M{"name": "Nic Raboy", "ssn": "123456", "keyAltName": "example"}); err != nil {
16
        log.Fatal(err)
17
    }
18
    result, err := collection.FindOne(context.TODO(), bson.D{}).DecodeBytes()
19
    if err != nil {
20
        log.Fatal(err)
21
    }
22
    fmt.Println(result)
23
}

1
go build -tags cse

1
go run -tags cse main.go

1
{
2
    "fle-example.people": {
3
        "encryptMetadata": {
4
            "keyId": [
5
                {
6
                    "$binary": {
7
                        "base64": "%s",
8
                        "subType": "04"
9
                    }
10
                }
11
            ]
12
        },
13
        "properties": {
14
            "ssn": {
15
                "encrypt": {
16
                    "bsonType": "string",
17
                    "algorithm": "AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic"
18
                }
19
            }
20
        },
21
        "bsonType": "object"
22
    }
23
}

1
dataKeyId, err := clientEncryption.CreateDataKey(ctx, "local", options.DataKey())

1
dataKeyId := createDataKey()
2
client := createEncryptedClient(base64.StdEncoding.EncodeToString(dataKeyId.Data))

1
schemaMap = readSchemaFromFile("schema.json", dataKeyIdBase64)

1
func readSchemaFromFile(file string, dataKeyIdBase64 string) bson.M {
2
    content, err := ioutil.ReadFile(file)
3
    if err != nil {
4
        log.Fatal(err)
5
    }
6
    content = []byte(fmt.Sprintf(string(content), dataKeyIdBase64))
7
    var doc bson.M
8
    if err = bson.UnmarshalExtJSON(content, false, &doc); err != nil {
9
        log.Fatal(err)
10
    }
11
    return doc
12
}

1
package main
2
3
import (
4
    "context"
5
    "crypto/rand"
6
    "encoding/base64"
7
    "fmt"
8
    "io/ioutil"
9
    "log"
10
    "os"
11
12
    "go.mongodb.org/mongo-driver/bson"
13
    "go.mongodb.org/mongo-driver/bson/primitive"
14
    "go.mongodb.org/mongo-driver/mongo"
15
    "go.mongodb.org/mongo-driver/mongo/options"
16
)
17
18
var (
19
    ctx          = context.Background()
20
    kmsProviders map[string]map[string]interface{}
21
    schemaMap    bson.M
22
)
23
24
func createDataKey() primitive.Binary {
25
    kvClient, err := mongo.Connect(ctx, options.Client().ApplyURI(os.Getenv("ATLAS_URI")))
26
    if err != nil {
27
        log.Fatal(err)
28
    }
29
    kvClient.Database("keyvault").Collection("datakeys").Drop(ctx)
30
    clientEncryptionOpts := options.ClientEncryption().SetKeyVaultNamespace("keyvault.datakeys").SetKmsProviders(kmsProviders)
31
    clientEncryption, err := mongo.NewClientEncryption(kvClient, clientEncryptionOpts)
32
    if err != nil {
33
        log.Fatal(err)
34
    }
35
    defer clientEncryption.Close(ctx)
36
    dataKeyId, err := clientEncryption.CreateDataKey(ctx, "local", options.DataKey())
37
    if err != nil {
38
        log.Fatal(err)
39
    }
40
    return dataKeyId
41
}
42
43
func createEncryptedClient(dataKeyIdBase64 string) *mongo.Client {
44
    schemaMap = readSchemaFromFile("schema.json", dataKeyIdBase64)
45
    mongocryptdOpts := map[string]interface{}{
46
        "mongodcryptdBypassSpawn": true,
47
    }
48
    autoEncryptionOpts := options.AutoEncryption().
49
        SetKeyVaultNamespace("keyvault.datakeys").
50
        SetKmsProviders(kmsProviders).
51
        SetSchemaMap(schemaMap).
52
        SetExtraOptions(mongocryptdOpts)
53
    mongoClient, err := mongo.Connect(ctx, options.Client().ApplyURI(os.Getenv("ATLAS_URI")).SetAutoEncryptionOptions(autoEncryptionOpts))
54
    if err != nil {
55
        log.Fatal(err)
56
    }
57
    return mongoClient
58
}
59
60
func readSchemaFromFile(file string, dataKeyIdBase64 string) bson.M {
61
    content, err := ioutil.ReadFile(file)
62
    if err != nil {
63
        log.Fatal(err)
64
    }
65
    content = []byte(fmt.Sprintf(string(content), dataKeyIdBase64))
66
    var doc bson.M
67
    if err = bson.UnmarshalExtJSON(content, false, &doc); err != nil {
68
        log.Fatal(err)
69
    }
70
    return doc
71
}
72
73
func main() {
74
    fmt.Println("Starting the application...")
75
    localKey := make([]byte, 96)
76
    if _, err := rand.Read(localKey); err != nil {
77
        log.Fatal(err)
78
    }
79
    kmsProviders = map[string]map[string]interface{}{
80
        "local": {
81
            "key": localKey,
82
        },
83
    }
84
    dataKeyId := createDataKey()
85
    client := createEncryptedClient(base64.StdEncoding.EncodeToString(dataKeyId.Data))
86
    defer client.Disconnect(ctx)
87
    collection := client.Database("fle-example").Collection("people")
88
    collection.Drop(context.TODO())
89
    if _, err := collection.InsertOne(context.TODO(), bson.M{"name": "Nic Raboy", "ssn": "123456"}); err != nil {
90
        log.Fatal(err)
91
    }
92
    result, err := collection.FindOne(context.TODO(), bson.M{"ssn": "123456"}).DecodeBytes()
93
    if err != nil {
94
        log.Fatal(err)
95
    }
96
    fmt.Println(result)
97
}

1
panic: client-side encryption not enabled. add the cse build tag to support

1
go build -tags cse

1
/usr/local/Cellar/go/1.13.1/libexec/pkg/tool/darwin_amd64/link: running clang failed: exit status 1
2
ld: warning: directory not found for option '-L/usr/local/Cellar/libmongocrypt/1.0.4/lib'
3
ld: library not found for -lmongocrypt
4
clang: error: linker command failed with exit code 1 (use -v to see invocation)

1
exec: "mongocryptd": executable file not found in $PATH
2
exit status 1