Uploaded image for project: 'Drivers'
  1. Drivers
  2. DRIVERS-2781

Add option to configure DEK cache lifetime

    XMLWordPrintableJSON

Details

    • Icon: New Feature New Feature
    • Resolution: Unresolved
    • Icon: Unknown Unknown
    • None
    • Client Side Encryption
    • None
    • Needed

    Description

      Summary

      Add option to configure DEK cache lifetime.

      Motivation

      At present, libmongocrypt caches the decrypted DEK for a fixed lifetime of 1 minute. There is a report of observed errors decrypting DEKs with KMS on heavy load. This may be due to the high rate of KMS requests. Adding an option to increase the lifetime may help these use cases reduce the rate of KMS requests.

      Who is the affected end user?

      Users of In-Use Encryption (CSFLE and/or QE) with heavy workloads requiring many KMS requests.

      How does this affect the end user?

      May result in more KMS requests than desired on heavy load. There is a report of observed errors decrypting DEKs with KMS on heavy load.

      How likely is it that this problem or use case will occur?

      Likely. There is a report of observed errors decrypting DEKs with KMS on heavy load. The high rate of KMS requests is the presumed cause.

      JAVA-5297 notes errors observed for Azure KMS requests that may benefit from a configurable DEK cache timeout.

      If the problem does occur, what are the consequences and how severe are they?

      Application errors.

      Is this issue urgent?

      Not sure.

      Is this ticket required by a downstream team?

      No?

      Is this ticket only for tests?

      No.

      Acceptance Criteria

      Update libmongocrypt to enable configuring the DEK cache lifetime.
      Add API to drivers to enable configuring the DEK cache lifetime.

      Attachments

        Activity

          People

            Unassigned Unassigned
            kevin.albertson@mongodb.com Kevin Albertson
            Votes:
            1 Vote for this issue
            Watchers:
            2 Start watching this issue

            Dates

              Created:
              Updated: