Loading...

XML

Word

Printable

JSON

Type: New Feature
Resolution: Unresolved
Priority: Unknown
Fix Version/s: None
Component/s: Client Side Encryption
Labels:
- jeff+

Driver Changes:
Needed
Quarter:
- FY25Q3
- FY25Q4
Downstream Changes Summary:
Hide

Summary of necessary driver changes

Expose the cache expiration option provided by libmongocrypt

Commits for syncing spec/prose tests
C driver implementation:
https://github.com/mongodb/mongo-c-driver/commit/b0edf300b8623bc8a4d861f02aaefc8c312c46c9

libmongocrypt implementation is available in 1.12.0:
https://github.com/mongodb/libmongocrypt/commit/11a8060526a638575d5e18cad254256ac871078c

Spec tests:

Added in: https://github.com/mongodb/specifications/commit/ecce2eccf0e6f3b41dff3bf0e57e2350f7517340

Updated (to increase wait time) in: https://github.com/mongodb/specifications/commit/787bbe67bdffb614270654372112e93fc2cd3eb3
Show
Summary of necessary driver changes Expose the cache expiration option provided by libmongocrypt Commits for syncing spec/prose tests C driver implementation: https://github.com/mongodb/mongo-c-driver/commit/b0edf300b8623bc8a4d861f02aaefc8c312c46c9 libmongocrypt implementation is available in 1.12.0: https://github.com/mongodb/libmongocrypt/commit/11a8060526a638575d5e18cad254256ac871078c Spec tests: Added in: https://github.com/mongodb/specifications/commit/ecce2eccf0e6f3b41dff3bf0e57e2350f7517340 Updated (to increase wait time) in: https://github.com/mongodb/specifications/commit/787bbe67bdffb614270654372112e93fc2cd3eb3

Driver Compliance:

$i18n.getText("admin.common.words.hide")

Key	Status/Resolution	FixVersion
CDRIVER-5644	Fixed	1.30.0
CXX-3080	Backlog
CSHARP-5205	Backlog
GODRIVER-3289	Investigating
JAVA-5547	Backlog
NODE-6294	Backlog
MOTOR-1348	Duplicate
PYTHON-4580	Ready for Work
PHPLIB-1496	Backlog
RUBY-3524	Backlog
RUST-2006	In Code Review

$i18n.getText("admin.common.words.show")

#scriptField, #scriptField *{ border: 1px solid black; } #scriptField{ border-collapse: collapse; } #scriptField td { text-align: center; /* Center-align text in table cells */ } #scriptField td.key { text-align: left; /* Left-align text in the Key column */ } #scriptField a { text-decoration: none; /* Remove underlines from links */ border: none; /* Remove border from links */ } /* Add green background color to cells with FixVersion */ #scriptField td.hasFixVersion { background-color: #00FF00; /* Green color code */ } #scriptField td.willNotDo { background-color: #FF0000; /* Red color code */ } /* Center-align the first row headers */ #scriptField th { text-align: center; } Key Status/Resolution FixVersion CDRIVER-5644 Fixed 1.30.0 CXX-3080 Backlog CSHARP-5205 Backlog GODRIVER-3289 Investigating JAVA-5547 Backlog NODE-6294 Backlog MOTOR-1348 Duplicate PYTHON-4580 Ready for Work PHPLIB-1496 Backlog RUBY-3524 Backlog RUST-2006 In Code Review

Summary

Add option to configure DEK cache lifetime.

Motivation

At present, libmongocrypt caches the decrypted DEK for a fixed lifetime of 1 minute. There is a report of observed errors decrypting DEKs with KMS on heavy load. This may be due to the high rate of KMS requests. Adding an option to increase the lifetime may help these use cases reduce the rate of KMS requests.

Who is the affected end user?

Users of In-Use Encryption (CSFLE and/or QE) with heavy workloads requiring many KMS requests.

How does this affect the end user?

May result in more KMS requests than desired on heavy load. There is a report of observed errors decrypting DEKs with KMS on heavy load.

How likely is it that this problem or use case will occur?

Likely. There is a report of observed errors decrypting DEKs with KMS on heavy load. The high rate of KMS requests is the presumed cause.

JAVA-5297 notes errors observed for Azure KMS requests that may benefit from a configurable DEK cache timeout.

If the problem does occur, what are the consequences and how severe are they?

Application errors.

Is this issue urgent?

Not sure.

Is this ticket required by a downstream team?

No?

Is this ticket only for tests?

No.

Acceptance Criteria

Update libmongocrypt to enable configuring the DEK cache lifetime.
Add API to drivers to enable configuring the DEK cache lifetime.

depends on

MONGOCRYPT-730 Add option to configure DEK cache lifetime

Closed

is related to

JAVA-5297 ClientEncryption encrypt/decrypt KMS key caching

Backlog

split to

CSHARP-5205 Add option to configure DEK cache lifetime

Backlog

CXX-3080 Add option to configure DEK cache lifetime

Backlog

JAVA-5547 Add option to configure DEK cache lifetime

Backlog

NODE-6294 Add option to configure DEK cache lifetime

Backlog

PHPLIB-1496 Add option to configure DEK cache lifetime

Backlog

RUBY-3524 Add option to configure DEK cache lifetime

Backlog

RUST-2006 Add option to configure DEK cache lifetime

In Code Review

PYTHON-4580 Add option to configure DEK cache lifetime

Ready for Work

CDRIVER-5644 Add option to configure DEK cache lifetime

Closed

MOTOR-1348 Add option to configure DEK cache lifetime

Closed

GODRIVER-3289 Add option to configure DEK cache lifetime

Investigating

(8 split to)

Assignee:: Adrian Dole

Reporter:: Kevin Albertson

Engineering Lead:: Kevin Albertson

Product Manager:: Esha Bhargava

Program Manager:: Esha Bhargava

Votes:: 10 Vote for this issue

Watchers:: 12 Start watching this issue

Created:: Nov 27 2023 03:11:14 PM UTC

Updated:: Dec 17 2024 04:33:23 PM UTC

Start date:: 08/Aug/24

Details

Description

Summary

Motivation

Who is the affected end user?

How does this affect the end user?

How likely is it that this problem or use case will occur?

If the problem does occur, what are the consequences and how severe are they?

Is this issue urgent?

Is this ticket required by a downstream team?

Is this ticket only for tests?

Acceptance Criteria

Attachments

Issue Links

Activity

People

Dates