Uploaded image for project: 'Core Server'
  1. Core Server
  2. SERVER-92390

FLE2 trimFactor default fails on small domain ranges

XMLWordPrintableJSON

    • Server Security
    • Fully Compatible
    • ALL
    • v8.0
    • Hide

      Create a QE range collection with the following schema:

      let client = new EncryptedClient(db.getMongo(), 'testdb');

assert.commandWorked(client.createEncryptionCollection("basic", {
    encryptedFields: {
        "fields": [{
            "path": "foo",
            "bsonType": "int",
            "queries": {
                "queryType": "range",
                "min": NumberInt(3),
                "max": NumberInt(5)
            }
        }]
    }
}));

      Then insert one document with "foo":

      let edb = client.getDB();

assert.commandWorked(edb.erunCommand({
    insert: "basic",
    documents: [{"foo": NumberInt(4)}]
}));

      Doing a range query for "foo" will result in an error ("Error: Trim factor must be less than the number of bits used to represent the domain.").

      // Throws error
client.runEncryptionOperation(() => {
    edb.basic.find({int_bounded: {$gt: NumberInt(3)}}).toArray();
});
      Show
      Create a QE range collection with the following schema: let client = new EncryptedClient(db.getMongo(), 'testdb'); assert.commandWorked(client.createEncryptionCollection("basic", { encryptedFields: {   "fields": [{ "path": "foo", "bsonType": "int", "queries": { "queryType": "range", "min": NumberInt(3), "max": NumberInt(5) } }] } })); Then insert one document with "foo": let edb = client.getDB(); assert.commandWorked(edb.erunCommand({ insert: "basic",   documents: [{"foo": NumberInt(4)}] })); Doing a range query for "foo" will result in an error ("Error: Trim factor must be less than the number of bits used to represent the domain."). // Throws error client.runEncryptionOperation(() => { edb.basic.find({int_bounded: {$gt: NumberInt(3)}}).toArray(); });
    • Security 2024-07-22

      For FLE2-encrypted range fields with small domain size (6 or fewer bits required) and unspecified trimFactor, one will run into a validation error ("Error: Trim factor must be less than the number of bits used to represent the domain.") when inserting field values and trying to query them back.

      This is because when inserting a range field value whose trimFactor is unspecified in the schema, the following happens in the client:

      1. query_analysis.cpp:buildFle2EncryptPlaceholder() sets FLE2RangeInsertSpec.trimFactor to be boost::none. So, the final insertion placeholder will wind up not having an explicit trim factor value.
      2. when the placeholder is converted to a FLE2InsertUpdatePayloadV2, the getEdges algorithm resolves the unspecified trim factor to some default value, D, that is clamped to a valid value based on the domain size.

      However, when doing a find, query analysis will always set a value of 6 for the FLE2RangeFindSpecEdgesInfo.trimFactor if the trim factor is unspecified in the schema.  Since 6 is not always equal to D, this is going to cause an error during the validation performed in validateIDLFLE2RangeFindSpec

            Assignee:
            erwin.pe@mongodb.com Erwin Pe
            Reporter:
            erwin.pe@mongodb.com Erwin Pe
            Votes:
            0 Vote for this issue
            Watchers:
            6 Start watching this issue

              Created:
              Updated:
              Resolved: