[DRIVERS-2781] Add option to configure DEK cache lifetime Created: 27/Nov/23 Updated: 30/Jan/24 |
|
| Status: | Backlog |
| Project: | Drivers |
| Component/s: | Client Side Encryption |
| Fix Version/s: | None |
| Type: | New Feature | Priority: | Unknown |
| Reporter: | Kevin Albertson | Assignee: | Unassigned |
| Resolution: | Unresolved | Votes: | 1 |
| Labels: | None | ||
| Remaining Estimate: | Not Specified | ||
| Time Spent: | Not Specified | ||
| Original Estimate: | Not Specified | ||
| Issue Links: |
|
||||||||
| Driver Changes: | Needed | ||||||||
| Description |
SummaryAdd option to configure DEK cache lifetime. MotivationAt present, libmongocrypt caches the decrypted DEK for a fixed lifetime of 1 minute. There is a report of observed errors decrypting DEKs with KMS on heavy load. This may be due to the high rate of KMS requests. Adding an option to increase the lifetime may help these use cases reduce the rate of KMS requests. Who is the affected end user?Users of In-Use Encryption (CSFLE and/or QE) with heavy workloads requiring many KMS requests. How does this affect the end user?May result in more KMS requests than desired on heavy load. There is a report of observed errors decrypting DEKs with KMS on heavy load. How likely is it that this problem or use case will occur?Likely. There is a report of observed errors decrypting DEKs with KMS on heavy load. The high rate of KMS requests is the presumed cause. JAVA-5297 notes errors observed for Azure KMS requests that may benefit from a configurable DEK cache timeout. If the problem does occur, what are the consequences and how severe are they?Application errors. Is this issue urgent?Not sure. Is this ticket required by a downstream team?No? Is this ticket only for tests?No. Acceptance CriteriaUpdate libmongocrypt to enable configuring the DEK cache lifetime. |