[DRIVERS-2781] Add option to configure DEK cache lifetime Created: 27/Nov/23  Updated: 30/Jan/24

Status: Backlog
Project: Drivers
Component/s: Client Side Encryption
Fix Version/s: None

Type: New Feature Priority: Unknown
Reporter: Kevin Albertson Assignee: Unassigned
Resolution: Unresolved Votes: 1
Labels: None
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Issue Links:
Related
is related to JAVA-5297 ClientEncryption encrypt/decrypt KMS ... Backlog
Driver Changes: Needed

 Description   

Summary

Add option to configure DEK cache lifetime.

Motivation

At present, libmongocrypt caches the decrypted DEK for a fixed lifetime of 1 minute. There is a report of observed errors decrypting DEKs with KMS on heavy load. This may be due to the high rate of KMS requests. Adding an option to increase the lifetime may help these use cases reduce the rate of KMS requests.

Who is the affected end user?

Users of In-Use Encryption (CSFLE and/or QE) with heavy workloads requiring many KMS requests.

How does this affect the end user?

May result in more KMS requests than desired on heavy load. There is a report of observed errors decrypting DEKs with KMS on heavy load.

How likely is it that this problem or use case will occur?

Likely. There is a report of observed errors decrypting DEKs with KMS on heavy load. The high rate of KMS requests is the presumed cause.

JAVA-5297 notes errors observed for Azure KMS requests that may benefit from a configurable DEK cache timeout.

If the problem does occur, what are the consequences and how severe are they?

Application errors.

Is this issue urgent?

Not sure.

Is this ticket required by a downstream team?

No?

Is this ticket only for tests?

No.

Acceptance Criteria

Update libmongocrypt to enable configuring the DEK cache lifetime.
Add API to drivers to enable configuring the DEK cache lifetime.


Generated at Thu Feb 08 08:26:24 UTC 2024 using Jira 9.7.1#970001-sha1:2222b88b221c4928ef0de3161136cc90c8356a66.