Skip to content

Commit 1e3e464

Browse files
authored
DRIVERS-2330 rename "FLE 2" to "Queryable Encryption" (#1223)
1 parent d4c9432 commit 1e3e464

File tree

1 file changed

+26
-22
lines changed

1 file changed

+26
-22
lines changed

source/client-side-encryption/client-side-encryption.rst

Lines changed: 26 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ Client Side Encryption
1010
:Status: Accepted
1111
:Type: Standards
1212
:Minimum Server Version: 4.2
13-
:Last Modified: 2022-05-31
13+
:Last Modified: 2022-06-02
1414
:Version: 1.7.3
1515

1616
.. _lmc-c-api: https://github.com/mongodb/libmongocrypt/blob/master/src/mongocrypt.h.in
@@ -98,14 +98,17 @@ ciphertext
9898
One of the data formats of `BSON binary subtype 6 <https://github.com/mongodb/specifications/tree/master/source/client-side-encryption/subtype6.rst>`_, representing an encoded BSON document containing
9999
encrypted ciphertext and metadata.
100100

101-
FLE 1
102-
FLE 1 is the first version of Client-Side Field Level Encryption. FLE 1 is almost entirely client-side with the exception of server-side JSON schema.
101+
FLE
102+
FLE is the first version of Client-Side Field Level Encryption. FLE is almost entirely client-side with the exception of server-side JSON schema.
103103

104-
FLE 2
105-
FLE 2 the second version of Client-Side Field Level Encryption. Data is encrypted client-side. FLE 2 supports indexed encrypted fields, which are further processed server-side.
104+
Queryable Encryption
105+
Queryable Encryption the second version of Client-Side Field Level Encryption. Data is encrypted client-side. Queryable Encryption supports indexed encrypted fields, which are further processed server-side.
106+
107+
In-Use Encryption
108+
Is an umbrella term describing the both FLE and Queryable Encryption.
106109

107110
encryptedFields
108-
A BSON document describing the FLE 2 encrypted fields. This is analogous to the JSON Schema in FLE 1. The following is an example encryptedFields in extended canonical JSON:
111+
A BSON document describing the Queryable Encryption encrypted fields. This is analogous to the JSON Schema in FLE. The following is an example encryptedFields in extended canonical JSON:
109112

110113
.. code::
111114
@@ -642,13 +645,13 @@ encryptedFieldsMap
642645

643646
``encryptedFieldsMap`` maps a collection namespace to an ``encryptedFields``.
644647

645-
``encryptedFieldsMap`` only applies to FLE 2.
648+
``encryptedFieldsMap`` only applies to Queryable Encryption.
646649

647650
If a collection is present on both the ``encryptedFieldsMap`` and ``schemaMap``, libmongocrypt_ will error on initialization. See :ref:`fle2-and-fle1-error`.
648651

649652
If a collection is present on the ``encryptedFieldsMap``, the behavior of ``CreateCollection()`` and ``Collection.Drop()`` is altered. See :ref:`fle2-createcollection-drop`.
650653

651-
Automatic encryption in FLE 2 is configured with the ``encryptedFields``.
654+
Automatic encryption in Queryable Encryption is configured with the ``encryptedFields``.
652655

653656
If a collection is not present on the ``encryptedFields`` a server-side collection ``encryptedFields`` may be used by libmongocrypt_.
654657
Drivers MUST include the following in the documentation for MongoClient:
@@ -663,10 +666,10 @@ See `Why is bypassQueryAnalysis needed?`_.
663666

664667
.. _fle2-createcollection-drop:
665668

666-
FLE 2 Create and Drop Collection Helpers
667-
----------------------------------------
669+
Queryable Encryption Create and Drop Collection Helpers
670+
-------------------------------------------------------
668671

669-
A collection supporting FLE 2 requires an index and three additional collections.
672+
A collection supporting Queryable Encryption requires an index and three additional collections.
670673

671674
.. _create: https://www.mongodb.com/docs/manual/reference/command/create
672675
.. _drop: https://www.mongodb.com/docs/manual/reference/command/drop
@@ -2142,19 +2145,19 @@ certificates.
21422145
21432146
.. _fle2-and-fle1-error:
21442147
2145-
Why is it an error to have an FLE 1 and FLE 2 field in the same collection?
2146-
---------------------------------------------------------------------------
2147-
There is no technical limitation to having a separate FLE 1 field and FLE 2
2148-
field in the same collection. Prohibiting FLE 1 and FLE 2 in the same collection
2149-
reduces complexity. From the product perspective, a random FLE 1 field and a
2150-
non-queryable FLE 2 field have the same behavior and similar security
2151-
guarantees. A deterministic FLE 1 field leaks more information then a
2152-
deterministic FLE 2 field. There is not a compelling use case to use both FLE 1
2153-
and FLE 2 in the same collection.
2148+
Why is it an error to have an FLE 1 and Queryable Encryption field in the same collection?
2149+
------------------------------------------------------------------------------------------
2150+
There is no technical limitation to having a separate FLE field and Queryable Encryption
2151+
field in the same collection. Prohibiting FLE and Queryable Encryption in the same collection
2152+
reduces complexity. From the product perspective, a random FLE field and a
2153+
non-queryable Queryable Encryption field have the same behavior and similar security
2154+
guarantees. A deterministic FLE field leaks more information then a
2155+
deterministic Queryable Encryption field. There is not a compelling use case to use both FLE
2156+
and Queryable Encryption in the same collection.
21542157
21552158
Is it an error to set schemaMap and encryptedFieldsMap?
21562159
------------------------------------------------------------
2157-
No. FLE 1 and FLE 2 fields can coexist in different collections. The same
2160+
No. FLE and Queryable Encryption fields can coexist in different collections. The same
21582161
collection cannot be in the ``encryptedFieldsMap`` and ``schemaMap``.
21592162
libmongocrypt_ will error if the same collection is specified in a ``schemaMap``
21602163
and ``encryptedFieldsMap``.
@@ -2189,7 +2192,7 @@ Here is an example:
21892192
}
21902193
21912194
coll := encryptedClient.Database("foo").Collection("bar")
2192-
// Explicit Encrypt an FLE 2 Indexed Field.
2195+
// Explicit Encrypt an Queryable Encryption Indexed Field.
21932196
eo := options.Encrypt().
21942197
SetEncryptIndexType(options.EncryptIndexEquality)
21952198
ciphertext, err := ce.Encrypt(ctx, val, eo)
@@ -2302,6 +2305,7 @@ Changelog
23022305
:align: left
23032306
23042307
Date, Description
2308+
22-06-02, Rename ``FLE 2`` to ``Queryable Encryption``
23052309
22-05-31, Rename ``csfle`` to ``crypt_shared``
23062310
22-05-27, Define ECC, ECOC, and ESC acronyms within encryptedFields
23072311
22-05-26, Clarify how ``encryptedFields`` interacts with ``create`` and ``drop`` commands

0 commit comments

Comments
 (0)