Skip to content

Commit 9f1d416

Browse files
authored
DRIVERS-1016 clarify decryption does not need the key ID or algorithm. (#1695)
1 parent 47d1822 commit 9f1d416

File tree

1 file changed

+15
-14
lines changed

1 file changed

+15
-14
lines changed

source/client-side-encryption/client-side-encryption.md

Lines changed: 15 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -143,19 +143,19 @@ See also:
143143
One of the data formats of [BSON binary encrypted](../bson-binary-encrypted/binary-encrypted.md), representing an
144144
encoded BSON document containing encrypted ciphertext and metadata.
145145

146-
**FLE**
146+
**Client-Side Field Level Encryption (CSFLE)**
147147

148-
FLE is the first version of Client-Side Field Level Encryption. FLE is almost entirely client-side with the exception of
149-
server-side JSON schema.
148+
CSFLE is the first version of In-Use Encryption. CSFLE is almost entirely client-side with the exception of server-side
149+
JSON schema.
150150

151-
**Queryable Encryption**
151+
**Queryable Encryption (QE)**
152152

153-
Queryable Encryption the second version of Client-Side Field Level Encryption. Data is encrypted client-side. Queryable
154-
Encryption supports indexed encrypted fields, which are further processed server-side.
153+
Queryable Encryption the second version of In-Use Encryption. Data is encrypted client-side. Queryable Encryption
154+
supports indexed encrypted fields, which are further processed server-side.
155155

156156
**In-Use Encryption**
157157

158-
Is an umbrella term describing the both FLE and Queryable Encryption.
158+
Is an umbrella term describing the both CSFLE and Queryable Encryption.
159159

160160
**encryptedFields**
161161

@@ -237,6 +237,7 @@ created_key_id = clientencryption.create_data_key("aws", opts)
237237
opts = EncryptOpts(key_id=created_key_id,
238238
algorithm="AEAD_AES_256_CBC_HMAC_SHA_512-Random")
239239
encrypted = clientencryption.encrypt("secret text", opts)
240+
# Decryption does not require the key ID or algorithm. The ciphertext indicates the key ID and algorithm used.
240241
decrypted = clientencryption.decrypt(encrypted)
241242
```
242243

@@ -2223,17 +2224,17 @@ KMIP support in the MongoDB server is a precedent. The server supports `--kmipSe
22232224
TLS options may be useful for the AWS, Azure, and GCP KMS providers in a case where the default trust store does not
22242225
include the needed CA certificates.
22252226

2226-
### Why is it an error to have an FLE 1 and Queryable Encryption field in the same collection?
2227+
### Why is it an error to have an CSFLE and Queryable Encryption field in the same collection?
22272228

2228-
There is no technical limitation to having a separate FLE field and Queryable Encryption field in the same collection.
2229-
Prohibiting FLE and Queryable Encryption in the same collection reduces complexity. From the product perspective, a
2230-
random FLE field and a non-queryable Queryable Encryption field have the same behavior and similar security guarantees.
2231-
A deterministic FLE field leaks more information then a deterministic Queryable Encryption field. There is not a
2232-
compelling use case to use both FLE and Queryable Encryption in the same collection.
2229+
There is no technical limitation to having a separate CSFLE field and Queryable Encryption field in the same collection.
2230+
Prohibiting CSFLE and Queryable Encryption in the same collection reduces complexity. From the product perspective, a
2231+
random CSFLE field and a non-queryable Queryable Encryption field have the same behavior and similar security
2232+
guarantees. A deterministic CSFLE field leaks more information then a deterministic Queryable Encryption field. There is
2233+
not a compelling use case to use both CSFLE and Queryable Encryption in the same collection.
22332234

22342235
### Is it an error to set schemaMap and encryptedFieldsMap?
22352236

2236-
No. FLE and Queryable Encryption fields can coexist in different collections. The same collection cannot be in the
2237+
No. CSFLE and Queryable Encryption fields can coexist in different collections. The same collection cannot be in the
22372238
`encryptedFieldsMap` and `schemaMap`. [libmongocrypt](#libmongocrypt) will error if the same collection is specified in
22382239
a `schemaMap` and `encryptedFieldsMap`.
22392240

0 commit comments

Comments
 (0)