@@ -143,19 +143,19 @@ See also:
143
143
One of the data formats of [ BSON binary encrypted] ( ../bson-binary-encrypted/binary-encrypted.md ) , representing an
144
144
encoded BSON document containing encrypted ciphertext and metadata.
145
145
146
- ** FLE **
146
+ ** Client-Side Field Level Encryption (CSFLE) **
147
147
148
- FLE is the first version of Client-Side Field Level Encryption. FLE is almost entirely client-side with the exception of
149
- server-side JSON schema.
148
+ CSFLE is the first version of In-Use Encryption. CSFLE is almost entirely client-side with the exception of server-side
149
+ JSON schema.
150
150
151
- ** Queryable Encryption**
151
+ ** Queryable Encryption (QE) **
152
152
153
- Queryable Encryption the second version of Client-Side Field Level Encryption. Data is encrypted client-side. Queryable
154
- Encryption supports indexed encrypted fields, which are further processed server-side.
153
+ Queryable Encryption the second version of In-Use Encryption. Data is encrypted client-side. Queryable Encryption
154
+ supports indexed encrypted fields, which are further processed server-side.
155
155
156
156
** In-Use Encryption**
157
157
158
- Is an umbrella term describing the both FLE and Queryable Encryption.
158
+ Is an umbrella term describing the both CSFLE and Queryable Encryption.
159
159
160
160
** encryptedFields**
161
161
@@ -237,6 +237,7 @@ created_key_id = clientencryption.create_data_key("aws", opts)
237
237
opts = EncryptOpts(key_id = created_key_id,
238
238
algorithm = " AEAD_AES_256_CBC_HMAC_SHA_512-Random" )
239
239
encrypted = clientencryption.encrypt(" secret text" , opts)
240
+ # Decryption does not require the key ID or algorithm. The ciphertext indicates the key ID and algorithm used.
240
241
decrypted = clientencryption.decrypt(encrypted)
241
242
```
242
243
@@ -2223,17 +2224,17 @@ KMIP support in the MongoDB server is a precedent. The server supports `--kmipSe
2223
2224
TLS options may be useful for the AWS , Azure, and GCP KMS providers in a case where the default trust store does not
2224
2225
include the needed CA certificates.
2225
2226
2226
- # ## Why is it an error to have an FLE 1 and Queryable Encryption field in the same collection?
2227
+ # ## Why is it an error to have an CSFLE and Queryable Encryption field in the same collection?
2227
2228
2228
- There is no technical limitation to having a separate FLE field and Queryable Encryption field in the same collection.
2229
- Prohibiting FLE and Queryable Encryption in the same collection reduces complexity. From the product perspective, a
2230
- random FLE field and a non- queryable Queryable Encryption field have the same behavior and similar security guarantees.
2231
- A deterministic FLE field leaks more information then a deterministic Queryable Encryption field. There is not a
2232
- compelling use case to use both FLE and Queryable Encryption in the same collection.
2229
+ There is no technical limitation to having a separate CSFLE field and Queryable Encryption field in the same collection.
2230
+ Prohibiting CSFLE and Queryable Encryption in the same collection reduces complexity. From the product perspective, a
2231
+ random CSFLE field and a non- queryable Queryable Encryption field have the same behavior and similar security
2232
+ guarantees. A deterministic CSFLE field leaks more information then a deterministic Queryable Encryption field. There is
2233
+ not a compelling use case to use both CSFLE and Queryable Encryption in the same collection.
2233
2234
2234
2235
# ## Is it an error to set schemaMap and encryptedFieldsMap?
2235
2236
2236
- No. FLE and Queryable Encryption fields can coexist in different collections. The same collection cannot be in the
2237
+ No. CSFLE and Queryable Encryption fields can coexist in different collections. The same collection cannot be in the
2237
2238
`encryptedFieldsMap` and `schemaMap` . [libmongocrypt](# libmongocrypt) will error if the same collection is specified in
2238
2239
a `schemaMap` and `encryptedFieldsMap` .
2239
2240
0 commit comments