# Client Side Field Level Encryption (CSFLE) > Depth-first rabbithole dossier for Client Side Field Level Encryption (CSFLE); source-anchored research pack. Parent: [Client Side Operations Timeout (CSOT)](https://llms-explorer.com/tree/client-side-operations-timeout-csot/) · 4 facets · 18 facts · page: https://llms-explorer.com/tree/client-side-field-level-encryption-csfle/ ## How it works - [low] If automatic client-side encryption or decryption is enabled, the remaining `timeoutMS` value MUST be used as the `timeoutMS` when executing `listCollections` commands to retrieve collection schemas, `find` commands to get data from the key vault, and any commands sent to mongocryptd. Sources: https://raw.githubusercontent.com/mongodb/specifications/master/source/client-side-operations-timeout/client-side-operations-timeout.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/client-side-field-level-encryption-csfle-dd3fa281d3/rabbithole-synthesis.md#core` - [low] When sending a command to mongocryptd, drivers MUST NOT append a `maxTimeMS` field to ensure that a `maxTimeMS` field can be safely appended after the command is marked by mongocryptd and encrypted by libmongocrypt. Sources: https://raw.githubusercontent.com/mongodb/specifications/master/source/client-side-operations-timeout/client-side-operations-timeout.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/client-side-field-level-encryption-csfle-dd3fa281d3/rabbithole-synthesis.md#core` ## Measurements and reference values - [low] The maximum size for an `_id` field value in Azure DocumentDB is 2 KB. Sources: https://learn.microsoft.com/en-us/azure/documentdb/limitations — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/client-side-field-level-encryption-csfle-dd3fa281d3/rabbithole-synthesis.md#core` ## Comparisons and alternatives - [low] In Azure DocumentDB wildcard indexes, if the indexed field is an array of arrays, the entire embedded array is taken as a value instead of traversing its contents. Sources: https://learn.microsoft.com/en-us/azure/documentdb/limitations — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/client-side-field-level-encryption-csfle-dd3fa281d3/rabbithole-synthesis.md#antipatterns` ## Facts and statements - [low] Client-Side Field Level Encryption depends on server-enforced uniqueness of key alternate names, requiring a partial unique index on the `keyAltNames` field before adding a new key alternate name. Sources: https://www.mongodb.com/docs/manual/core/csfle/fundamentals/manage-keys.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/client-side-field-level-encryption-csfle-dd3fa281d3/rabbithole-synthesis.md#core` - [low] If a Data Encryption Key (DEK) is deleted, all fields encrypted with that DEK become permanently unreadable. Sources: https://www.mongodb.com/docs/manual/core/csfle/fundamentals/manage-keys.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/client-side-field-level-encryption-csfle-dd3fa281d3/rabbithole-synthesis.md#antipatterns` - [low] With version 1.5 and later of the Mongo Shell, users can rotate encryption keys using the `rewrapManyDataKey` method, which automatically decrypts multiple data keys and re-encrypts them using a specified Customer Master Key. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/manual/core/csfle/fundamentals/manage-keys.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/client-side-field-level-encryption-csfle-dd3fa281d3/rabbithole-synthesis.md#tools` - [low] Drivers MUST check that the `iscryptd` field in the server's description is `true` to determine whether the server is a mongocryptd. Sources: https://raw.githubusercontent.com/mongodb/specifications/master/source/client-side-operations-timeout/client-side-operations-timeout.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/client-side-field-level-encryption-csfle-dd3fa281d3/rabbithole-synthesis.md#core` - [low] If `timeoutMS` is set on both the client and directly in `ClientEncryption`, the value provided to `ClientEncryption` takes precedence. Sources: https://www.mongodb.com/docs/drivers/node/current/connect/connection-options/csot.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/client-side-field-level-encryption-csfle-dd3fa281d3/rabbithole-synthesis.md#core` - [low] The default KMIP protocol version is 1.2, but MongoDB can be configured to use KMIP version 1.0 or 1.1 in the server configuration file. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/manual/core/csfle/fundamentals/manage-keys.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/client-side-field-level-encryption-csfle-dd3fa281d3/rabbithole-synthesis.md#core` - [low] Automatic encryption is unaffected by the missing `timeoutMS` implementation in PyMongo and remains conformant. Sources: https://jira.mongodb.org/browse/PYTHON-6037 — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/client-side-field-level-encryption-csfle-dd3fa281d3/rabbithole-synthesis.md#core` - [low] PYTHON-6037's definition of done proposes that PyMongo's `timeout_ms` default to the key vault client's `timeoutMS`, with an explicit value taking precedence; it is not yet implemented. Sources: https://jira.mongodb.org/browse/PYTHON-6037 — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/client-side-field-level-encryption-csfle-dd3fa281d3/rabbithole-synthesis.md#core` - [low] The maximum number of compound index fields in Azure DocumentDB is 32. Sources: https://learn.microsoft.com/en-us/azure/documentdb/limitations — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/client-side-field-level-encryption-csfle-dd3fa281d3/rabbithole-synthesis.md#core` - [low] The maximum level of nesting for embedded objects/arrays on index definitions in Azure DocumentDB is 6. Sources: https://learn.microsoft.com/en-us/azure/documentdb/limitations — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/client-side-field-level-encryption-csfle-dd3fa281d3/rabbithole-synthesis.md#core` - [low] In Azure DocumentDB, the `key` field is required in the `$geoNear` aggregation stage. Sources: https://learn.microsoft.com/en-us/azure/documentdb/limitations — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/client-side-field-level-encryption-csfle-dd3fa281d3/rabbithole-synthesis.md#core` - [low] Node implements the `timeoutMS` option for `ClientEncryption`, resolving it from the key vault client, allowing it to be overridden per instance, applying it to every operation, and marking it as experimental. Sources: https://jira.mongodb.org/browse/PYTHON-6037 — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/client-side-field-level-encryption-csfle-dd3fa281d3/rabbithole-synthesis.md#patterns` - [low] PyMongo does not implement the `timeoutMS` option for `ClientEncryption`, so explicit encryption establishes no CSOT deadline and KMS requests always use the default connect timeout. Sources: https://jira.mongodb.org/browse/PYTHON-6037 — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/client-side-field-level-encryption-csfle-dd3fa281d3/rabbithole-synthesis.md#troubleshooting` - [low] No `_csot.apply` exists in either `encryption.py` file in PyMongo, so there is no deadline plumbing to extend. Sources: https://jira.mongodb.org/browse/PYTHON-6037 — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/client-side-field-level-encryption-csfle-dd3fa281d3/rabbithole-synthesis.md#troubleshooting` ## Related concepts - Field — is a part of Client Side Field Level Encryption (CSFLE) - Encryption — is a part of Client Side Field Level Encryption (CSFLE) - CSFLE — is a part of Client Side Field Level Encryption (CSFLE) - Client — is a part of Client Side Field Level Encryption (CSFLE) - Level — is a part of Client Side Field Level Encryption (CSFLE)