Client Side Field Level Encryption (CSFLE)

Parent: Client Side Operations Timeout (CSOT) · Published reference · snapshot 2026-10-15 · viability 3.10 / 5 (skip)

↓ Facts as markdown all context files

Depth-first rabbithole dossier for Client Side Field Level Encryption (CSFLE); source-anchored research pack.

These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.

How it works

[low] If automatic client-side encryption or decryption is enabled, the remaining `timeoutMS` value MUST be used as the `timeoutMS` when executing `listCollections` commands to retrieve collection schemas, `find` commands to get data from the key vault, and any commands sent to mongocryptd. Sources: https://raw.githubusercontent.com/mongodb/specifications/master/source/client-side-operations-timeout/client-side-operations-timeout.md [source]
[low] When sending a command to mongocryptd, drivers MUST NOT append a `maxTimeMS` field to ensure that a `maxTimeMS` field can be safely appended after the command is marked by mongocryptd and encrypted by libmongocrypt. Sources: https://raw.githubusercontent.com/mongodb/specifications/master/source/client-side-operations-timeout/client-side-operations-timeout.md [source]

Measurements and reference values

[low] The maximum size for an `_id` field value in Azure DocumentDB is 2 KB. Sources: https://learn.microsoft.com/en-us/azure/documentdb/limitations [source]

Comparisons and alternatives

[low] In Azure DocumentDB wildcard indexes, if the indexed field is an array of arrays, the entire embedded array is taken as a value instead of traversing its contents. Sources: https://learn.microsoft.com/en-us/azure/documentdb/limitations [source]

Facts and statements

[low] Client-Side Field Level Encryption depends on server-enforced uniqueness of key alternate names, requiring a partial unique index on the `keyAltNames` field before adding a new key alternate name. Sources: https://www.mongodb.com/docs/manual/core/csfle/fundamentals/manage-keys.md [source]
[low] If a Data Encryption Key (DEK) is deleted, all fields encrypted with that DEK become permanently unreadable. Sources: https://www.mongodb.com/docs/manual/core/csfle/fundamentals/manage-keys.md [source]
[low] With version 1.5 and later of the Mongo Shell, users can rotate encryption keys using the `rewrapManyDataKey` method, which automatically decrypts multiple data keys and re-encrypts them using a specified Customer Master Key. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/manual/core/csfle/fundamentals/manage-keys.md [source]
[low] Drivers MUST check that the `iscryptd` field in the server's description is `true` to determine whether the server is a mongocryptd. Sources: https://raw.githubusercontent.com/mongodb/specifications/master/source/client-side-operations-timeout/client-side-operations-timeout.md [source]
[low] If `timeoutMS` is set on both the client and directly in `ClientEncryption`, the value provided to `ClientEncryption` takes precedence. Sources: https://www.mongodb.com/docs/drivers/node/current/connect/connection-options/csot.md [source]
[low] The default KMIP protocol version is 1.2, but MongoDB can be configured to use KMIP version 1.0 or 1.1 in the server configuration file. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/manual/core/csfle/fundamentals/manage-keys.md [source]
[low] Automatic encryption is unaffected by the missing `timeoutMS` implementation in PyMongo and remains conformant. Sources: https://jira.mongodb.org/browse/PYTHON-6037 [source]
[low] PYTHON-6037's definition of done proposes that PyMongo's `timeout_ms` default to the key vault client's `timeoutMS`, with an explicit value taking precedence; it is not yet implemented. Sources: https://jira.mongodb.org/browse/PYTHON-6037 [source]
[low] The maximum number of compound index fields in Azure DocumentDB is 32. Sources: https://learn.microsoft.com/en-us/azure/documentdb/limitations [source]
[low] The maximum level of nesting for embedded objects/arrays on index definitions in Azure DocumentDB is 6. Sources: https://learn.microsoft.com/en-us/azure/documentdb/limitations [source]
[low] In Azure DocumentDB, the `key` field is required in the `$geoNear` aggregation stage. Sources: https://learn.microsoft.com/en-us/azure/documentdb/limitations [source]
[low] Node implements the `timeoutMS` option for `ClientEncryption`, resolving it from the key vault client, allowing it to be overridden per instance, applying it to every operation, and marking it as experimental. Sources: https://jira.mongodb.org/browse/PYTHON-6037 [source]
[low] PyMongo does not implement the `timeoutMS` option for `ClientEncryption`, so explicit encryption establishes no CSOT deadline and KMS requests always use the default connect timeout. Sources: https://jira.mongodb.org/browse/PYTHON-6037 [source]
[low] No `_csot.apply` exists in either `encryption.py` file in PyMongo, so there is no deadline plumbing to extend. Sources: https://jira.mongodb.org/browse/PYTHON-6037 [source]

Related concepts

Field — is a part of Client Side Field Level Encryption (CSFLE)
Encryption — is a part of Client Side Field Level Encryption (CSFLE)
CSFLE — is a part of Client Side Field Level Encryption (CSFLE)
Client — is a part of Client Side Field Level Encryption (CSFLE)
Level — is a part of Client Side Field Level Encryption (CSFLE)

Children

No children recorded.

← the whole tree · 3D view· how to read this page