Queryable Encryption contention and range-index tuning
Parent: MongoDB Security Architecture · Published reference · snapshot 2026-10-29
↓ Facts as markdownall context files
Source-anchored research for Queryable Encryption contention and range-index tuning. Run status: COMPLETED.
These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.
Definitions
- Contention is not a general protection against leakage abuse: the 2023 ETH analysis of preview-era equality QE found that query logs could reunite values across contention tokens. That result is historical evidence, not a demonstrated attack on current range-index tuning. (low confidence) [source]
How-to and procedures
- Set realistic inclusive min/max bounds to improve range efficiency; use the field's BSON type. Bounds are required when precision is specified. (high confidence) [source]
Problems, failure modes and limitations
- SERVER-92390 documents a historical small-domain failure: an unspecified trimFactor with a domain of six or fewer bits could produce 'Trim factor must be less than the number of bits used to represent the domain.' The tracker lists fixes in 8.0.0-rc14 and 8.1.0-rc0; this is not evidence of a current unfixed defect. (low confidence) [source]
Facts and statements
- Contention partitions per-value counters into randomly selected slots; increasing it reduces collisions for concurrent same-value writes but increases read work. (high confidence) [source]
- Queryable Encryption partitions each field/value counter into contention + 1 slots and randomly selects a slot on insertion, reducing conflicts between concurrent writes of repeated values. (high confidence) [source]
- trimFactor removes root levels from the encrypted range tree. Raising it reduces write conflicts and improves insert throughput, while slowing broad range reads. (high confidence) [source]
- Lower sparsity produces faster range queries with greater metadata storage overhead. MongoDB documents default 2 and a maximum increase from 4 to 8 in version 8.2; current repository validation permits 1–8. (high confidence) (verified as of 2026-10-14) [source]
- For double/decimal fields, precision truncates query digits without rounding or altering the stored encrypted value; reducing precision limits index overhead. (low confidence) [source]
- The consulted manual specifies defaults contention=8, sparsity=2 and trimFactor=6; SERVER-91077 records the latter two defaults. (medium confidence) (verified as of 2026-10-27) [source]
- Explicit-encryption RangeOpts must match the destination encryptedFields configuration for min, max, trimFactor, sparsity and precision; double/decimal128 min/max/precision must be supplied together or all omitted. (low confidence) (verified as of 2026-10-27) [source]
- Spring Data MongoDB 5.0 documents range configuration through @RangeEncrypted with contentionFactor and rangeOptions, including bounds and floating-point precision examples. (low confidence) [source]
- Spring Data MongoDB exposes range configuration through @RangeEncrypted and collection options. Its examples combine contentionFactor=8 with integer bounds 0–150, and use typed BSON bounds for decimal-valued fields. (medium confidence) (verified as of 2026-10-23) [source]
- Omit a query type for encrypted fields that never need encrypted searches to avoid generating their searchable indexes. (medium confidence) [source]
- The documented automatic-encryption contention default is 8; the server configuration also declares 8. Explicit encryption requires a contention value. (high confidence) (verified as of 2026-10-14) [source]
- Treat database snapshots accompanied by query transcripts/logs as outside current QE security guarantees, especially for range queries. The historical ETH study illustrates why logs require a separate threat-model review; increasing tuning parameters does not establish protection against this adversary. (medium confidence) (verified as of 2026-10-14) [source]
Children
- No children recorded.