Queryable Encryption ESC/ECOC metadata compaction and leakage tradeoffs
Parent: MongoDB Security Architecture · Published reference · snapshot 2026-10-29
↓ Facts as markdownall context files
Source-anchored research for Queryable Encryption ESC/ECOC metadata compaction and leakage tradeoffs. Run status: COMPLETED.
These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.
Measurements and reference values
- MongoDB documents manual metadata compaction, recommends running it when metadata exceeds 1 GB, and exposes compactStructuredEncryptionData with per-field compactionTokens and a mongosh wrapper. (medium confidence) (verified as of 2026-10-14) [source]
Problems, failure modes and limitations
- MongoDB recommends manual metadata compaction above 1 GB; treat that operational threshold together with the scheduling leakage warning. (medium confidence) (verified as of 2026-10-14) [source]
- MongoDB documents omission of compactStructuredEncryptionData and other encrypted-collection operations from the slow query log and system.profile; this reduces diagnostic visibility and is not a claim that every log channel is protected. (low confidence) (verified as of 2026-10-14) [source]
- SERVER-128430 describes concurrent writes racing with ECOC rename/recreation during cleanup or compaction. On sharded clusters, implicit ECOC creation can fail inside a distributed transaction. The ticket was updated October 5, 2026; its listed versions and resolution do not prove every later build is affected. (low confidence) (verified as of 2026-10-05) [source]
- MongoDB excludes persistent adversaries and adversaries possessing both database snapshots and accompanying query transcripts/logs from Queryable Encryption security guarantees. Its documented redaction omits compactStructuredEncryptionData from the slow query log and profiler on encrypted collections. (low confidence) (verified as of 2026-10-14) [source]
Facts and statements
- QE maintains ESC and ECOC metadata collections alongside the encrypted collection; Go driver integration tests explicitly check their creation. (medium confidence) [source]
- For equality-indexed fields, each insert or update adds one ESC write and one ECOC write per indexed field. Before compaction, each metadata collection stores one document per indexed field/value occurrence. (low confidence) [source]
- Metadata compaction empties ECOC and reduces ESC by removing redundant metadata documents; compactStructuredEncryptionData is the dedicated command. (medium confidence) [source]
- MongoDB warns that compaction can, in the worst case, reveal how many unique field/value pairs were inserted since the previous compaction. (low confidence) [source]
- The documented scheduling rule for removing at least t ESC documents is (encfields × docinserts) − valinserts ≥ t, with valinserts counting unique field/value pairs since the last compaction. (low confidence) [source]
- The documented workflow runs compaction manually through an encryption-configured mongosh client; the command accepts field-to-compaction-token mappings. (medium confidence) [source]
- The ETH Zurich analysis published in June 2023 studied the MongoDB 6.0 public-preview design, including an ECC collection absent from the current two-collection description. Its compaction attack assumes access to an operation-log snapshot after compaction and a similarly distributed auxiliary plaintext dataset; statistical attack evaluation used simulated leakage. These are historical results, not verification against current releases. (low confidence) [source]
- MongoDB excludes persistent adversaries and attackers with snapshots plus query transcripts/logs from QE security guarantees. The ETH attack illustrates why log-inclusive compromise needs separate assessment. (medium confidence) [source]
- MongoDB engineering issue SERVER-92399 describes range-compaction padding documents added to ESC to reduce leakage of real anchor documents. It reports an unsigned-underflow problem in unit-test padding calculations; this record does not establish a deployed production exploit. (low confidence) [source]
- SWiSSSE proposes evaluating leakage across both encrypted indexes and encrypted documents. Its research constructions combine response-volume bucketization, delayed pseudorandom write-backs, and indistinguishable searches and updates; these are research techniques, not documented MongoDB compaction options. (low confidence) [source]
- MongoDB creates enxcol_.<collectionName>.esc and enxcol_.<collectionName>.ecoc alongside an encrypted collection. These metadata structures and __safeContent__ must not be manually altered. (low confidence) [source]
Children
- Compaction scheduling and distinct-value leakage (frontier)
- Range compaction anchor padding (frontier)
- Replication-log leakage in searchable encryption (frontier)
- ECOC recreation races during concurrent writes (frontier)
Frontier under this node: Compaction scheduling and distinct-value leakage, ECOC recreation races during concurrent writes, Range compaction anchor padding, Replication-log leakage in searchable encryption