Docs Menu
Docs Home
/
Database Manual
/ / / / /

Install and Configure a CSFLE Query Analysis Component

MongoDB uses the Automatic Encryption Shared Library (recommended) or the mongocryptd executable process to translate queries into encrypted queries, and to encrypt or decrypt data.

To use CSFLE with automatic encryption, you must first choose the query analysis component you want MongoDB to use to encrypt the fields.

  • crypt_shared, the recommended CSFLE library.

  • mongocryptd, which is included in MongoDB Enterprise Server installations.

The libmongocrypt library and MongoDB drivers require the Automatic Encryption Shared Library or mongocryptd to interpret encrypted queries. For more information, see Install libmongocrypt for CSFLE.

The Automatic Encryption Shared Library is a dynamic library that enables your client application to perform automatic encryption. A dynamic library is a set of functionality accessed by an application at runtime rather than compile time. The Automatic Encryption Shared Library performs the following tasks:

  • Reads the encryption schema to determine which fields to encrypt or decrypt

  • Prevents your application from executing unsupported operations on encrypted fields

The Automatic Encryption Shared Library does not do any of the following:

  • Perform data encryption or decryption

  • Access the encryption key material

  • Listen for data over the network

The Automatic Encryption Shared Library is a preferred alternative to mongocryptd and does not require you to spawn another process to perform automatic encryption.

Note

While we recommend using the Automatic Encryption Shared Library, mongocryptd is still supported.

To learn more about automatic encryption, see CSFLE Features.

mongocryptd is installed with MongoDB Enterprise Server.

When you create a CSFLE-enabled MongoDB client, the mongocryptd process starts automatically by default.

The mongocryptd process:

  • Uses the specified automatic encryption rules to mark fields in read and write operations for encryption.

  • Prevents unsupported operations from executing on encrypted fields.

  • Parses the encryption schema specified for the database connection. Automatic encryption rules use a strict subset of JSON schema syntax. If the rules contain invalid automatic encryption syntax or any schema validation syntax, mongocryptd returns an error.

mongocryptd only performs the previous functions, and doesn't perform any of the following:

  • mongocryptd doesn't perform encryption or decryption

  • mongocryptd doesn't access any encryption key material

  • mongocryptd doesn't listen over the network

To perform field encryption and automatic decryption, the drivers use the Apache-licensed libmongocrypt library.

The official MongoDB drivers require access to the mongocryptd process on the client host machine. These clients search for the mongocryptd process in the system PATH by default.

Select the query analysis component you want to use and follow the steps to install and configure a CSFLE query analysis component.

Back

How CSFLE Decrypts Documents

On this page