为 Mongo 客户端字段级加密（CSFLE）生成单个数据密钥

Question

I am using the second example mentioned here for client side field level encryption and it is working as expected. I create a Mongo client bean once and use it through out until my application is stopped.

I wanted to find if there are better ways of doing the following things and have few doubts:

1. The below commands is run each time I re-start the server:

BsonBinary dataKeyId = clientEncryption.createDataKey("local", new DataKeyOptions());

This generates a new key each time and inserts in my key vault collection. I am curious if there is a way to use the old key itself by fetching it for space optimisation. Is there any advantage in terms of security for either of these approaches?

2. If I am using AWS KMS, does my mongo client call keyvault collection and KMS for each fetch/update call?

3. If I enable AWS KMS key rotation, does key rotation cause issue while decrypting old data?

Thanks in advance.

Answer 1

I am using the second example mentioned here for client side field level encryption and it is working as expected. I create a Mongo client bean once and use it through out until my application is stopped.

I wanted to find if there are better ways of doing the following things and have few doubts:

1. The below commands is run each time I re-start the server:

BsonBinary dataKeyId = clientEncryption.createDataKey("local", new DataKeyOptions());

This generates a new key each time and inserts in my key vault collection. I am curious if there is a way to use the old key itself by fetching it for space optimisation. Is there any advantage in terms of security for either of these approaches?

2. If I am using AWS KMS, does my mongo client call keyvault collection and KMS for each fetch/update call?

3. If I enable AWS KMS key rotation, does key rotation cause issue while decrypting old data?

Thanks in advance.