You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
- the algorithm "AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic"
217
-
- the "local" KMS provider
243
+
Then, test creating and using data keys from a ``local`` KMS provider:
218
244
219
-
- Expect the value is equal to a known BSON binary of subtype 6
220
-
- Use `KeyVault.decrypt` to decrypt the encrypted value
221
-
- Expect the value is equal to the string "hello"
245
+
#. Call ``client_encryption.createDataKey()`` with the ``local`` KMS provider and keyAltNames set to ``["local_altname"]``.
222
246
223
-
#. Test explicit encrypt and decrypt with the "aws" KMS provider.
247
+
- Expect a BSON binary with subtype 4 to be returned, referred to as ``local_datakey_id``.
248
+
- Use ``client`` to run a ``find`` on ``admin.datakeys`` by querying with the ``_id`` set to the ``local_datakey_id``.
249
+
- Expect that exactly one document is returned with the "masterKey.provider" equal to "local".
224
250
225
-
- Create a `KeyVault` with a "aws" KMS provider.
226
-
- Insert the a key document in to the key vault.
227
-
- Use `KeyVault.encrypt` to encrypt the value "hello" with the following:
251
+
#. Call ``client_encryption.encrypt()`` with the value "hello local", the algorithm ``AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic``, and the ``key_id`` of ``local_datakey_id``.
228
252
229
-
- the algorithm "AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic"
230
-
- the "aws" KMS provider
253
+
- Expect the return value to be a BSON binary subtype 6, referred to as ``local_encrypted``.
254
+
- Use ``client_encrypted`` to insert ``{ _id: "local", "value": <local_encrypted> }`` into ``db.coll``.
255
+
- Use ``client_encrypted`` to run a find querying with ``_id`` of "local" and expect ``value`` to be "hello local".
231
256
232
-
- Expect the value is equal to a known BSON binary of subtype 6
233
-
- Use `KeyVault.decrypt` to decrypt the encrypted value
234
-
- Expect the value is equal to the string "hello"
257
+
#. Call ``client_encryption.encrypt()`` with the value "hello local", the algorithm ``AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic``, and the ``key_alt_name`` of ``local_altname``.
235
258
236
-
#. Test explicit encrypt of invalid values.
259
+
- Expect the return value to be a BSON binary subtype 6. Expect the value to exactly match the value of ``local_encrypted``.
237
260
238
-
- Create a `KeyVault` with either a "local" or "aws" KMS provider
239
-
- Use `KeyVault.encrypt` to attempt to encrypt each BSON type with deterministic encryption.
261
+
Then, repeat the above tests with the ``aws`` KMS provider:
240
262
241
-
- Expect a `string` to succeed. An exception MUST be thrown.
242
-
- Expect a `document` to fail. An exception MUST be thrown.
243
-
- Expect a `null` to fail. An exception MUST be thrown.
244
-
- Expect a BSON binary subtype 6 to fail. An exception MUST be thrown.
263
+
#. Call ``client_encryption.createDataKey()`` with the ``aws`` KMS provider, keyAltNames set to ``["aws_altname"]``, and ``masterKey`` as follows:
245
264
246
-
- Use `KeyVault.encrypt` to attempt to encrypt a document using randomized encryption.
265
+
.. code:: javascript
247
266
248
-
- Expect a `document` to succeed.
249
-
- Expect a BSON binary subtype 6 to fail. An exception MUST be thrown.
250
-
- Expect a `null` to fail. An exception MUST be thrown.
- Create a `KeyVault` with either a "local" or "aws" KMS provider
255
-
- Use `KeyVault.encrypt` to encrypt a value.
256
-
- Create a document, setting some field to the value.
257
-
- Insert the document into a collection.
258
-
- Find the document. Verify both the value matches the originally set value.
273
+
- Expect a BSON binary with subtype 4 to be returned, referred to as ``aws_datakey_id``.
274
+
- Use ``client`` to run a ``find`` on ``admin.datakeys`` by querying with the ``_id`` set to the ``aws_datakey_id``.
275
+
- Expect that exactly one document is returned with the "masterKey.provider" equal to "aws".
276
+
277
+
#. Call ``client_encryption.encrypt()`` with the value "hello aws", the algorithm ``AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic``, and the ``key_id`` of ``aws_datakey_id``.
278
+
279
+
- Expect the return value to be a BSON binary subtype 6, referred to as ``aws_encrypted``.
280
+
- Use ``client_encrypted`` to insert ``{ _id: "aws", "value": <aws_encrypted> }`` into ``db.coll``.
281
+
- Use ``client_encrypted`` to run a find querying with ``_id`` of "aws" and expect ``value`` to be "hello aws".
282
+
283
+
#. Call ``client_encryption.encrypt()`` with the value "hello aws", the algorithm ``AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic``, and the ``key_alt_name`` of ``aws_altname``.
284
+
285
+
- Expect the return value to be a BSON binary subtype 6. Expect the value to exactly match the value of ``aws_encrypted``.
286
+
287
+
288
+
Then, run the following final tests:
259
289
260
290
#. Test explicit encrypting an auto encrypted field.
261
291
262
-
- Create a `KeyVault` with either a "local" or "aws" KMS provider
263
-
- Create a collection with a JSON Schema specifying an encrypted field.
264
-
- Use `KeyVault.encrypt` to encrypt a value.
265
-
- Create a document, setting the auto-encrypted field to the value.
266
-
- Insert the document. Verify an exception is thrown.
292
+
- Use ``client_encrypted`` to attempt to insert ``{ "encrypted_placeholder": (local_encrypted) }``
293
+
- Expect an exception to be thrown, since this is an attempt to auto encrypt an already encrypted value.
294
+
295
+
296
+
Corpus Test
297
+
===========
298
+
299
+
The corpus test exhaustively enumerates all ways to encrypt all BSON value types. Note, the test data includes BSON binary subtype 4 (or standard UUID), which MUST be decoded and encoded as subtype 4. Run the test as follows.
300
+
301
+
1. Create a MongoClient without encryption enabled (referred to as ``client``).
302
+
303
+
2. Using ``client``, drop and create the collection ``db.coll`` configured with the included JSON schema `corpus/corpus-schema.json <corpus/corpus-schema.json>`_.
304
+
305
+
3. Using ``client``, drop the collection ``admin.datakeys``. Insert the documents `corpus/corpus-key-local.json <corpus/corpus-key-local.json>`_ and `corpus/corpus-key-aws.json <corpus/corpus-key-aws.json>`_.
306
+
307
+
4. Create the following:
308
+
309
+
- A MongoClient configured with auto encryption (referred to as ``client_encrypted``)
310
+
- A ``ClientEncryption`` object (referred to as ``client_encryption``)
311
+
312
+
Configure both objects with ``aws`` and the ``local`` KMS providers as follows:
Configure both objects with ``keyVaultNamespace`` set to ``admin.datakeys``.
328
+
329
+
5. Load `corpus/corpus.json <corpus/corpus.json>`_ to a variable named ``corpus``. The corpus contains subdocuments with the following fields:
330
+
331
+
- ``kms`` is either ``aws`` or ``local``
332
+
- ``type`` is a BSON type string `names coming from here <https://docs.mongodb.com/manual/reference/operator/query/type/>`_)
333
+
- ``algo`` is either ``rand`` or ``det`` for random or deterministic encryption
334
+
- ``method`` is either ``auto``, for automatic encryption or ``explicit`` for explicit encryption
335
+
- ``identifier`` is either ``id`` or ``altname`` for the key identifier
336
+
- ``allowed`` is a boolean indicating whether the encryption for the given parameters is permitted.
337
+
- ``value`` is the value to be tested.
338
+
339
+
Create a new BSON document, named ``corpus_copied``.
340
+
Iterate over each field of ``corpus``.
341
+
342
+
- If the field name is ``_id``, ``altname_aws`` and ``altname_local``, copy the field to ``corpus_copied``.
343
+
- If ``method`` is ``auto``, copy the field to ``corpus_copied``.
344
+
- If ``method`` is ``explicit``, use ``client_encryption`` to explicitly encrypt the value.
345
+
346
+
- Encrypt with the algorithm described by ``algo``.
347
+
- If ``identifier`` is ``id``
348
+
- If ``kms`` is ``local`` set the key_id to the UUID with base64 value ``LOCALAAAAAAAAAAAAAAAAA==``.
349
+
- If ``kms`` is ``aws`` set the key_id to the UUID with base64 value ``AWSAAAAAAAAAAAAAAAAAAA==``.
350
+
- If ``identifier`` is ``altname``
351
+
- If ``kms`` is ``local`` set the key_alt_name to "local".
352
+
- If ``kms`` is ``aws`` set the key_alt_name to "aws".
353
+
354
+
If ``allowed`` is true, copy the field and encrypted value to ``corpus_copied``.
355
+
If ``allowed`` is false. verify that an exception is thrown. Copy the unencrypted value to to ``corpus_copied``.
356
+
357
+
358
+
6. Using ``client_encrypted``, insert ``corpus_copied`` into ``db.coll``.
359
+
360
+
7. Using ``client_encrypted``, find the inserted document from ``db.coll`` to a variable named ``corpus_decrypted``. Since it should have been automatically decrypted, assert the document exactly matches ``corpus``.
361
+
362
+
8. Load `corpus/corpus_encrypted.json <corpus/corpus-encrypted.json>`_ to a variable named ``corpus_encrypted_expected``.
363
+
Using ``client`` find the inserted document from ``db.coll`` to a variable named ``corpus_encrypted_actual``.
364
+
365
+
Iterate over each field of ``corpus_encrypted_expected`` and check the following:
366
+
367
+
- If the ``algo`` is ``det``, that the value exactly matches all fields in ``corpus_encrypted_actual`` with the same ``kms``, ``type``, and ``algo``.
368
+
- If the ``algo`` is ``rand`` and ``allowed`` is true, that the value does not match any fields in ``corpus_encrypted_actual`` with the same ``kms`` and ``type``.
369
+
- If the ``method`` is ``auto`` or ``explicit``, decrypt the value with ``client_encryption`` and validate the value exactly matches the corresponding field of ``corpus``.
370
+
- If the ``allowed`` is false, validate the value exactly matches the corresponding field of ``corpus``.
371
+
372
+
9. Repeat steps 1-8 with a local JSON schema. I.e. amend step 4 to configure the schema on ``client_encrypted`` and ``client_encryption`` with the ``schema_map`` option.
0 commit comments