kennwhite

MongoDB Client-Side Field Level Encryption (CSFLE) Using KMIP or Local Master Key (with mongosh)

Assumptions

• You have an accessible MongoDB deployment already running and accessible (self-managed or in Atlas)
• You have the modern MongoDB Shell (mongosh) installed locally on your workstation
• You have a KMIP Server running and accessible, if you don't intend to use a local keyfile (for an example of running and configuring a Hashicorp Vault development instance, see: Hashicorp Vault Configuration For MongoDB KMIP Use)

Configure Local Workstation Context Files

kennwhite

Not many papers share a critical view of the cryptography field, and when such papers are published they tend to be dismissed as "extreme opinions". But not talking about potential deficiencies is harmful for everyone on the long run, even if many actors' self-interest is the status quo (example: USSR). So here's a list of crypto papers and essays not purely technical, sometimes called "controverial", in arbitrary order (please send suggestions of missing entries):

Rogaway - The moral character of cryptographic work - https://web.cs.ucdavis.edu/~rogaway/papers/moral.pdf

Bernstein - Non-uniform cracks in the concrete: the power of free precomputation - http://cr.yp.to/nonuniform/nonuniform-20130914.pdf

kennwhite

# Build arguments for the gn build
# You can set these with `gn args out/Default`
#   ( and they're stored in src/out/Default/args.gn )
# See "gn args out/Default --list" for available build arguments

# component build, because people love it
is_component_build = true

# release build, because its faster
is_debug = false

kennwhite

hashcat (v5.0.0) starting in benchmark mode...

* Device #1: WARNING! Kernel exec timeout is not disabled.
             This may cause "CL_OUT_OF_RESOURCES" or related errors.
             To disable the timeout, see: https://hashcat.net/q/timeoutpatch
OpenCL Platform #1: NVIDIA Corporation
======================================
* Device #1: GeForce RTX 2080 Ti, 2816/11264 MB allocatable, 68MCU

Benchmark relevant options:

kennwhite

Nvidia RTX 2080 FE Hashcat Benchmarks

Product: As there is currently no Linux driver, we had to use chick3nman's desktop (Windows 7)

Software: Hashcat v4.2.1, Nvidia driver 411.63

Accelerator: 1x Nvidia RTX 2080 Founders Edition

Notes

kennwhite

Nvidia RTX 2080 SUPER FE Hashcat Benchmarks

Software: Hashcat v5.1.0, Nvidia driver 430.34

Accelerator: 1x Nvidia RTX 2080 SUPER Founders Edition

Notes

1. Only ~ 3% faster than non-SUPER 2080. Future drivers may show slightly better performance, but this seems like a pretty good driver as far as release-day drivers go.

kennwhite

Nvidia Driver version 411.63

hashcat (v4.2.1) starting in benchmark mode...

OpenCL Platform #1: Intel(R) Corporation
========================================
* Device #1: Intel(R) Core(TM) i7-6700K CPU @ 4.00GHz, skipped.

OpenCL Platform #2: NVIDIA Corporation
======================================

kennwhite

import java.security.Provider;
import java.security.Security;
import java.util.Enumeration;

public class SecurityProvidersAndAlgorithms {
  public static void main(String[] args) throws Exception {
    try {
      Provider p[] = Security.getProviders();
      for (int i = 0; i < p.length; i++) {
          System.out.println(p[i]);

kennwhite

/*
 * Copyright (c) 2008 - 2013 10gen, Inc. <http://10gen.com>
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *   http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software

kennwhite

/*
 * Copyright (c) 2008 - 2013 10gen, Inc. <http://10gen.com>
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *   http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software