ClientEncryption.decrypt()
ClientEncryption.decrypt(encryptedValue)
ClientEncryption.decrypt()
decrypts theencryptionValue
if the current database connection was configured with access to the Key Management Service (KMS) and key vault used to encryptencryptionValue
.decrypt()
has the following syntax:clientEncryption = db.getMongo().getClientEncryption() clientEncryption.decrypt(encryptedValue) The
encryptedValue
must be abinary data
object with subtype 6 created using client-side field level encryption.Returns: The decrypted value.
Behavior
Read operations issued from a database connection configured
with access to the correct Key Management Service (KMS) and Key Vault can
automatically decrypt field values encrypted using
ClientEncryption.encrypt()
. Clients only need to use
decrypt()
to decrypt Binary
subtype 6
values not stored within a document field.
Enable Client-Side Field Level Encryption on Database Connection
The mongo
client-side field level encryption methods
require a database connection with client-side field level encryption
enabled. If the current database connection was not initiated with
client-side field level encryption enabled, either:
Use the
Mongo()
constructor from themongo
shell to establish a connection with the required client-side field level encryption options. TheMongo()
method supports the following Key Management Service (KMS) providers for Customer Master Key (CMK) management:or
Use the
mongo
shell command line options to establish a connection with the required options. The command line options only support the Amazon Web Services KMS provider for CMK management.
Example
The following example uses a locally managed KMS for the client-side field level encryption configuration.
Configuring client-side field level encryption for a locally
managed key requires specifying a base64-encoded 96-byte
string with no line breaks. The following operation generates
a key that meets the stated requirements and loads it into
the mongo
shell:
TEST_LOCAL_KEY=$(echo "$(head -c 96 /dev/urandom | base64 | tr -d '\n')") mongosh --nodb --shell --eval "var TEST_LOCAL_KEY='$TEST_LOCAL_KEY'"
Create the client-side field level encryption object using the generated local key string:
var ClientSideFieldLevelEncryptionOptions = { "keyVaultNamespace" : "encryption.__dataKeys", "kmsProviders" : { "local" : { "key" : BinData(0, TEST_LOCAL_KEY) } } }
Use the Mongo()
constructor to create a database connection
with the client-side field level encryption options. Replace the
mongodb://myMongo.example.net
URI with the connection string
URI of the target cluster.
encryptedClient = Mongo( "mongodb://myMongo.example.net:27017/?replSetName=myMongo", ClientSideFieldLevelEncryptionOptions )
Retrieve the ClientEncryption
object
and use the ClientEncryption.decrypt()
method to decrypt
a value encrypted by ClientEncryption.encrypt()
.
clientEncryption = encryptedClient.getClientEncryption(); clientEncryption.decrypt(BinData(6,"AmTi2H3xaEk8u9+jlFNaLLkC3Q/+kmwDbbWrq+h9nuv9W+u7A5a0UnpULBNZH+Q21fAztPpU09wpKPrju9dKfpN1Afpj1/ZhFcH6LYZOWSBBOAuUNjPLxMNSYOOuITuuYWo="))
If successful, decrypt()
returns the
decrypted value:
"123-45-6789"
For complete documentation on initiating MongoDB connections with
client-side field level encryption enabled, see Mongo()
.