Overview
You can use the .NET/C# Driver to encrypt specific document fields by using a set of features called in-use encryption. In-use encryption allows your application to encrypt data before sending it to MongoDB and query documents with encrypted fields.
Warning
MongoDB 8.2 Known Issue
On Windows platforms, you cannot run version 8.2.0 of mongocryptd with the default spawn arguments. To avoid this issue, you must manually start the mongocryptd process and specify the --logpath argument. Alternatively, use the Automatic Encryption Shared Library instead of mongocryptd.
To learn more about this issue and how to resolve it, see Known Issues in the MongoDB 8.2 Release Notes.
In-use encryption prevents unauthorized users from viewing plaintext data as it is sent to MongoDB or while it is in an encrypted database. To enable in-use encryption in an application and authorize it to decrypt data, you must create encryption keys that only your application can access. Only applications that have access to your encryption keys can access the decrypted, plaintext data. If an attacker gains access to the database, they can only see the encrypted ciphertext data because they lack access to the encryption keys.
You might use in-use encryption to encrypt fields in your MongoDB documents that contain the following types of sensitive data:
Credit card numbers
Addresses
Health information
Financial information
Any other sensitive or personally identifiable information (PII)
MongoDB offers the following features to enable in-use encryption:
Queryable Encryption
Client-side Field Level Encryption
Queryable Encryption
Queryable Encryption (QE) is an in-use encryption feature that supports querying uniquely encrypted field values, including equality, range, prefix, suffix, and substring queries. Range query support requires MongoDB Server 8.0 or later. Prefix, suffix, and substring query support requires MongoDB Server 9.0 or later.
To learn more about Queryable Encryption, see Queryable Encryption in the Server manual.
Client-side Field Level Encryption
Client-side Field Level Encryption (CSFLE) supports searching encrypted fields for equality. MongoDB Server version 4.2 introduced CSFLE.
Unlike QE, CSFLE requires you to select an encryption algorithm for each field, and that choice determines whether you can query the field. Deterministic encryption always produces the same output value for the same input value. Because matching values look the same after encryption, you can run equality queries on these fields. Randomized encryption produces a different output value each time it encrypts the same input value. Drivers can decrypt these fields, but you cannot query them.
Deterministic encryption trades some confidentiality for query support. When an encrypted field has low cardinality, an attacker can compare how often each encrypted value appears and infer the original values. This technique is called frequency analysis. To protect fields that you do not query, use randomized encryption.
Tip
To learn more about these concepts, see the following Wikipedia entries:
To learn more about CSFLE, see CSFLE in the Server manual.