Deterministic encryption produces the same ciphertext whenever the same plaintext is encrypted with the same key. In MongoDB client-side field-level encryption, this predictable output enables exact equality queries while keeping sensitive values hidden from MongoDB. section 20.5.4
Use deterministic encryption with these constraints:
- Apply it when an application must match encrypted values exactly, such as a social security number. section 20.5.4
- Do not expect range, prefix, suffix, or substring queries; those require comparisons beyond exact equality. section 20.5.4
- Consider Queryable Encryption when encrypted equality, range, prefix, suffix, or substring searches are required. section 20.5.4
Encrypted social security number
An application sends a document containing a socialSecurityNumber to an authenticated client. The client-side driver encrypts the field before transmission, stores ciphertext in MongoDB, and decrypts authorized results; MongoDB never sees the plaintext. section 20.5.4
{
"name": "Name Surname",
"socialSecurityNumber": "123-45-6789",
"email": "user@example.com"
}
Inspect the plaintext document before client-side field-level encryption. section 20.5.4
{
"name": " Name Surname",
"socialSecurityNumber": { "$binary": "AE4F0F9DE7..." },
"email": "user@example.com"
}
Compare the stored document after the sensitive field has become ciphertext. section 20.5.4
