MONGOID-5588 Add automatic FLE documentation

[comandeo]

No description provided.

[johnnyshields]

encrypt_with key_id: ___

# vs

field :ssn, type: Integer, encrypt: { deterministic: true, data_key_id: ___ }

It would be good to use either key_id or data_key_id consistently.

[comandeo]

Wow, I wonder how I could have missed that. Thank you!

[johnnyshields]

Several questions, which I think should be covered in the tutorial:

1. How do I migrate an existing field with unencrypted data in the DB to use encryption? (If it's not possible to encrypt in-place, perhaps the recommendation can be to make a new field which we must copy the data.)

   • Same question also applies to rotating encryption keys, e.g. if a key becomes compromised.

2. How do I query for encrypted data in various fields? What sorts of queries are supported--only exact match? How about different data types (String, Integer, Time, etc.)

3. If I want to encrypt a string or decrypt a BSON::Binary value, how can I do that? In my existing gem I can do Mongoid::EncryptedString.encrypt("foobar") / .decrypt("____")

[alexbevi]

@johnnyshields

How do I migrate an existing field with unencrypted data in the DB to use encryption? (If it's not possible to encrypt in-place, perhaps the recommendation can be to make a new field which we must copy the data.)

Same question also applies to rotating encryption keys, e.g. if a key becomes compromised.

Regarding the first point, we plan on covering this content in a more targeted fashion (ex: blog post) as this is an activity that isn't limited to just Mongoid. We'll link to this from the Mongoid docs once ready though.

For questions 2 and 3 we'll see if we can address that still.

[alexbevi]

@comandeo first pass completed, let me know what you think