Skip to main content

Module field_encryption

chronix_engine::segment

Module field_encryption 

Source
Expand description

Field-level encryption for columnar segment blocks.

Provides per-column AES-256-GCM encryption with per-block random nonces. Each encrypted block is stored as [12-byte nonce][ciphertext + 16-byte tag].

§Security Properties

  • Per-block random nonces: every column block gets a fresh 12-byte nonce from OsRng, preventing nonce reuse even if the same data is written twice.
  • Authenticated encryption: AES-256-GCM provides both confidentiality and integrity. Tampered ciphertext is detected and rejected.
  • Stats suppression: encrypted columns have their min/max/sum/distinct statistics zeroed to prevent information leakage via zone maps.
  • Bloom filter suppression: tag columns with encryption skip bloom filter construction.

§Performance Tradeoff: Statistics Suppression

Encrypting a column suppresses all zone-map statistics (min, max, sum, distinct count). This is a deliberate security measure — publishing plaintext min/max values would leak information about the encrypted data.

Consequence: Predicate pushdown cannot prune row groups based on encrypted columns. Queries that filter primarily on an encrypted column will read and decrypt every segment instead of skipping non-matching row groups. This can cause significant read amplification when most data would otherwise be pruned (e.g., 10× for a 90%-selective filter).

Mitigation strategies:

  1. Filter on non-encrypted columns first. Time-range and plaintext tag filters still benefit from zone-map pruning and bloom filters. Apply encrypted-column predicates as a post-decryption filter.

  2. Encrypt only sensitive fields. Keep frequently-filtered columns (e.g., host, region) in plaintext and encrypt only payload fields (e.g., patient_id, credit_card).

  3. Partition by sensitive dimension. If you need to filter on an encrypted tag, consider using it as a partition key so that each segment contains exactly one distinct value.

For a full discussion see the encryption section in the user guide.

§Key Management

Keys are identified by string IDs, enabling key rotation. The writer receives a mapping of column names to FieldEncryptionKey values. The reader must provide a FieldKeyProvider that resolves key IDs to the actual 256-bit key material.

§Format

Encrypted block layout:
  [nonce: 12 bytes][ciphertext: N bytes][auth_tag: 16 bytes]

Where N = len(encoded_and_possibly_compressed_block)

Structs§

FieldEncryptionConfig
Configuration for field-level encryption in the segment writer.
FieldEncryptionKey
A 256-bit encryption key with its ID for key rotation tracking.
StaticKeyProvider
Simple in-memory key provider for testing and embedded use.

Traits§

FieldKeyProvider
Trait for resolving encryption key IDs to key material during reads.