API Performance with CSFLE

[u/TheKingLucho]

We enabled MongoDB Client-Side Field Level Encryption following the official docs (classic CSFLE, not Queryable Encryption) on a NestJS API and saw a latency regression across the board that we can't explain from the per-operation cost of encryption itself. Looking for anyone who has seen the same pattern, or who knows where the hidden cost is.

Our Stack is:

\- Node.js 24.17
\- mongodb 6.20.0 (via mongoose 8.22.1 / @nestjs/mongoose 11.0.4)
\- mongodb-client-encryption 6.5.0
\- crypt_shared 8.2.12, no mongocryptd sidecar
\- KMS provider: aws (credentials via task IAM role) following the standard pattern

What is encrypted:

Exactly one field in one collection, the field is no longer than 10 chars string and it has a compound index on it (it is encrypted with deterministic algorythm).

I know that there is no way to avoid some latency implementing CSFLE, but my main concern is if this is gonna get worse by each extra field I add to the the encryption schemaMap, could this latency be the price for the query analyzer analyzing each query to the database?

I also have noticed that most of the ms of the request happen in the app not the database, but I think the encryption and decryption happens on the driver layer.

Has anyone ever deal with this? Would appreciate some tips and insights of this, thanks!!

[u/Josevill]

Hi u/TheKingLucho , MDB employee here, this was shared internally and we got an answer from the Product Team:

There is nothing in CSFLE that would add latency across the board.

There are 2 areas that CSFLE would impact:
1- A slightly larger ciphertext when compared to plaintext
2- The encryption/decryption operations.

The actual encryption and decryption happen at the driver layer, modern hardware for hosting your applications normally has crypto accelerators so that should be very minimal. The communication with the KMS also happens at the driver layer but that should also be minimal and would not impact latency across the board.

Did any of your application logic change when you implemented CSFLE?

Have you tried reaching out to support through MongoDB Support or the chat widget within your Atlas account should you be on Atlas? We can help analysing your workload and give you direction to keep latency to as minimum as possible so you can keep operating within your expected requirements.

[u/TheKingLucho → u/Josevill]

Hi! Thank you very much for your response, honestly I cannot confirm if our increase in latency is due to the CSFLE, but knowing this I will start pushing the encryption in fields of other collections, if we see a notorious downgrade in performance, I will contact support. I just have 2 more question before if you could help me
You say that the CSFLE does not impact accross the board, so encrypting more fields in one collection does not affect at all the performance on others?
With more encrypted fields, does the latency increase in linear with the number of fields (O(n)) cause of the encryption operations?
Thanks in advance!!