--- title: "Encryption" description: "6 posts about Encryption, summarised, each linking to the original." --- # Encryption > 6 posts about Encryption, summarised, each linking to the original. ## Articles ### [How to Encrypt LangGraph Checkpoints With MongoDB CSFLE](https://yomu.fyi/post/how-to-encrypt-langgraph-checkpoints-with-mongodb-csfle.md) - Company: [MongoDB](https://yomu.fyi/company/mongodb.md) - Published: Oct 14, 2026 - Type: Tutorial LangGraph checkpoints persist agent state, including user messages and tool results, as plaintext BSON in MongoDB by default, leaving sensitive data accessible to anyone who can read the database. MongoDB Client-Side Field Level Encryption (CSFLE) encrypts data on the client before transmission, ensuring the database engine never sees plaintext values and protecting against privileged database users or data breaches. This post demonstrates implementing a custom CipherProtocol for LangGraph’s EncryptedSerializer that uses explicit CSFLE with randomized encryption, configured with AWS KMS and a data encryption key stored in a key vault collection for envelope encryption. The encrypted payload replaces the default Base64 encoding, while only thread IDs, checkpoint IDs, and namespaces remain unencrypted to support runtime lookups without exposing sensitive content. This approach aligns with enterprise security and compliance requirements for customer-facing AI agents, preserving resumable sessions and human-in-the-loop workflows while preventing database administrators or attackers from reading the state. ### [MongoDB Queryable Encryption: Prefix, Suffix, and Substring Queries Are Now GA](https://yomu.fyi/post/mongodb-queryable-encryption-prefix-suffix-and-substring-queries-are-n.md) - Company: [MongoDB](https://yomu.fyi/company/mongodb.md) - Published: Oct 5, 2026 - Type: Announcement MongoDB announced general availability of prefix, suffix, and substring query support in Queryable Encryption, extending beyond equality and range queries to production workloads at no additional cost in Atlas, Enterprise Advanced, and Community Edition. These capabilities enable expressive text searches on encrypted data without decryption, with the database server never seeing plaintext during query processing. The open-source encryption scheme is independently verifiable, works without specialized hardware, and protects data at rest, in transit, and in use. The new query types enable partial-name lookups, autocomplete, and partial-word filtering on encrypted fields via the native query engine, requiring no external indexes or middleware. This helps meet HIPAA, PCI-DSS, and GDPR compliance by protecting data in use — a stage other encryption methods cannot cover — reducing audit gaps and eliminating workarounds. ### [MongoDB 9.0: This Is What a Database Should Be](https://yomu.fyi/post/mongodb-9-0-this-is-what-a-database-should-be.md) - Company: [MongoDB](https://yomu.fyi/company/mongodb.md) - Published: Oct 5, 2026 - Type: Announcement MongoDB 9.0 is the most advanced release in MongoDB’s history, designed to eliminate the tradeoffs that force organizations to add infrastructure, compromise security, or rethink architecture as applications grow. Transactional workloads achieve up to 20% higher throughput compared to 8.0, with find-one queries up to 35% faster and update-one queries up to 30% faster, and large deployments see nearly 2x higher throughput. Queryable Encryption now supports prefix, suffix, and substring queries, enabling partial-match searches on encrypted data throughout its lifecycle. Intelligent Workload Management queues transient traffic spikes during overload to keep clusters responsive, buying time for auto-scaling or operator intervention. The release also includes redesigned Atlas Metrics UI, enhanced OpenTelemetry integration for streaming metrics to platforms like Datadog and Prometheus, and a MongoDB extension for Hibernate ORM to ease modernization. ### [Is your domain using post-quantum encryption? Now you can see for yourself](https://yomu.fyi/post/is-your-domain-using-post-quantum-encryption-now-you-can-see-for-yours.md) - Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md) - Author: Sharon Goldberg - Published: Sep 29, 2026 - Type: Announcement Cloudflare introduced new post-quantum cryptography visibility tools in its Application Security and Logs products, including Logpush, Log Explorer, and the HTTP Traffic Analytics dashboard, to help customers monitor encryption adoption. These tools surface the key exchange algorithm negotiated on every incoming request, enabling customers to audit their post-quantum posture, assess compliance, and identify cryptographic gaps across their domains. The primary post-quantum algorithm in TLS 1.3 is X25519MLKEM768, a hybrid of classical ECDHE over curve X25519 and the post-quantum ML-KEM, which provides belt-and-suspenders security against harvest-now-decrypt-later attacks. Cloudflare Radar data shows about 70% of browser-generated traffic uses post-quantum encryption on the visitor-to-Cloudflare connection, but only 15% of origin connections to Cloudflare use hybrid ML-KEM. For legacy origin servers that cannot support modern post-quantum cryptography, Cloudflare Tunnel can tunnel traffic over TLS 1.3 with X25519MLKEM768 without requiring any upgrade to the origin server itself. ### [Self-encrypting VM images for confidential environments hands on](https://yomu.fyi/post/self-encrypting-vm-images-for-confidential-environments-hands-on.md) - Company: [Red Hat](https://yomu.fyi/company/red-hat.md) - Author: Vitaly Kuznetsov - Published: Sep 24, 2026 - Type: Tutorial Confidential VM technologies such as AMD SEV-SNP and Intel TDX protect runtime data but leave persistent storage protection to the guest OS. This article demonstrates a method using Fedora Rawhide that combines dm-verity integrity for the immutable base image with a dm-crypt encrypted overlay for mutable parts. The base /usr partition remains verity-protected, while on first boot systemd-repart creates an encrypted root partition with a key sealed to the virtual TPM, ensuring each VM gets a unique key. An overlay filesystem mounts the immutable base under the writable overlay, avoiding a full copy of the base image and reducing boot time significantly in cloud environments. The article also outlines current limitations, including the lack of proof of origin for the overlay partition and the absence of integrity or replay attack protection. ### [MongoDB 8.0: Raising The Bar](https://yomu.fyi/post/mongodb-8-0-raising-the-bar.md) - Company: [MongoDB](https://yomu.fyi/company/mongodb.md) - Published: Oct 2, 2024 - Type: Announcement MongoDB 8.0, the latest version of the document database, is now generally available, delivering significant performance and security improvements. The release features 36% better read throughput, 56% faster bulk writes, 20% faster concurrent writes during data replication, and 200% faster complex aggregations of time series data. MongoDB’s internal build system, which runs on MongoDB, saw query latencies drop by approximately 75% after upgrading. The company also reports that customer OCELL experienced queries running twice as fast. MongoDB 8.0 includes sharding enhancements for up to 50 times faster data distribution, quantized vectors that reduce memory usage by up to 96%, and expanded Queryable Encryption to support range queries. The release is available via MongoDB Atlas, MongoDB Enterprise Advanced, and MongoDB Community Edition.