  Modern databases and data-warehousing systems separate query processing and
durable storage. Storage systems have idiosyncratic bugs and security
vulnerabilities, thus attacks that compromise only storage are a realistic
threat. In this paper, we show that encryption alone is not sufficient to
protect databases from compromised storage. Using MongoDB WiredTiger as a
concrete example, we demonstrate that sizes of encrypted writes to a durable
write-ahead log can reveal sensitive information about the inputs and
activities of MongoDB applications. We then design, implement, and evaluate
BigFoot, a WAL modification that mitigates size leakage.
