)]}'
{"specs/bobcat/pkcs11-aes-cbc-authentication.rst":[{"author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"change_message_id":"2f40e0555cb95847b2b718068c41d3478ae39f36","unresolved":true,"context_lines":[{"line_number":38,"context_line":"by first verifying the HMAC before starting the decryption process."},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"The key used in the HMAC would be generated automatically on a per-project"},{"line_number":41,"context_line":"basis in a simliar fashion to the existing pKEK generation."},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"We will have to ensure backwards compatibility with existing deployments.  One"},{"line_number":44,"context_line":"way of achieving this would be to provide a way to rotate the project hmac keys"}],"source_content_type":"text/x-rst","patch_set":2,"id":"86ad86f3_82a732d8","line":41,"updated":"2023-05-05 11:02:08.000000000","message":"So the pHMAC will be also encrypted by the HSM?","commit_id":"85eb16a584460541934fb24ff4ef790bc3784293"},{"author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"change_message_id":"2f40e0555cb95847b2b718068c41d3478ae39f36","unresolved":true,"context_lines":[{"line_number":44,"context_line":"way of achieving this would be to provide a way to rotate the project hmac keys"},{"line_number":45,"context_line":"that can be used to calculate new HMACs for existing databases.  e.g."},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"    barbican-manage hsm rotate_project_hmac $PROJECT_ID"},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"That would generate a new pHMAC key for that project and wrap all existing"},{"line_number":50,"context_line":"secrets in that project wit the new key.  The decrypt function will check HMACs"}],"source_content_type":"text/x-rst","patch_set":2,"id":"955b075d_f4402fb7","line":47,"updated":"2023-05-05 11:02:08.000000000","message":"Could we do this as part of the current commands that run on upgrade? Or maybe provide a general post-upgrade command to run.","commit_id":"85eb16a584460541934fb24ff4ef790bc3784293"},{"author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"change_message_id":"2f40e0555cb95847b2b718068c41d3478ae39f36","unresolved":true,"context_lines":[{"line_number":94,"context_line":"---------------------"},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"When using the PKCS#11 backend with AES-CBC encryption, the plugin will be"},{"line_number":97,"context_line":"doing more work to encrypt and decrypt secrets since it will have to peform"},{"line_number":98,"context_line":"additional work to calculate or verify the hmac."},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"Performance Impact"}],"source_content_type":"text/x-rst","patch_set":2,"id":"f373a9e3_4bb4e5d8","line":97,"updated":"2023-05-05 11:02:08.000000000","message":"s/peform/perform/","commit_id":"85eb16a584460541934fb24ff4ef790bc3784293"},{"author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"change_message_id":"2f40e0555cb95847b2b718068c41d3478ae39f36","unresolved":true,"context_lines":[{"line_number":135,"context_line":"  keys for each project and HMACs and key metadata for every secret."},{"line_number":136,"context_line":"* Modify the PKCS#11 plugin backend to generate and verify HMACs during encrypt"},{"line_number":137,"context_line":"  and decrypt respectively"},{"line_number":138,"context_line":"* Implement pHMAC rotation in barbican-manage"},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"Dependencies"},{"line_number":141,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":2,"id":"e1c985b3_8fd84d32","line":138,"updated":"2023-05-05 11:02:08.000000000","message":"Will pHMAC hash algorithm be configured somewhere, what will be the default?","commit_id":"85eb16a584460541934fb24ff4ef790bc3784293"}]}