)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"1411ad780ebdfff5b849e4255812db70cb415547","unresolved":false,"context_lines":[{"line_number":8,"context_line":""},{"line_number":9,"context_line":"The pycrypto library is unmaintained, and keystonemiddleware currently"},{"line_number":10,"context_line":"uses pycrypto to encrypt and decrpyt things before caching them."},{"line_number":11,"context_line":"This patch set removes the pycrypto dependency and update the code"},{"line_number":12,"context_line":"to use the cryptography library."},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Change-Id: Iced7f5115e49ccf4f7f5bf6813cb5988b95c248b"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"dfeb2761_ca1a3716","line":11,"updated":"2017-03-30 20:18:54.000000000","message":"updates*","commit_id":"cee86858a12dda647045dd8d79d410c61e3be13d"},{"author":{"_account_id":20466,"name":"Tin Lam","email":"tin@lam.wtf","username":"tinlam"},"change_message_id":"2389149fa62850d40eebbe30bb716843a4afb4e7","unresolved":false,"context_lines":[{"line_number":8,"context_line":""},{"line_number":9,"context_line":"The pycrypto library is unmaintained, and keystonemiddleware currently"},{"line_number":10,"context_line":"uses pycrypto to encrypt and decrpyt things before caching them."},{"line_number":11,"context_line":"This patch set removes the pycrypto dependency and update the code"},{"line_number":12,"context_line":"to use the cryptography library."},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Change-Id: Iced7f5115e49ccf4f7f5bf6813cb5988b95c248b"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"dfeb2761_526c9435","line":11,"in_reply_to":"dfeb2761_ca1a3716","updated":"2017-03-31 03:44:53.000000000","message":"Done","commit_id":"cee86858a12dda647045dd8d79d410c61e3be13d"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"2c0bf630b64ddd551033aac44308ee488fa1e701","unresolved":false,"context_lines":[{"line_number":10,"context_line":"uses pycrypto to encrypt and decrpyt things before caching them."},{"line_number":11,"context_line":"This patch set removes the pycrypto dependency and updates the code"},{"line_number":12,"context_line":"to use the cryptography library.  See [1].  Replacing the cryptographic"},{"line_number":13,"context_line":"library does not change the underlying library, and the replacement"},{"line_number":14,"context_line":"is backward compatible.  See [2]."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"[1] http://lists.openstack.org/pipermail/openstack-dev/2017-March/113568.html"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":6,"id":"9ff52f3f_fd2db046","line":13,"updated":"2017-04-13 14:44:16.000000000","message":"I\u0027m not sure what this means.","commit_id":"e6da2a944f3b69e8012d115a5c3dffef3345db3f"}],"keystonemiddleware/auth_token/_memcache_crypt.py":[{"author":{"_account_id":20466,"name":"Tin Lam","email":"tin@lam.wtf","username":"tinlam"},"change_message_id":"e3e82f3a2e9468febc48a13da84324d4bff60b6c","unresolved":false,"context_lines":[{"line_number":62,"context_line":"    pass"},{"line_number":63,"context_line":""},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"def assert_crypto_availability(f):"},{"line_number":66,"context_line":"    @functools.wraps(f)"},{"line_number":67,"context_line":"    def wrapper(*args, **kwds):"},{"line_number":68,"context_line":"        return f(*args, **kwds)"},{"line_number":69,"context_line":"    return wrapper"},{"line_number":70,"context_line":""},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"def derive_keys(token, secret, strategy):"}],"source_content_type":"text/x-python","patch_set":1,"id":"dfeb2761_f0096e31","line":69,"range":{"start_line":65,"start_character":0,"end_line":69,"end_character":18},"updated":"2017-03-30 19:59:54.000000000","message":"Will remove in the next patchset.","commit_id":"cee86858a12dda647045dd8d79d410c61e3be13d"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"4c0ada668da5eff1302a861ad0c209a6a58142b5","unresolved":false,"context_lines":[{"line_number":16,"context_line":"\"\"\""},{"line_number":17,"context_line":"Utilities for memcache encryption and integrity check."},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"Data should be serialized before entering these functions. Encryption"},{"line_number":20,"context_line":"has a dependency on the pycrypto. If pycrypto is not available,"},{"line_number":21,"context_line":"CryptoUnavailableError will be raised."},{"line_number":22,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"bff0334d_d6f6bdd7","side":"PARENT","line":19,"updated":"2017-04-10 20:54:30.000000000","message":"The first sentence of this paragraph is technically still valid, but we\u0027re just using cryptography instead of pycrypto.","commit_id":"a2e3d60644aadb4ecb3d49dadbcd5d4c1dec2176"},{"author":{"_account_id":20466,"name":"Tin Lam","email":"tin@lam.wtf","username":"tinlam"},"change_message_id":"a6942c14ff8024f076e32400ae5488cfc103a323","unresolved":false,"context_lines":[{"line_number":16,"context_line":"\"\"\""},{"line_number":17,"context_line":"Utilities for memcache encryption and integrity check."},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"Data should be serialized before entering these functions. Encryption"},{"line_number":20,"context_line":"has a dependency on the pycrypto. If pycrypto is not available,"},{"line_number":21,"context_line":"CryptoUnavailableError will be raised."},{"line_number":22,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"bff0334d_e239fbd6","side":"PARENT","line":19,"in_reply_to":"bff0334d_d6f6bdd7","updated":"2017-04-10 23:38:26.000000000","message":"I will place back part of this paragraph.","commit_id":"a2e3d60644aadb4ecb3d49dadbcd5d4c1dec2176"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"4c0ada668da5eff1302a861ad0c209a6a58142b5","unresolved":false,"context_lines":[{"line_number":30,"context_line":"import os"},{"line_number":31,"context_line":"import six"},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"from cryptography.hazmat.backends import default_backend"},{"line_number":34,"context_line":"from cryptography.hazmat.primitives.ciphers import algorithms"},{"line_number":35,"context_line":"from cryptography.hazmat.primitives.ciphers import Cipher"},{"line_number":36,"context_line":"from cryptography.hazmat.primitives.ciphers import modes"}],"source_content_type":"text/x-python","patch_set":2,"id":"bff0334d_16b8a5e2","line":33,"updated":"2017-04-10 20:54:30.000000000","message":"We typically reference the module at import time and the function by the module:\n\n  from cryptography.hazmat import backends as crypto_backends\n  ...\n  crypto_backends.default_backend()","commit_id":"1118c4f28ede6a23530d7a76f98bb50fa8653db5"},{"author":{"_account_id":20466,"name":"Tin Lam","email":"tin@lam.wtf","username":"tinlam"},"change_message_id":"a6942c14ff8024f076e32400ae5488cfc103a323","unresolved":false,"context_lines":[{"line_number":30,"context_line":"import os"},{"line_number":31,"context_line":"import six"},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"from cryptography.hazmat.backends import default_backend"},{"line_number":34,"context_line":"from cryptography.hazmat.primitives.ciphers import algorithms"},{"line_number":35,"context_line":"from cryptography.hazmat.primitives.ciphers import Cipher"},{"line_number":36,"context_line":"from cryptography.hazmat.primitives.ciphers import modes"}],"source_content_type":"text/x-python","patch_set":2,"id":"bff0334d_421f875a","line":33,"in_reply_to":"bff0334d_16b8a5e2","updated":"2017-04-10 23:38:26.000000000","message":"Done","commit_id":"1118c4f28ede6a23530d7a76f98bb50fa8653db5"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"4c0ada668da5eff1302a861ad0c209a6a58142b5","unresolved":false,"context_lines":[{"line_number":32,"context_line":""},{"line_number":33,"context_line":"from cryptography.hazmat.backends import default_backend"},{"line_number":34,"context_line":"from cryptography.hazmat.primitives.ciphers import algorithms"},{"line_number":35,"context_line":"from cryptography.hazmat.primitives.ciphers import Cipher"},{"line_number":36,"context_line":"from cryptography.hazmat.primitives.ciphers import modes"},{"line_number":37,"context_line":"from oslo_utils import secretutils"},{"line_number":38,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"bff0334d_56906d4a","line":35,"updated":"2017-04-10 20:54:30.000000000","message":"Same comment here:\n\n  from cryptography.hazmat.primitives import ciphers\n  ...\n  ciphers.Cipher()","commit_id":"1118c4f28ede6a23530d7a76f98bb50fa8653db5"},{"author":{"_account_id":20466,"name":"Tin Lam","email":"tin@lam.wtf","username":"tinlam"},"change_message_id":"a6942c14ff8024f076e32400ae5488cfc103a323","unresolved":false,"context_lines":[{"line_number":32,"context_line":""},{"line_number":33,"context_line":"from cryptography.hazmat.backends import default_backend"},{"line_number":34,"context_line":"from cryptography.hazmat.primitives.ciphers import algorithms"},{"line_number":35,"context_line":"from cryptography.hazmat.primitives.ciphers import Cipher"},{"line_number":36,"context_line":"from cryptography.hazmat.primitives.ciphers import modes"},{"line_number":37,"context_line":"from oslo_utils import secretutils"},{"line_number":38,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"bff0334d_222483ae","line":35,"in_reply_to":"bff0334d_56906d4a","updated":"2017-04-10 23:38:26.000000000","message":"Done","commit_id":"1118c4f28ede6a23530d7a76f98bb50fa8653db5"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"4c0ada668da5eff1302a861ad0c209a6a58142b5","unresolved":false,"context_lines":[{"line_number":105,"context_line":"    \"\"\"Decrypt the data with the given secret key.\"\"\""},{"line_number":106,"context_line":"    iv \u003d data[:16]"},{"line_number":107,"context_line":"    backend \u003d default_backend()"},{"line_number":108,"context_line":"    cipher \u003d Cipher(algorithms.AES(key), modes.CBC(iv),"},{"line_number":109,"context_line":"                    backend\u003dbackend)"},{"line_number":110,"context_line":"    try:"},{"line_number":111,"context_line":"        decryptor \u003d cipher.decryptor()"}],"source_content_type":"text/x-python","patch_set":2,"id":"bff0334d_f6a3019d","line":108,"updated":"2017-04-10 20:54:30.000000000","message":"Is this backwards compatible with data that\u0027s already encrypted in memcache?","commit_id":"1118c4f28ede6a23530d7a76f98bb50fa8653db5"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"2c0bf630b64ddd551033aac44308ee488fa1e701","unresolved":false,"context_lines":[{"line_number":39,"context_line":""},{"line_number":40,"context_line":"from keystonemiddleware.i18n import _"},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"# make sure pycrypto is available"},{"line_number":43,"context_line":"try:"},{"line_number":44,"context_line":"    from Crypto.Cipher import AES"},{"line_number":45,"context_line":"except ImportError:"}],"source_content_type":"text/x-python","patch_set":6,"id":"9ff52f3f_3de438ac","side":"PARENT","line":42,"updated":"2017-04-13 14:44:16.000000000","message":"This pattern and the decorator below allows the module to be imported even if pycrypto isn\u0027t installed. Are you making cryptography a hard requirement now? To test this you can just \u0027import keystonemiddleware.auth_token\u0027 using a python venv that doesn\u0027t have cryptography installed.","commit_id":"9b14d80fe0519999cd801470573edfaf6991d6cd"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"1fc93d5c03858363cb0f1e8e93db481452aae9c1","unresolved":false,"context_lines":[{"line_number":39,"context_line":""},{"line_number":40,"context_line":"from keystonemiddleware.i18n import _"},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"# make sure pycrypto is available"},{"line_number":43,"context_line":"try:"},{"line_number":44,"context_line":"    from Crypto.Cipher import AES"},{"line_number":45,"context_line":"except ImportError:"}],"source_content_type":"text/x-python","patch_set":6,"id":"9ff52f3f_1f63a4de","side":"PARENT","line":42,"in_reply_to":"9ff52f3f_3de438ac","updated":"2017-04-13 16:40:32.000000000","message":"Previously it\u0027d not error on import time, but on runtime, as per the assert_crypto_availability wrapper below (L76).\n\nI agree with David that it\u0027s a good idea to keep the same behavior here.","commit_id":"9b14d80fe0519999cd801470573edfaf6991d6cd"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"fcd40d0a139509967dc849c4977a38afcb0ab1df","unresolved":false,"context_lines":[{"line_number":103,"context_line":"    padder \u003d padding.PKCS7(256).padder()"},{"line_number":104,"context_line":"    padded_data \u003d padder.update(data) + padder.finalize()"},{"line_number":105,"context_line":"    encryptor \u003d cipher.encryptor()"},{"line_number":106,"context_line":"    return iv + encryptor.update(padded_data) + encryptor.finalize()"},{"line_number":107,"context_line":""},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"def decrypt_data(key, data):"}],"source_content_type":"text/x-python","patch_set":6,"id":"9ff52f3f_9a390a43","line":106,"updated":"2017-04-13 14:20:07.000000000","message":"I tested this bit locally and it works for me. I ported the test script to a gist to share my results.\n\nhttps://gist.github.com/lbragstad/0c5c831d11684f8c7def7a6c553e1c40","commit_id":"e6da2a944f3b69e8012d115a5c3dffef3345db3f"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"9e33a1405fa546686de54611c8e6006e8dc0bbb3","unresolved":false,"context_lines":[{"line_number":18,"context_line":""},{"line_number":19,"context_line":"Data should be serialized before entering these functions. Encryption"},{"line_number":20,"context_line":"has a dependency on the pycrypto. If pycrypto is not available,"},{"line_number":21,"context_line":"CryptoUnavailableError will be raised."},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"This module will not be called unless signing or encryption is enabled"},{"line_number":24,"context_line":"in the config. It will always validate signatures, and will decrypt"}],"source_content_type":"text/x-python","patch_set":7,"id":"7ffa3b31_4574c035","side":"PARENT","line":21,"updated":"2017-04-15 18:10:22.000000000","message":"I think this comment can be added back","commit_id":"9b14d80fe0519999cd801470573edfaf6991d6cd"},{"author":{"_account_id":20466,"name":"Tin Lam","email":"tin@lam.wtf","username":"tinlam"},"change_message_id":"423c31e85139628edb093b77af45aaee1d2875f6","unresolved":false,"context_lines":[{"line_number":18,"context_line":""},{"line_number":19,"context_line":"Data should be serialized before entering these functions. Encryption"},{"line_number":20,"context_line":"has a dependency on the pycrypto. If pycrypto is not available,"},{"line_number":21,"context_line":"CryptoUnavailableError will be raised."},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"This module will not be called unless signing or encryption is enabled"},{"line_number":24,"context_line":"in the config. It will always validate signatures, and will decrypt"}],"source_content_type":"text/x-python","patch_set":7,"id":"7ffa3b31_45fa8042","side":"PARENT","line":21,"in_reply_to":"7ffa3b31_4574c035","updated":"2017-04-15 18:17:19.000000000","message":"Done","commit_id":"9b14d80fe0519999cd801470573edfaf6991d6cd"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"9f0a2840cd52025dac1156cda56beca266a968e7","unresolved":false,"context_lines":[{"line_number":18,"context_line":""},{"line_number":19,"context_line":"Data should be serialized before entering these functions. Encryption"},{"line_number":20,"context_line":"has a dependency on the cryptography module. If cryptography is not"},{"line_number":21,"context_line":"available, CryptoUnavailableError will be raised."},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"This module will not be called unless signing or encryption is enabled"},{"line_number":24,"context_line":"in the config. It will always validate signatures, and will decrypt"}],"source_content_type":"text/x-python","patch_set":9,"id":"7ffa3b31_caae892d","line":21,"updated":"2017-04-17 14:05:12.000000000","message":"(nit) ... on runtime.","commit_id":"438abc183b7994b32b976105a5c2ef5e77dfcfb2"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"9f0a2840cd52025dac1156cda56beca266a968e7","unresolved":false,"context_lines":[{"line_number":70,"context_line":""},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"class CryptoUnavailableError(Exception):"},{"line_number":73,"context_line":"    \"\"\"raise when Python Crypto module is not available.\"\"\""},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"    pass"},{"line_number":76,"context_line":""}],"source_content_type":"text/x-python","patch_set":9,"id":"7ffa3b31_eab14591","line":73,"range":{"start_line":73,"start_character":7,"end_line":73,"end_character":8},"updated":"2017-04-17 14:05:12.000000000","message":"(nit) Raise","commit_id":"438abc183b7994b32b976105a5c2ef5e77dfcfb2"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"cce050e6127f2299769f42dbaac37f5a53e92af3","unresolved":false,"context_lines":[{"line_number":70,"context_line":""},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"class CryptoUnavailableError(Exception):"},{"line_number":73,"context_line":"    \"\"\"raise when Python Crypto module is not available.\"\"\""},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"    pass"},{"line_number":76,"context_line":""}],"source_content_type":"text/x-python","patch_set":9,"id":"5ff73747_8aa1ae98","line":73,"in_reply_to":"7ffa3b31_eab14591","updated":"2017-05-03 12:39:24.000000000","message":"I agree but at the same time its a consistent convention throughout the module and I\u0027d be in favor of updating all doc-strings at the same time.","commit_id":"438abc183b7994b32b976105a5c2ef5e77dfcfb2"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"cba54782af4eaca4d3a83beb84132ad112b729a9","unresolved":false,"context_lines":[{"line_number":122,"context_line":"        algorithms.AES(key),"},{"line_number":123,"context_line":"        modes.CBC(iv),"},{"line_number":124,"context_line":"        backend\u003dcrypto_backends.default_backend())"},{"line_number":125,"context_line":"    padder \u003d padding.PKCS7(256).padder()"},{"line_number":126,"context_line":"    padded_data \u003d padder.update(data) + padder.finalize()"},{"line_number":127,"context_line":"    encryptor \u003d cipher.encryptor()"},{"line_number":128,"context_line":"    return iv + encryptor.update(padded_data) + encryptor.finalize()"}],"source_content_type":"text/x-python","patch_set":10,"id":"ff0f0b1f_53c8f753","line":125,"range":{"start_line":125,"start_character":27,"end_line":125,"end_character":30},"updated":"2017-05-18 12:35:05.000000000","message":"where does 256 come from? In the old code I see padding \u003d 16 - len(data) % 16\n\nand then we do six.int2byte(padding) * padding, which might not result in 256 ?\n\nAm I missing something? Could you add a comment to explain this better as it is not obvious?","commit_id":"1c5f44766856969be34bea6c1c30e8f6f92016f4"},{"author":{"_account_id":20466,"name":"Tin Lam","email":"tin@lam.wtf","username":"tinlam"},"change_message_id":"f6ae39d3a593a981c0bdc1204d10ba8bf74ce721","unresolved":false,"context_lines":[{"line_number":122,"context_line":"        algorithms.AES(key),"},{"line_number":123,"context_line":"        modes.CBC(iv),"},{"line_number":124,"context_line":"        backend\u003dcrypto_backends.default_backend())"},{"line_number":125,"context_line":"    padder \u003d padding.PKCS7(256).padder()"},{"line_number":126,"context_line":"    padded_data \u003d padder.update(data) + padder.finalize()"},{"line_number":127,"context_line":"    encryptor \u003d cipher.encryptor()"},{"line_number":128,"context_line":"    return iv + encryptor.update(padded_data) + encryptor.finalize()"}],"source_content_type":"text/x-python","patch_set":10,"id":"ff0f0b1f_e4da9ce7","line":125,"range":{"start_line":125,"start_character":27,"end_line":125,"end_character":30},"in_reply_to":"ff0f0b1f_53c8f753","updated":"2017-05-18 15:29:27.000000000","message":"The algorithm before pads it manually by calculating the padding.  Cryptography\u0027s padding call takes in the block size as a parameter [0] and ensure the text is padded to a size \u003d\u003d multiple of the block size.  The algorithm of AES256 uses a block size of 256.  I will add a comment in the next patch set.\n\n[0] https://cryptography.io/en/latest/hazmat/primitives/padding/","commit_id":"1c5f44766856969be34bea6c1c30e8f6f92016f4"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"08fe9fe526c7f875f1741e579408a9f1a7a2e6f9","unresolved":false,"context_lines":[{"line_number":126,"context_line":"    # Per cryptography.hazmat.primitives.padding documentation, the padding"},{"line_number":127,"context_line":"    # takes in block_size as a parameter to ensure it is padded to a multiple"},{"line_number":128,"context_line":"    # of the block_size.  The original AES256 algorithm uses a block"},{"line_number":129,"context_line":"    # size of 256."},{"line_number":130,"context_line":"    padder \u003d padding.PKCS7(256).padder()"},{"line_number":131,"context_line":"    padded_data \u003d padder.update(data) + padder.finalize()"},{"line_number":132,"context_line":"    encryptor \u003d cipher.encryptor()"}],"source_content_type":"text/x-python","patch_set":11,"id":"ff0f0b1f_ed2c7103","line":129,"updated":"2017-05-22 11:44:34.000000000","message":"So it looks like the block size was 16 before and it is now 256? My only concern is that we don\u0027t really have an automated way to test these changes of libs so that if it is broken we will only discover in a real deployment, and it is going to be critical","commit_id":"47d68292f4cd20c69c6368f2e6ffec89af396d65"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"78971f41661d9d9672c3788be1640694198ec5b6","unresolved":false,"context_lines":[{"line_number":126,"context_line":"    # Per cryptography.hazmat.primitives.padding documentation, the padding"},{"line_number":127,"context_line":"    # takes in block_size as a parameter to ensure it is padded to a multiple"},{"line_number":128,"context_line":"    # of the block_size.  The original AES256 algorithm uses a block"},{"line_number":129,"context_line":"    # size of 256."},{"line_number":130,"context_line":"    padder \u003d padding.PKCS7(256).padder()"},{"line_number":131,"context_line":"    padded_data \u003d padder.update(data) + padder.finalize()"},{"line_number":132,"context_line":"    encryptor \u003d cipher.encryptor()"}],"source_content_type":"text/x-python","patch_set":11,"id":"ff0f0b1f_5323febd","line":129,"in_reply_to":"ff0f0b1f_adce792a","updated":"2017-05-22 12:53:08.000000000","message":"Just to document: As we talked on IRC, the pycrypto default block size was 16 bytes not 32, so converting it to bits should result in 128.\n\nIn addition, converting the backwards compatibility testing to Python3 makes it fail for me, see http://paste.openstack.org/show/610168/\n\nAnyone tested this on a Python3 env?","commit_id":"47d68292f4cd20c69c6368f2e6ffec89af396d65"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"351ea066697702292de3f94062c3d882483c0299","unresolved":false,"context_lines":[{"line_number":126,"context_line":"    # Per cryptography.hazmat.primitives.padding documentation, the padding"},{"line_number":127,"context_line":"    # takes in block_size as a parameter to ensure it is padded to a multiple"},{"line_number":128,"context_line":"    # of the block_size.  The original AES256 algorithm uses a block"},{"line_number":129,"context_line":"    # size of 256."},{"line_number":130,"context_line":"    padder \u003d padding.PKCS7(256).padder()"},{"line_number":131,"context_line":"    padded_data \u003d padder.update(data) + padder.finalize()"},{"line_number":132,"context_line":"    encryptor \u003d cipher.encryptor()"}],"source_content_type":"text/x-python","patch_set":11,"id":"ff0f0b1f_adce792a","line":129,"in_reply_to":"ff0f0b1f_ed2c7103","updated":"2017-05-22 11:49:52.000000000","message":"It\u0027s not changing, the block size parameter for the cryptography padding module is in bits, while previously we were calculating it manually in bytes","commit_id":"47d68292f4cd20c69c6368f2e6ffec89af396d65"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"1d6883a4b32242b41af6183ea0bea39c90d461c2","unresolved":false,"context_lines":[{"line_number":124,"context_line":"        backend\u003dcrypto_backends.default_backend())"},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"    # Since the original and the new code use AES, we will"},{"line_number":127,"context_line":"    # use the default variable defined in the ``cryptography`` module."},{"line_number":128,"context_line":"    padder \u003d padding.PKCS7(algorithms.AES.block_size).padder()"},{"line_number":129,"context_line":"    padded_data \u003d padder.update(data) + padder.finalize()"},{"line_number":130,"context_line":"    encryptor \u003d cipher.encryptor()"}],"source_content_type":"text/x-python","patch_set":12,"id":"ff0f0b1f_20a383b4","line":127,"updated":"2017-05-22 17:21:34.000000000","message":"this comment won\u0027t make sense after this merges and people do not know what the old code looked like anymore","commit_id":"851ba1da7227c923d5570c4f126bf9da51e21e7f"},{"author":{"_account_id":20466,"name":"Tin Lam","email":"tin@lam.wtf","username":"tinlam"},"change_message_id":"e0eeea40f047098ff95ea70002fc82c7e2d9794a","unresolved":false,"context_lines":[{"line_number":124,"context_line":"        backend\u003dcrypto_backends.default_backend())"},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"    # Since the original and the new code use AES, we will"},{"line_number":127,"context_line":"    # use the default variable defined in the ``cryptography`` module."},{"line_number":128,"context_line":"    padder \u003d padding.PKCS7(algorithms.AES.block_size).padder()"},{"line_number":129,"context_line":"    padded_data \u003d padder.update(data) + padder.finalize()"},{"line_number":130,"context_line":"    encryptor \u003d cipher.encryptor()"}],"source_content_type":"text/x-python","patch_set":12,"id":"ff0f0b1f_a72682cd","line":127,"in_reply_to":"ff0f0b1f_20a383b4","updated":"2017-05-22 22:06:37.000000000","message":"Done","commit_id":"851ba1da7227c923d5570c4f126bf9da51e21e7f"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"1d6883a4b32242b41af6183ea0bea39c90d461c2","unresolved":false,"context_lines":[{"line_number":125,"context_line":""},{"line_number":126,"context_line":"    # Since the original and the new code use AES, we will"},{"line_number":127,"context_line":"    # use the default variable defined in the ``cryptography`` module."},{"line_number":128,"context_line":"    padder \u003d padding.PKCS7(algorithms.AES.block_size).padder()"},{"line_number":129,"context_line":"    padded_data \u003d padder.update(data) + padder.finalize()"},{"line_number":130,"context_line":"    encryptor \u003d cipher.encryptor()"},{"line_number":131,"context_line":"    return iv + encryptor.update(padded_data) + encryptor.finalize()"}],"source_content_type":"text/x-python","patch_set":12,"id":"ff0f0b1f_208ca334","line":128,"range":{"start_line":128,"start_character":27,"end_line":128,"end_character":52},"updated":"2017-05-22 17:21:34.000000000","message":"did the old code used this as well ? with the value of 16 (bytes I assume) ?","commit_id":"851ba1da7227c923d5570c4f126bf9da51e21e7f"},{"author":{"_account_id":20466,"name":"Tin Lam","email":"tin@lam.wtf","username":"tinlam"},"change_message_id":"e0eeea40f047098ff95ea70002fc82c7e2d9794a","unresolved":false,"context_lines":[{"line_number":125,"context_line":""},{"line_number":126,"context_line":"    # Since the original and the new code use AES, we will"},{"line_number":127,"context_line":"    # use the default variable defined in the ``cryptography`` module."},{"line_number":128,"context_line":"    padder \u003d padding.PKCS7(algorithms.AES.block_size).padder()"},{"line_number":129,"context_line":"    padded_data \u003d padder.update(data) + padder.finalize()"},{"line_number":130,"context_line":"    encryptor \u003d cipher.encryptor()"},{"line_number":131,"context_line":"    return iv + encryptor.update(padded_data) + encryptor.finalize()"}],"source_content_type":"text/x-python","patch_set":12,"id":"ff0f0b1f_3230729f","line":128,"range":{"start_line":128,"start_character":27,"end_line":128,"end_character":52},"in_reply_to":"ff0f0b1f_208ca334","updated":"2017-05-22 22:06:37.000000000","message":"Previously this was padded to 16 bytes using:\n\n   six.int2byte(padding) * padding\n\nWith cryptography, we need to pass the bit value as bit to the padding.PKCS7(bits) using [1], or 128 bits.  \n\n[1] https://cryptography.io/en/latest/hazmat/primitives/padding/#cryptography.hazmat.primitives.padding.PKCS7","commit_id":"851ba1da7227c923d5570c4f126bf9da51e21e7f"}],"releasenotes/notes/bug-1677308-a2fa7de67f21cd84.yaml":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"4c0ada668da5eff1302a861ad0c209a6a58142b5","unresolved":false,"context_lines":[{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    [`bug 1677308 \u003chttps://bugs.launchpad.net/keystonemiddleware/+bug/1677308\u003e`_]"},{"line_number":5,"context_line":"    Removes pycrypto dependency as the library is unmaintained, and replaces it"},{"line_number":6,"context_line":"    with the cryptography library."}],"source_content_type":"text/x-yaml","patch_set":2,"id":"bff0334d_f628a1e2","line":6,"updated":"2017-04-10 20:54:30.000000000","message":"From an upgrade perspective, is this going to affect anything for operators? If the data in the cache was encrypted with pycrypto, it will long longer be decipherable with the new library will it?","commit_id":"1118c4f28ede6a23530d7a76f98bb50fa8653db5"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"0f7550b3056637027e4411acf0cb5311a0132f67","unresolved":false,"context_lines":[{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    [`bug 1677308 \u003chttps://bugs.launchpad.net/keystonemiddleware/+bug/1677308\u003e`_]"},{"line_number":5,"context_line":"    Removes pycrypto dependency as the library is unmaintained, and replaces it"},{"line_number":6,"context_line":"    with the cryptography library."}],"source_content_type":"text/x-yaml","patch_set":3,"id":"bff0334d_b6be52ab","line":6,"updated":"2017-04-12 14:41:04.000000000","message":"What is the impact of changing the libraries on current deployments upon upgrade? Even if there is no impact, this should be stated in the RN, so that operators won\u0027t worry about it.","commit_id":"07a032e3704fd5200ed3de8a2d367a103b3d394d"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"1ef9d40478a960fe564c528c63190d13347ee21b","unresolved":false,"context_lines":[{"line_number":9,"context_line":"    [`bug 1677308 \u003chttps://bugs.launchpad.net/keystonemiddleware/+bug/1677308\u003e`_]"},{"line_number":10,"context_line":"    Replacing the cryptographic library does not change the underlying"},{"line_number":11,"context_line":"    encryption and decryption algorithm.  Previously encyrpted items in the"},{"line_number":12,"context_line":"    cache can be decrypted using the new library.  There is no upgrade impact."}],"source_content_type":"text/x-yaml","patch_set":4,"id":"bff0334d_ebd74fbe","line":12,"updated":"2017-04-12 18:02:47.000000000","message":"We should elaborate on why there is no upgrade impact, especially since the previous sentence mentions data is getting destroyed. As an operator, I want to understand why there isn\u0027t going to be an upgrade impact. Is it because the services get bounced which drops the cache?","commit_id":"9a8e71436238841c2784ce586f155314f1e1f078"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"2c0bf630b64ddd551033aac44308ee488fa1e701","unresolved":false,"context_lines":[{"line_number":10,"context_line":"    There is no upgrade impact from replacing the cryptographic library from"},{"line_number":11,"context_line":"    ``pycrypto`` to ``cryptography`` since all data will be encrypted and"},{"line_number":12,"context_line":"    decrypted using identical blocksize, padding, algorithm (AES) and mode"},{"line_number":13,"context_line":"    (CBC).Data previously encrypted using ``pycrypto`` can be decrypted using"},{"line_number":14,"context_line":"    both ``pycrypto`` and ``cryptography``.  Same holds for data encrypted"},{"line_number":15,"context_line":"    using ``cryptography``."}],"source_content_type":"text/x-yaml","patch_set":6,"id":"9ff52f3f_fd9490ea","line":13,"updated":"2017-04-13 14:44:16.000000000","message":"needs a space before Data.","commit_id":"e6da2a944f3b69e8012d115a5c3dffef3345db3f"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"1fc93d5c03858363cb0f1e8e93db481452aae9c1","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":6,"id":"9ff52f3f_5fdc8c73","line":16,"updated":"2017-04-13 16:40:32.000000000","message":"Thanks for adding this upgrade section!","commit_id":"e6da2a944f3b69e8012d115a5c3dffef3345db3f"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"8e59e1230f050e0d6bbd9892f21ae5a6dde69d28","unresolved":false,"context_lines":[{"line_number":7,"context_line":"upgrade:"},{"line_number":8,"context_line":"  - |"},{"line_number":9,"context_line":"    [`bug 1677308 \u003chttps://bugs.launchpad.net/keystonemiddleware/+bug/1677308\u003e`_]"},{"line_number":10,"context_line":"    There is no upgrade impact from replacing the cryptographic library from"},{"line_number":11,"context_line":"    ``pycrypto`` to ``cryptography`` since all data will be encrypted and"},{"line_number":12,"context_line":"    decrypted using identical blocksize, padding, algorithm (AES) and mode"},{"line_number":13,"context_line":"    (CBC). Data previously encrypted using ``pycrypto`` can be decrypted using"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"7ffa3b31_c9134666","line":10,"updated":"2017-04-17 00:55:35.000000000","message":"nit: There is no upgrade impact when switching from ``pycrypto`` to ``cryptography``.","commit_id":"7b0b8a9f46f231b145009467d4cf92e3e79ed316"},{"author":{"_account_id":20466,"name":"Tin Lam","email":"tin@lam.wtf","username":"tinlam"},"change_message_id":"bfa630d9bd2171cbb049046187a24e74324aff2c","unresolved":false,"context_lines":[{"line_number":7,"context_line":"upgrade:"},{"line_number":8,"context_line":"  - |"},{"line_number":9,"context_line":"    [`bug 1677308 \u003chttps://bugs.launchpad.net/keystonemiddleware/+bug/1677308\u003e`_]"},{"line_number":10,"context_line":"    There is no upgrade impact from replacing the cryptographic library from"},{"line_number":11,"context_line":"    ``pycrypto`` to ``cryptography`` since all data will be encrypted and"},{"line_number":12,"context_line":"    decrypted using identical blocksize, padding, algorithm (AES) and mode"},{"line_number":13,"context_line":"    (CBC). Data previously encrypted using ``pycrypto`` can be decrypted using"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"7ffa3b31_828873c6","line":10,"in_reply_to":"7ffa3b31_c9134666","updated":"2017-04-17 04:14:54.000000000","message":"Done","commit_id":"7b0b8a9f46f231b145009467d4cf92e3e79ed316"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"8e59e1230f050e0d6bbd9892f21ae5a6dde69d28","unresolved":false,"context_lines":[{"line_number":11,"context_line":"    ``pycrypto`` to ``cryptography`` since all data will be encrypted and"},{"line_number":12,"context_line":"    decrypted using identical blocksize, padding, algorithm (AES) and mode"},{"line_number":13,"context_line":"    (CBC). Data previously encrypted using ``pycrypto`` can be decrypted using"},{"line_number":14,"context_line":"    both ``pycrypto`` and ``cryptography``.  Same holds for data encrypted"},{"line_number":15,"context_line":"    using ``cryptography``."}],"source_content_type":"text/x-yaml","patch_set":8,"id":"7ffa3b31_091a4e7c","line":14,"updated":"2017-04-17 00:55:35.000000000","message":"nit: s/Same holds for/The same is true of/","commit_id":"7b0b8a9f46f231b145009467d4cf92e3e79ed316"},{"author":{"_account_id":20466,"name":"Tin Lam","email":"tin@lam.wtf","username":"tinlam"},"change_message_id":"bfa630d9bd2171cbb049046187a24e74324aff2c","unresolved":false,"context_lines":[{"line_number":11,"context_line":"    ``pycrypto`` to ``cryptography`` since all data will be encrypted and"},{"line_number":12,"context_line":"    decrypted using identical blocksize, padding, algorithm (AES) and mode"},{"line_number":13,"context_line":"    (CBC). Data previously encrypted using ``pycrypto`` can be decrypted using"},{"line_number":14,"context_line":"    both ``pycrypto`` and ``cryptography``.  Same holds for data encrypted"},{"line_number":15,"context_line":"    using ``cryptography``."}],"source_content_type":"text/x-yaml","patch_set":8,"id":"7ffa3b31_a2a36f4f","line":14,"in_reply_to":"7ffa3b31_091a4e7c","updated":"2017-04-17 04:14:54.000000000","message":"Done","commit_id":"7b0b8a9f46f231b145009467d4cf92e3e79ed316"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"cce050e6127f2299769f42dbaac37f5a53e92af3","unresolved":false,"context_lines":[{"line_number":12,"context_line":"    blocksize, padding, algorithm (AES) and mode (CBC). Data previously"},{"line_number":13,"context_line":"    encrypted using ``pycrypto`` can be decrypted using both ``pycrypto`` and"},{"line_number":14,"context_line":"    ``cryptography``.  The same is true of data encrypted using"},{"line_number":15,"context_line":"    ``cryptography``."}],"source_content_type":"text/x-yaml","patch_set":9,"id":"5ff73747_ca333662","line":15,"updated":"2017-05-03 12:39:24.000000000","message":"Nice work on the release note!","commit_id":"438abc183b7994b32b976105a5c2ef5e77dfcfb2"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"cba54782af4eaca4d3a83beb84132ad112b729a9","unresolved":false,"context_lines":[{"line_number":12,"context_line":"    blocksize, padding, algorithm (AES) and mode (CBC). Data previously"},{"line_number":13,"context_line":"    encrypted using ``pycrypto`` can be decrypted using both ``pycrypto`` and"},{"line_number":14,"context_line":"    ``cryptography``.  The same is true of data encrypted using"},{"line_number":15,"context_line":"    ``cryptography``."}],"source_content_type":"text/x-yaml","patch_set":10,"id":"ff0f0b1f_9388cf1f","line":15,"updated":"2017-05-18 12:35:05.000000000","message":"nice, very good explanation","commit_id":"1c5f44766856969be34bea6c1c30e8f6f92016f4"}]}