)]}'
{"specs/ocata/approved/image-verification.rst":[{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"515640dd0baa0f349e4000c50e490d9ec68f9192","unresolved":false,"context_lines":[{"line_number":36,"context_line":"* Man-in-the-Middle Attack - An adversary with access to the network between"},{"line_number":37,"context_line":"  Nova and Glance is altering image data as Nova downloads the data from"},{"line_number":38,"context_line":"  Glance. The adversary is potentially incorporating malware into the image"},{"line_number":39,"context_line":"  and/or altering the image metadata."},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"* Untrusted Glance - In a hybrid cloud deployment, Glance is hosted on"},{"line_number":42,"context_line":"  machines which are located in a physically insecure location or is hosted by"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9a629dbe_4849078e","line":39,"updated":"2016-11-14 19:29:22.000000000","message":"if they could do this, couldn\u0027t they alter the signature as well to match their changes? So I\u0027m not sure this spec really helps this case.","commit_id":"2edf8ef8f75a6fe1ea41a0a13ca9feed576027fe"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"ad8941e814b2861186045a387b9087055612a562","unresolved":false,"context_lines":[{"line_number":36,"context_line":"* Man-in-the-Middle Attack - An adversary with access to the network between"},{"line_number":37,"context_line":"  Nova and Glance is altering image data as Nova downloads the data from"},{"line_number":38,"context_line":"  Glance. The adversary is potentially incorporating malware into the image"},{"line_number":39,"context_line":"  and/or altering the image metadata."},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"* Untrusted Glance - In a hybrid cloud deployment, Glance is hosted on"},{"line_number":42,"context_line":"  machines which are located in a physically insecure location or is hosted by"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a77a97e_b002be6d","line":39,"in_reply_to":"9a629dbe_4849078e","updated":"2016-11-16 17:58:27.000000000","message":"They could do this if they have access to the private key associated with a trusted certificate.","commit_id":"2edf8ef8f75a6fe1ea41a0a13ca9feed576027fe"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"515640dd0baa0f349e4000c50e490d9ec68f9192","unresolved":false,"context_lines":[{"line_number":40,"context_line":""},{"line_number":41,"context_line":"* Untrusted Glance - In a hybrid cloud deployment, Glance is hosted on"},{"line_number":42,"context_line":"  machines which are located in a physically insecure location or is hosted by"},{"line_number":43,"context_line":"  a company with limited security infrastructure. Adversaries may be able to"},{"line_number":44,"context_line":"  compromise the integrity of Glance and/or the integrity of images stored by"},{"line_number":45,"context_line":"  Glance through physical access to the host machines or through poor network"},{"line_number":46,"context_line":"  security on the part of the company hosting Glance."},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"Please note that our threat model considers only threats to the integrity of"},{"line_number":49,"context_line":"images while they are in transit between the end user and Glance, while they"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a77a97e_395b6b56","line":46,"range":{"start_line":43,"start_character":50,"end_line":46,"end_character":52},"updated":"2016-11-14 19:29:22.000000000","message":"again, some such compromises would also allow them to change the signature, nullifying the benefit of this spec. But not necessarily all. E.g. Perhaps the attacker has access to the file on disk, but not the metadata in the db. Just be careful not to overstate what this will solve.","commit_id":"2edf8ef8f75a6fe1ea41a0a13ca9feed576027fe"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"ad8941e814b2861186045a387b9087055612a562","unresolved":false,"context_lines":[{"line_number":40,"context_line":""},{"line_number":41,"context_line":"* Untrusted Glance - In a hybrid cloud deployment, Glance is hosted on"},{"line_number":42,"context_line":"  machines which are located in a physically insecure location or is hosted by"},{"line_number":43,"context_line":"  a company with limited security infrastructure. Adversaries may be able to"},{"line_number":44,"context_line":"  compromise the integrity of Glance and/or the integrity of images stored by"},{"line_number":45,"context_line":"  Glance through physical access to the host machines or through poor network"},{"line_number":46,"context_line":"  security on the part of the company hosting Glance."},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"Please note that our threat model considers only threats to the integrity of"},{"line_number":49,"context_line":"images while they are in transit between the end user and Glance, while they"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a77a97e_90ff8266","line":46,"range":{"start_line":43,"start_character":50,"end_line":46,"end_character":52},"in_reply_to":"7a77a97e_395b6b56","updated":"2016-11-16 17:58:27.000000000","message":"If the attacker changes the signature and the image data successfully, they must have access to the private key associated with a trusted certificate.","commit_id":"2edf8ef8f75a6fe1ea41a0a13ca9feed576027fe"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"515640dd0baa0f349e4000c50e490d9ec68f9192","unresolved":false,"context_lines":[{"line_number":77,"context_line":"* img_signature_key_type - A string designating the signature scheme used to"},{"line_number":78,"context_line":"  generate the signature."},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"* img_signature_certificate_uuid - A string encoding the certificate"},{"line_number":81,"context_line":"  uuid used to retrieve the certificate from the key manager."},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"The image verification functionality in Glance uses the signature_utils"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a77a97e_d9c997ae","line":80,"range":{"start_line":80,"start_character":2,"end_line":80,"end_character":32},"updated":"2016-11-14 19:29:22.000000000","message":"this ties the implementation to Castellan or something similarly UUID-based. Could you use certificate fingerprints instead, and support locally-known certificates (E.g. a nova conf setting identifying a directory of image signing certificates) as well as Castellan?","commit_id":"2edf8ef8f75a6fe1ea41a0a13ca9feed576027fe"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"ad8941e814b2861186045a387b9087055612a562","unresolved":false,"context_lines":[{"line_number":77,"context_line":"* img_signature_key_type - A string designating the signature scheme used to"},{"line_number":78,"context_line":"  generate the signature."},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"* img_signature_certificate_uuid - A string encoding the certificate"},{"line_number":81,"context_line":"  uuid used to retrieve the certificate from the key manager."},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"The image verification functionality in Glance uses the signature_utils"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a77a97e_b09d5e5b","line":80,"range":{"start_line":80,"start_character":2,"end_line":80,"end_character":32},"in_reply_to":"7a77a97e_d9c997ae","updated":"2016-11-16 17:58:27.000000000","message":"Cinder, Nova, and Glance all already use Castellan to interface with a key manager. We have already discussed the option of a local trust store of certificates and found it lacking for a number of reasons, the simplest of which is that this approach does not scale in a cloud with multiple compute nodes.","commit_id":"2edf8ef8f75a6fe1ea41a0a13ca9feed576027fe"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"04c370771a11995f70e2c9be23cd6a55dc16af23","unresolved":false,"context_lines":[{"line_number":128,"context_line":"verification using image properties passed to Nova by Glance. If this fails,"},{"line_number":129,"context_line":"or if the image signature metadata is incomplete or missing, Nova will not"},{"line_number":130,"context_line":"boot the image. Instead, Nova will throw an exception and log an error. If the"},{"line_number":131,"context_line":"signature verification succeeds, Nova will proceed with booting the instance."},{"line_number":132,"context_line":""},{"line_number":133,"context_line":"The next component will be to add functionality to the pyca/cryptography"},{"line_number":134,"context_line":"library which will validate a given certificate chain against a pool of given"}],"source_content_type":"text/x-rst","patch_set":1,"id":"bacf61ea_a420949c","line":131,"updated":"2016-08-04 08:20:39.000000000","message":"This implies that every single image stored in glance has to be signed. As an operator, I do see use cases where this functionality could be required for some tenants and users, whereas others do not require it. Users not requiring or not willing to implement verification of images would be forced to create a signature, otherwise the images won\u0027t boot.","commit_id":"2edf8ef8f75a6fe1ea41a0a13ca9feed576027fe"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"4181fec09822e7e18258cc530f50230c059fb561","unresolved":false,"context_lines":[{"line_number":128,"context_line":"verification using image properties passed to Nova by Glance. If this fails,"},{"line_number":129,"context_line":"or if the image signature metadata is incomplete or missing, Nova will not"},{"line_number":130,"context_line":"boot the image. Instead, Nova will throw an exception and log an error. If the"},{"line_number":131,"context_line":"signature verification succeeds, Nova will proceed with booting the instance."},{"line_number":132,"context_line":""},{"line_number":133,"context_line":"The next component will be to add functionality to the pyca/cryptography"},{"line_number":134,"context_line":"library which will validate a given certificate chain against a pool of given"}],"source_content_type":"text/x-rst","patch_set":1,"id":"bacf61ea_4fb9e878","line":131,"in_reply_to":"bacf61ea_a420949c","updated":"2016-08-04 12:25:28.000000000","message":"As it is currently implemented in Nova, it is an \"all or nothing\" feature. If the config flag is enabled, every image that Nova boots has to be signed. We are working on functionality to allow the end user to specify that image signature verification be performed on a per instance basis. For more info see my \"trusted flavors\" spec:\n\nhttps://review.openstack.org/#/c/312225/","commit_id":"2edf8ef8f75a6fe1ea41a0a13ca9feed576027fe"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"515640dd0baa0f349e4000c50e490d9ec68f9192","unresolved":false,"context_lines":[{"line_number":143,"context_line":"GET requests to dynamically fetch the certificate chain for a given"},{"line_number":144,"context_line":"certificate. Any service using the signature_utils module will now call the"},{"line_number":145,"context_line":"signature_utils module\u0027s initializing method with an additional parameter: a"},{"line_number":146,"context_line":"list of references representing a pool of trusted root certificates. This"},{"line_number":147,"context_line":"module will then use its certificate chain fetching functionality to build the"},{"line_number":148,"context_line":"certificate chain for the signing certificate, fetch the root certificates"},{"line_number":149,"context_line":"through Castellan, and will verify this chain against the trusted root"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a77a97e_d98277c8","line":146,"range":{"start_line":146,"start_character":50,"end_line":146,"end_character":54},"updated":"2016-11-14 19:29:22.000000000","message":"they shouldn\u0027t have to be root certificates. If you want to trust an intermediary or even a leaf, that should be fine.","commit_id":"2edf8ef8f75a6fe1ea41a0a13ca9feed576027fe"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"ad8941e814b2861186045a387b9087055612a562","unresolved":false,"context_lines":[{"line_number":143,"context_line":"GET requests to dynamically fetch the certificate chain for a given"},{"line_number":144,"context_line":"certificate. Any service using the signature_utils module will now call the"},{"line_number":145,"context_line":"signature_utils module\u0027s initializing method with an additional parameter: a"},{"line_number":146,"context_line":"list of references representing a pool of trusted root certificates. This"},{"line_number":147,"context_line":"module will then use its certificate chain fetching functionality to build the"},{"line_number":148,"context_line":"certificate chain for the signing certificate, fetch the root certificates"},{"line_number":149,"context_line":"through Castellan, and will verify this chain against the trusted root"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a77a97e_f03b5636","line":146,"range":{"start_line":146,"start_character":50,"end_line":146,"end_character":54},"in_reply_to":"7a77a97e_d98277c8","updated":"2016-11-16 17:58:27.000000000","message":"Fair. I would encourage you to raise this point on the accompanying spec which actually addresses the certificate validation change:\n\nhttps://review.openstack.org/#/c/357151/","commit_id":"2edf8ef8f75a6fe1ea41a0a13ca9feed576027fe"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"515640dd0baa0f349e4000c50e490d9ec68f9192","unresolved":false,"context_lines":[{"line_number":155,"context_line":"option in nova.conf."},{"line_number":156,"context_line":""},{"line_number":157,"context_line":"Future API changes are necessary to mitigate attacks that are possible when"},{"line_number":158,"context_line":"Glance is untrusted; such as Glance returning a different signed image than the"},{"line_number":159,"context_line":"image that was requested. Possible changes include the following extensions:"},{"line_number":160,"context_line":""},{"line_number":161,"context_line":"* Modify the REST API to accept a specific signature required to verify the"},{"line_number":162,"context_line":"  integrity of the image. If the specified signature cannot be verified, then"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a77a97e_9c9aadc4","line":159,"range":{"start_line":158,"start_character":21,"end_line":159,"end_character":24},"updated":"2016-11-14 19:29:22.000000000","message":"this is also how you can solve the MITM issue, which I don\u0027t think is otherwise addressed here. Why say this is future work, rather than include here? I suggest you build the entire solution around this.","commit_id":"2edf8ef8f75a6fe1ea41a0a13ca9feed576027fe"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"ad8941e814b2861186045a387b9087055612a562","unresolved":false,"context_lines":[{"line_number":155,"context_line":"option in nova.conf."},{"line_number":156,"context_line":""},{"line_number":157,"context_line":"Future API changes are necessary to mitigate attacks that are possible when"},{"line_number":158,"context_line":"Glance is untrusted; such as Glance returning a different signed image than the"},{"line_number":159,"context_line":"image that was requested. Possible changes include the following extensions:"},{"line_number":160,"context_line":""},{"line_number":161,"context_line":"* Modify the REST API to accept a specific signature required to verify the"},{"line_number":162,"context_line":"  integrity of the image. If the specified signature cannot be verified, then"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a77a97e_30eeaeec","line":159,"range":{"start_line":158,"start_character":21,"end_line":159,"end_character":24},"in_reply_to":"7a77a97e_9c9aadc4","updated":"2016-11-16 17:58:27.000000000","message":"This change is complicated, and requires another spec to explain it.","commit_id":"2edf8ef8f75a6fe1ea41a0a13ca9feed576027fe"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"515640dd0baa0f349e4000c50e490d9ec68f9192","unresolved":false,"context_lines":[{"line_number":158,"context_line":"Glance is untrusted; such as Glance returning a different signed image than the"},{"line_number":159,"context_line":"image that was requested. Possible changes include the following extensions:"},{"line_number":160,"context_line":""},{"line_number":161,"context_line":"* Modify the REST API to accept a specific signature required to verify the"},{"line_number":162,"context_line":"  integrity of the image. If the specified signature cannot be verified, then"},{"line_number":163,"context_line":"  Nova refuses to boot the image and returns an appropriate error message to"},{"line_number":164,"context_line":"  the end user. This change builds upon a spec that allows overriding image"},{"line_number":165,"context_line":"  properties at boot time [4]."}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a77a97e_bf867b63","line":162,"range":{"start_line":161,"start_character":25,"end_line":162,"end_character":24},"updated":"2016-11-14 19:29:22.000000000","message":"I think you could further simplify the solution by having the API also include the certificate and no longer need Castellan.","commit_id":"2edf8ef8f75a6fe1ea41a0a13ca9feed576027fe"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"09427617e14c1c6edb583ce6c174e4353023e045","unresolved":false,"context_lines":[{"line_number":158,"context_line":"Glance is untrusted; such as Glance returning a different signed image than the"},{"line_number":159,"context_line":"image that was requested. Possible changes include the following extensions:"},{"line_number":160,"context_line":""},{"line_number":161,"context_line":"* Modify the REST API to accept a specific signature required to verify the"},{"line_number":162,"context_line":"  integrity of the image. If the specified signature cannot be verified, then"},{"line_number":163,"context_line":"  Nova refuses to boot the image and returns an appropriate error message to"},{"line_number":164,"context_line":"  the end user. This change builds upon a spec that allows overriding image"},{"line_number":165,"context_line":"  properties at boot time [4]."}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a77a97e_8a088d2f","line":162,"range":{"start_line":161,"start_character":25,"end_line":162,"end_character":24},"in_reply_to":"7a77a97e_2372c249","updated":"2016-11-21 14:01:42.000000000","message":"This is the exact reason why we are implementing certificate validation.","commit_id":"2edf8ef8f75a6fe1ea41a0a13ca9feed576027fe"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"c549ca5d3d01a56d77afae074155cab5312049ee","unresolved":false,"context_lines":[{"line_number":158,"context_line":"Glance is untrusted; such as Glance returning a different signed image than the"},{"line_number":159,"context_line":"image that was requested. Possible changes include the following extensions:"},{"line_number":160,"context_line":""},{"line_number":161,"context_line":"* Modify the REST API to accept a specific signature required to verify the"},{"line_number":162,"context_line":"  integrity of the image. If the specified signature cannot be verified, then"},{"line_number":163,"context_line":"  Nova refuses to boot the image and returns an appropriate error message to"},{"line_number":164,"context_line":"  the end user. This change builds upon a spec that allows overriding image"},{"line_number":165,"context_line":"  properties at boot time [4]."}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a77a97e_2372c249","line":162,"range":{"start_line":161,"start_character":25,"end_line":162,"end_character":24},"in_reply_to":"7a77a97e_50388aa0","updated":"2016-11-17 11:25:17.000000000","message":"To be fair, the MiTM could just give a reference to his own certificate in castellan. There is probably an interesting issue to look at here.","commit_id":"2edf8ef8f75a6fe1ea41a0a13ca9feed576027fe"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"ad8941e814b2861186045a387b9087055612a562","unresolved":false,"context_lines":[{"line_number":158,"context_line":"Glance is untrusted; such as Glance returning a different signed image than the"},{"line_number":159,"context_line":"image that was requested. Possible changes include the following extensions:"},{"line_number":160,"context_line":""},{"line_number":161,"context_line":"* Modify the REST API to accept a specific signature required to verify the"},{"line_number":162,"context_line":"  integrity of the image. If the specified signature cannot be verified, then"},{"line_number":163,"context_line":"  Nova refuses to boot the image and returns an appropriate error message to"},{"line_number":164,"context_line":"  the end user. This change builds upon a spec that allows overriding image"},{"line_number":165,"context_line":"  properties at boot time [4]."}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a77a97e_50388aa0","line":162,"range":{"start_line":161,"start_character":25,"end_line":162,"end_character":24},"in_reply_to":"7a77a97e_bf867b63","updated":"2016-11-16 17:58:27.000000000","message":"If the certificate were included in the boot request, the MiTM is free to swap out the certificate with one of their choosing and dupe Nova into validating the signature associated with a corrupted disc image.","commit_id":"2edf8ef8f75a6fe1ea41a0a13ca9feed576027fe"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"515640dd0baa0f349e4000c50e490d9ec68f9192","unresolved":false,"context_lines":[{"line_number":171,"context_line":"  signature matches the expected signature."},{"line_number":172,"context_line":""},{"line_number":173,"context_line":"The first approach is preferred since it may be fully automated whereas the"},{"line_number":174,"context_line":"second approach requires manual verification by the end user."},{"line_number":175,"context_line":""},{"line_number":176,"context_line":"The certificate references will be used to access the certificates from a key"},{"line_number":177,"context_line":"manager through the interface provided by Castellan."}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a77a97e_dc40a50a","line":174,"range":{"start_line":174,"start_character":16,"end_line":174,"end_character":60},"updated":"2016-11-14 19:29:22.000000000","message":"not necessarily manual. They could automate the verification themselves to do exactly what nova would have done for them with the first approach. Of course it is nicer if nova does it for them so they don\u0027t have to write that automation themselves.","commit_id":"2edf8ef8f75a6fe1ea41a0a13ca9feed576027fe"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"ad8941e814b2861186045a387b9087055612a562","unresolved":false,"context_lines":[{"line_number":171,"context_line":"  signature matches the expected signature."},{"line_number":172,"context_line":""},{"line_number":173,"context_line":"The first approach is preferred since it may be fully automated whereas the"},{"line_number":174,"context_line":"second approach requires manual verification by the end user."},{"line_number":175,"context_line":""},{"line_number":176,"context_line":"The certificate references will be used to access the certificates from a key"},{"line_number":177,"context_line":"manager through the interface provided by Castellan."}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a77a97e_f0d99684","line":174,"range":{"start_line":174,"start_character":16,"end_line":174,"end_character":60},"in_reply_to":"7a77a97e_dc40a50a","updated":"2016-11-16 17:58:27.000000000","message":"I would argue that requiring the end user to write their own software to perform certificate validation is equally arduous.","commit_id":"2edf8ef8f75a6fe1ea41a0a13ca9feed576027fe"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"c549ca5d3d01a56d77afae074155cab5312049ee","unresolved":false,"context_lines":[{"line_number":171,"context_line":"  signature matches the expected signature."},{"line_number":172,"context_line":""},{"line_number":173,"context_line":"The first approach is preferred since it may be fully automated whereas the"},{"line_number":174,"context_line":"second approach requires manual verification by the end user."},{"line_number":175,"context_line":""},{"line_number":176,"context_line":"The certificate references will be used to access the certificates from a key"},{"line_number":177,"context_line":"manager through the interface provided by Castellan."}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a77a97e_c3ccae6c","line":174,"range":{"start_line":174,"start_character":16,"end_line":174,"end_character":60},"in_reply_to":"7a77a97e_f0d99684","updated":"2016-11-17 11:25:17.000000000","message":"Seems like that second thing should love in the alternatives section, so its not confusing.","commit_id":"2edf8ef8f75a6fe1ea41a0a13ca9feed576027fe"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"515640dd0baa0f349e4000c50e490d9ec68f9192","unresolved":false,"context_lines":[{"line_number":210,"context_line":"signed images. The user, when using the Nova CLI to boot an instance, would"},{"line_number":211,"context_line":"specify one of these \"trusted\" flavors to indicate that image signature"},{"line_number":212,"context_line":"verification should occur as part of the control flow for booting the"},{"line_number":213,"context_line":"instance. This may be added in a later change, but will not be included in the"},{"line_number":214,"context_line":"initial implementation. If added, the trusted flavors option will work"},{"line_number":215,"context_line":"alongside the configuration option approach. In this case, Nova would perform"},{"line_number":216,"context_line":"image signature verification if either the configuration flag is set, or if"},{"line_number":217,"context_line":"the user has specified booting an instance of the \"trusted\" flavor."}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a77a97e_ffaf1392","line":214,"range":{"start_line":213,"start_character":10,"end_line":214,"end_character":22},"updated":"2016-11-14 19:29:22.000000000","message":"this seems far superior to a single conf option. If we\u0027re not going to include it here, please explain your reasoning for separating that out.","commit_id":"2edf8ef8f75a6fe1ea41a0a13ca9feed576027fe"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"ad8941e814b2861186045a387b9087055612a562","unresolved":false,"context_lines":[{"line_number":210,"context_line":"signed images. The user, when using the Nova CLI to boot an instance, would"},{"line_number":211,"context_line":"specify one of these \"trusted\" flavors to indicate that image signature"},{"line_number":212,"context_line":"verification should occur as part of the control flow for booting the"},{"line_number":213,"context_line":"instance. This may be added in a later change, but will not be included in the"},{"line_number":214,"context_line":"initial implementation. If added, the trusted flavors option will work"},{"line_number":215,"context_line":"alongside the configuration option approach. In this case, Nova would perform"},{"line_number":216,"context_line":"image signature verification if either the configuration flag is set, or if"},{"line_number":217,"context_line":"the user has specified booting an instance of the \"trusted\" flavor."}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a77a97e_305f8e0f","line":214,"range":{"start_line":213,"start_character":10,"end_line":214,"end_character":22},"in_reply_to":"7a77a97e_ffaf1392","updated":"2016-11-16 17:58:27.000000000","message":"This change is complicated, and requires another spec to explain it.","commit_id":"2edf8ef8f75a6fe1ea41a0a13ca9feed576027fe"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"515640dd0baa0f349e4000c50e490d9ec68f9192","unresolved":false,"context_lines":[{"line_number":232,"context_line":"The accompanying work in Glance introduced additional Glance image properties"},{"line_number":233,"context_line":"necessary for image signing. The initial implementation in Nova will introduce"},{"line_number":234,"context_line":"a configuration flag indicating whether Nova should perform image signature"},{"line_number":235,"context_line":"verification before booting an image. The updated implementation which"},{"line_number":236,"context_line":"includes certificate validation will introduce an addtional configuration flag"},{"line_number":237,"context_line":"for specifying the trusted root certificates."},{"line_number":238,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a77a97e_9c30ed09","line":235,"range":{"start_line":235,"start_character":42,"end_line":235,"end_character":49},"updated":"2016-11-14 19:29:22.000000000","message":"still under this spec, I presume? This wording is a bit confusing.","commit_id":"2edf8ef8f75a6fe1ea41a0a13ca9feed576027fe"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"ad8941e814b2861186045a387b9087055612a562","unresolved":false,"context_lines":[{"line_number":232,"context_line":"The accompanying work in Glance introduced additional Glance image properties"},{"line_number":233,"context_line":"necessary for image signing. The initial implementation in Nova will introduce"},{"line_number":234,"context_line":"a configuration flag indicating whether Nova should perform image signature"},{"line_number":235,"context_line":"verification before booting an image. The updated implementation which"},{"line_number":236,"context_line":"includes certificate validation will introduce an addtional configuration flag"},{"line_number":237,"context_line":"for specifying the trusted root certificates."},{"line_number":238,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a77a97e_103612e6","line":235,"range":{"start_line":235,"start_character":42,"end_line":235,"end_character":49},"in_reply_to":"7a77a97e_9c30ed09","updated":"2016-11-16 17:58:27.000000000","message":"This refers to the implementation of the feature after another related change merges which enables certificate vaildation. That feature is described by the following spec:\n\nhttps://review.openstack.org/#/c/357151/","commit_id":"2edf8ef8f75a6fe1ea41a0a13ca9feed576027fe"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"515640dd0baa0f349e4000c50e490d9ec68f9192","unresolved":false,"context_lines":[{"line_number":239,"context_line":"REST API impact"},{"line_number":240,"context_line":"---------------"},{"line_number":241,"context_line":""},{"line_number":242,"context_line":"A future change will modify the request or response to the boot command. This"},{"line_number":243,"context_line":"change supports the untrusted Glance use cases by giving the user additional"},{"line_number":244,"context_line":"assurance that the desired image has been booted."},{"line_number":245,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a77a97e_1c5e9d45","line":242,"range":{"start_line":242,"start_character":2,"end_line":242,"end_character":8},"updated":"2016-11-14 19:29:22.000000000","message":"let\u0027s drop the word \"future\" and do this here. Or if it really stays future, then make this section N/A... It\u0027s confusing talking about things that this spec isn\u0027t really covering.","commit_id":"2edf8ef8f75a6fe1ea41a0a13ca9feed576027fe"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"ad8941e814b2861186045a387b9087055612a562","unresolved":false,"context_lines":[{"line_number":239,"context_line":"REST API impact"},{"line_number":240,"context_line":"---------------"},{"line_number":241,"context_line":""},{"line_number":242,"context_line":"A future change will modify the request or response to the boot command. This"},{"line_number":243,"context_line":"change supports the untrusted Glance use cases by giving the user additional"},{"line_number":244,"context_line":"assurance that the desired image has been booted."},{"line_number":245,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a77a97e_2eac9033","line":242,"range":{"start_line":242,"start_character":2,"end_line":242,"end_character":8},"in_reply_to":"7a77a97e_1c5e9d45","updated":"2016-11-16 17:58:27.000000000","message":"The level of detail involved in this change necessitates another spec. In my view it is worth mentioning here so that the approvers of this spec can see that we are making an effort to improve the initial implementation of the feature.","commit_id":"2edf8ef8f75a6fe1ea41a0a13ca9feed576027fe"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"515640dd0baa0f349e4000c50e490d9ec68f9192","unresolved":false,"context_lines":[{"line_number":266,"context_line":"---------------------"},{"line_number":267,"context_line":""},{"line_number":268,"context_line":"If the verification of a signature fails, then Nova will not boot an instance"},{"line_number":269,"context_line":"from the image, and an error message will be logged. The user would then have"},{"line_number":270,"context_line":"to edit the image\u0027s metadata through the Glance API, the Nova API, or the"},{"line_number":271,"context_line":"Horizon interface; or reinitiate an upload of the image to Glance with the"},{"line_number":272,"context_line":"correct signature metadata in order to boot the image."},{"line_number":273,"context_line":""},{"line_number":274,"context_line":"Performance Impact"},{"line_number":275,"context_line":"------------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a77a97e_ff2ab32b","line":272,"range":{"start_line":269,"start_character":53,"end_line":272,"end_character":53},"updated":"2016-11-14 19:29:22.000000000","message":"these 2 steps only seem to cover some of the attack possibilities here. E.g. MITM wouldn\u0027t be addressed by either of those corrective actions.","commit_id":"2edf8ef8f75a6fe1ea41a0a13ca9feed576027fe"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"ad8941e814b2861186045a387b9087055612a562","unresolved":false,"context_lines":[{"line_number":266,"context_line":"---------------------"},{"line_number":267,"context_line":""},{"line_number":268,"context_line":"If the verification of a signature fails, then Nova will not boot an instance"},{"line_number":269,"context_line":"from the image, and an error message will be logged. The user would then have"},{"line_number":270,"context_line":"to edit the image\u0027s metadata through the Glance API, the Nova API, or the"},{"line_number":271,"context_line":"Horizon interface; or reinitiate an upload of the image to Glance with the"},{"line_number":272,"context_line":"correct signature metadata in order to boot the image."},{"line_number":273,"context_line":""},{"line_number":274,"context_line":"Performance Impact"},{"line_number":275,"context_line":"------------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a77a97e_8ecbe41d","line":272,"range":{"start_line":269,"start_character":53,"end_line":272,"end_character":53},"in_reply_to":"7a77a97e_ff2ab32b","updated":"2016-11-16 17:58:27.000000000","message":"Please explain more. The MiTM attacker cannot fake the user\u0027s signature without access to their private key.","commit_id":"2edf8ef8f75a6fe1ea41a0a13ca9feed576027fe"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"515640dd0baa0f349e4000c50e490d9ec68f9192","unresolved":false,"context_lines":[{"line_number":277,"context_line":"This feature will only be used if the verify_glance_signatures configuration"},{"line_number":278,"context_line":"flag is set."},{"line_number":279,"context_line":""},{"line_number":280,"context_line":"When signature verification occurs there will be latency as a result of"},{"line_number":281,"context_line":"retrieving certificates from the key manager through the Castellan interface."},{"line_number":282,"context_line":"There will also be CPU overhead associated with hashing the image data and"},{"line_number":283,"context_line":"decrypting a signature using a public key."},{"line_number":284,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a77a97e_5f76473f","line":281,"range":{"start_line":280,"start_character":49,"end_line":281,"end_character":77},"updated":"2016-11-14 19:29:22.000000000","message":"another reason to find a way to solve this that doesn\u0027t involve Castellan, which seems unnecessary.","commit_id":"2edf8ef8f75a6fe1ea41a0a13ca9feed576027fe"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"ad8941e814b2861186045a387b9087055612a562","unresolved":false,"context_lines":[{"line_number":277,"context_line":"This feature will only be used if the verify_glance_signatures configuration"},{"line_number":278,"context_line":"flag is set."},{"line_number":279,"context_line":""},{"line_number":280,"context_line":"When signature verification occurs there will be latency as a result of"},{"line_number":281,"context_line":"retrieving certificates from the key manager through the Castellan interface."},{"line_number":282,"context_line":"There will also be CPU overhead associated with hashing the image data and"},{"line_number":283,"context_line":"decrypting a signature using a public key."},{"line_number":284,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a77a97e_eedc58e6","line":281,"range":{"start_line":280,"start_character":49,"end_line":281,"end_character":77},"in_reply_to":"7a77a97e_5f76473f","updated":"2016-11-16 17:58:27.000000000","message":"See above.","commit_id":"2edf8ef8f75a6fe1ea41a0a13ca9feed576027fe"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"c2611c5ea19abdf418c2d35f3ea4542dedab8b5d","unresolved":false,"context_lines":[{"line_number":324,"context_line":""},{"line_number":325,"context_line":"* Add functionality to Nova which calls the standalone module when Nova"},{"line_number":326,"context_line":"  uploads a Glance image and the verify_glance_signatures configuration flag"},{"line_number":327,"context_line":"  is set."},{"line_number":328,"context_line":""},{"line_number":329,"context_line":"* Add certificate validation functionality to the pyca/cryptography library."},{"line_number":330,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a77a97e_a815d149","line":327,"updated":"2016-11-17 11:18:23.000000000","message":"Its not clear to me, what is done, and what is left.\n\nNormally we create a new spec for the completion of partial efforts, so thats clearer.\n\nI am looking at:\nhttps://review.openstack.org/#/c/189843/\n\nIt seems like all these first few bullet points are done already.\n\nCan we make that clear in this list please.","commit_id":"2edf8ef8f75a6fe1ea41a0a13ca9feed576027fe"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"c2611c5ea19abdf418c2d35f3ea4542dedab8b5d","unresolved":false,"context_lines":[{"line_number":335,"context_line":""},{"line_number":336,"context_line":"* Amend the initial implementation in Nova to utilize this change by allowing"},{"line_number":337,"context_line":"  Nova to fetch root certificate references and pass them to the image"},{"line_number":338,"context_line":"  signature verification method."},{"line_number":339,"context_line":""},{"line_number":340,"context_line":"* Implement a REST API change to respond to a successful boot request with"},{"line_number":341,"context_line":"  information relevant to the signing data and/or implement a REST API change"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a77a97e_235e4212","line":338,"updated":"2016-11-17 11:18:23.000000000","message":"Surely can\u0027t the shared util lib not deal with all that?\nhttps://review.openstack.org/#/c/189843/30/nova/image/glance.py@393\n\nI assume it can already access the configuration for the certificate store?\n\nFrom the summit discussion, I got the impression that the REST API specifying the expected certificate was more important?","commit_id":"2edf8ef8f75a6fe1ea41a0a13ca9feed576027fe"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"c2611c5ea19abdf418c2d35f3ea4542dedab8b5d","unresolved":false,"context_lines":[{"line_number":339,"context_line":""},{"line_number":340,"context_line":"* Implement a REST API change to respond to a successful boot request with"},{"line_number":341,"context_line":"  information relevant to the signing data and/or implement a REST API change"},{"line_number":342,"context_line":"  to allow the end user to specify the expected signature at boot time."},{"line_number":343,"context_line":""},{"line_number":344,"context_line":""},{"line_number":345,"context_line":"Dependencies"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a77a97e_0857a526","line":342,"updated":"2016-11-17 11:18:23.000000000","message":"This is described as \"future work\" but is listed here. I am confused? I was expecting to review a spec around the API changes.\n\nI thought the API change was going to be specifying the certificate or root certificate that is expected to be used to validate the image. I.e. say trust \"Rackspace cloud\", and its some child cert that is used to sign the base image and snapshots, so that succeeds?","commit_id":"2edf8ef8f75a6fe1ea41a0a13ca9feed576027fe"}]}