)]}'
{"doc/source/artifacts/barbican/newton/architecture-page.rst":[{"author":{"_account_id":18462,"name":"Rahul U Nair","email":"rahulunair@gmail.com","username":"rahulunair"},"change_message_id":"28b8ce3cc474585c19306fefb008744776e87c7c","unresolved":false,"context_lines":[{"line_number":52,"context_line":"  retrieved from the worker queue."},{"line_number":53,"context_line":"- Keystone Listener Process (python): Python process that consumes Keystone"},{"line_number":54,"context_line":"  events published by the Keystone service."},{"line_number":55,"context_line":"- Database (SQL): SQL compliant database to store Barbican"},{"line_number":56,"context_line":"  state data related to its managed entities and their metadata."},{"line_number":57,"context_line":"- Worker Queue (rabbitmq): This queue is used to process new order"},{"line_number":58,"context_line":"  requests."}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a8ec9b2_bf547321","line":55,"range":{"start_line":55,"start_character":18,"end_line":55,"end_character":21},"updated":"2016-09-14 16:45:12.000000000","message":"Can we say SQL compliant, as Barbican works with mysql and mysql (Except for innodb engine) is not fully SQL compliant?","commit_id":"e9c0f17af5afaeff50039d437a73ef6bea866cdf"},{"author":{"_account_id":18462,"name":"Rahul U Nair","email":"rahulunair@gmail.com","username":"rahulunair"},"change_message_id":"28b8ce3cc474585c19306fefb008744776e87c7c","unresolved":false,"context_lines":[{"line_number":78,"context_line":"Data assets"},{"line_number":79,"context_line":"~~~~~~~~~~~"},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"- *Secret data* : Passphrase, Encryption Keys, RSA Keys - persisted in Database [PKCS#11] or HSM [KMIP] or [KMIP, Dogtag]"},{"line_number":82,"context_line":"- *Secret metadata*  - persisted in database"},{"line_number":83,"context_line":"- *RBAC rulesets* - persisted in policy.json"},{"line_number":84,"context_line":"- *ACL rules* - persisted in database"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a8ec9b2_2a581f32","line":81,"range":{"start_line":81,"start_character":28,"end_line":81,"end_character":29},"updated":"2016-09-14 16:45:12.000000000","message":"nit: Passphrases?","commit_id":"e9c0f17af5afaeff50039d437a73ef6bea866cdf"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"5fdcb1a632f36a9966f9a14e98126dfb3baabcc3","unresolved":false,"context_lines":[{"line_number":17,"context_line":""},{"line_number":18,"context_line":"- Architect: Douglas Mendizábal - redrobot"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"- Security Reviewer: Robert Clark - hyakuei"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"Project description and purpose"},{"line_number":23,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7a8ec9b2_6988f971","line":20,"updated":"2016-09-16 17:23:24.000000000","message":"hyakuhei","commit_id":"80e4c62c2ede84551bbfce7113f4b098aa21bb0d"},{"author":{"_account_id":15515,"name":"Charles Neill","email":"charles.neill@rackspace.com","username":"cneill"},"change_message_id":"c6e45bfe9a2c89ddae9dca9abfbee227f5a7ce3f","unresolved":false,"context_lines":[{"line_number":52,"context_line":"  retrieved from the worker queue."},{"line_number":53,"context_line":"- Keystone Listener Process (python): Python process that consumes Keystone"},{"line_number":54,"context_line":"  events published by the Keystone service."},{"line_number":55,"context_line":"- Database (mySQL): mySQL database to store Barbican state data related to its"},{"line_number":56,"context_line":"  managed entities and their metadata."},{"line_number":57,"context_line":"- Worker Queue (rabbitmq): This queue is used to process new order"},{"line_number":58,"context_line":"  requests."}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a8bc5a2_55dc4212","line":55,"range":{"start_line":55,"start_character":11,"end_line":55,"end_character":25},"updated":"2016-09-22 20:07:42.000000000","message":"Nit: MySQL? mysql?","commit_id":"fd5430d9d64ff315ed6710a9980ea6807c0a2abf"},{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"2942a21ea3ec9c3341291114e58f16a0e84ce4b6","unresolved":false,"context_lines":[{"line_number":52,"context_line":"  retrieved from the worker queue."},{"line_number":53,"context_line":"- Keystone Listener Process (python): Python process that consumes Keystone"},{"line_number":54,"context_line":"  events published by the Keystone service."},{"line_number":55,"context_line":"- Database (mySQL): mySQL database to store Barbican state data related to its"},{"line_number":56,"context_line":"  managed entities and their metadata."},{"line_number":57,"context_line":"- Worker Queue (rabbitmq): This queue is used to process new order"},{"line_number":58,"context_line":"  requests."}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a8bc5a2_8784a0d4","line":55,"range":{"start_line":55,"start_character":11,"end_line":55,"end_character":25},"in_reply_to":"5a8bc5a2_55dc4212","updated":"2016-09-23 20:42:37.000000000","message":"Done","commit_id":"fd5430d9d64ff315ed6710a9980ea6807c0a2abf"},{"author":{"_account_id":15515,"name":"Charles Neill","email":"charles.neill@rackspace.com","username":"cneill"},"change_message_id":"c6e45bfe9a2c89ddae9dca9abfbee227f5a7ce3f","unresolved":false,"context_lines":[{"line_number":90,"context_line":"- *Keystone Event Queue Credentials* - persisted in barbican.conf"},{"line_number":91,"context_line":"- *Middleware configuration* - persisted in paste.ini"},{"line_number":92,"context_line":"- *[PKCS#11] HSM HMAC Key* - persisted in HSM"},{"line_number":93,"context_line":"- *[PKCS#11] HSM Master Key Encryption Key* - persisted in HSM, Per-project"},{"line_number":94,"context_line":"  KEKs wrapped by MKEK, stored in DB"},{"line_number":95,"context_line":"- *CA (dogtag) credentials* - persisted in worker process barbican.conf"},{"line_number":96,"context_line":"- *Keystone Credentials (Barbican service account)* - should be configured to"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a8bc5a2_d55a1283","line":93,"range":{"start_line":93,"start_character":39,"end_line":93,"end_character":43},"updated":"2016-09-22 20:07:42.000000000","message":"Might be good to include \"(MKEK)\" here since it is referenced by its acronym elsewhere","commit_id":"fd5430d9d64ff315ed6710a9980ea6807c0a2abf"},{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"2942a21ea3ec9c3341291114e58f16a0e84ce4b6","unresolved":false,"context_lines":[{"line_number":90,"context_line":"- *Keystone Event Queue Credentials* - persisted in barbican.conf"},{"line_number":91,"context_line":"- *Middleware configuration* - persisted in paste.ini"},{"line_number":92,"context_line":"- *[PKCS#11] HSM HMAC Key* - persisted in HSM"},{"line_number":93,"context_line":"- *[PKCS#11] HSM Master Key Encryption Key* - persisted in HSM, Per-project"},{"line_number":94,"context_line":"  KEKs wrapped by MKEK, stored in DB"},{"line_number":95,"context_line":"- *CA (dogtag) credentials* - persisted in worker process barbican.conf"},{"line_number":96,"context_line":"- *Keystone Credentials (Barbican service account)* - should be configured to"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a8bc5a2_a75efc73","line":93,"range":{"start_line":93,"start_character":39,"end_line":93,"end_character":43},"in_reply_to":"5a8bc5a2_d55a1283","updated":"2016-09-23 20:42:37.000000000","message":"Done","commit_id":"fd5430d9d64ff315ed6710a9980ea6807c0a2abf"},{"author":{"_account_id":15515,"name":"Charles Neill","email":"charles.neill@rackspace.com","username":"cneill"},"change_message_id":"c6e45bfe9a2c89ddae9dca9abfbee227f5a7ce3f","unresolved":false,"context_lines":[{"line_number":90,"context_line":"- *Keystone Event Queue Credentials* - persisted in barbican.conf"},{"line_number":91,"context_line":"- *Middleware configuration* - persisted in paste.ini"},{"line_number":92,"context_line":"- *[PKCS#11] HSM HMAC Key* - persisted in HSM"},{"line_number":93,"context_line":"- *[PKCS#11] HSM Master Key Encryption Key* - persisted in HSM, Per-project"},{"line_number":94,"context_line":"  KEKs wrapped by MKEK, stored in DB"},{"line_number":95,"context_line":"- *CA (dogtag) credentials* - persisted in worker process barbican.conf"},{"line_number":96,"context_line":"- *Keystone Credentials (Barbican service account)* - should be configured to"},{"line_number":97,"context_line":"  only allow token validation but in some configurations may have higher"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a8bc5a2_95796aff","line":94,"range":{"start_line":93,"start_character":64,"end_line":94,"end_character":36},"updated":"2016-09-22 20:07:42.000000000","message":"Should this be its own line?","commit_id":"fd5430d9d64ff315ed6710a9980ea6807c0a2abf"},{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"2942a21ea3ec9c3341291114e58f16a0e84ce4b6","unresolved":false,"context_lines":[{"line_number":90,"context_line":"- *Keystone Event Queue Credentials* - persisted in barbican.conf"},{"line_number":91,"context_line":"- *Middleware configuration* - persisted in paste.ini"},{"line_number":92,"context_line":"- *[PKCS#11] HSM HMAC Key* - persisted in HSM"},{"line_number":93,"context_line":"- *[PKCS#11] HSM Master Key Encryption Key* - persisted in HSM, Per-project"},{"line_number":94,"context_line":"  KEKs wrapped by MKEK, stored in DB"},{"line_number":95,"context_line":"- *CA (dogtag) credentials* - persisted in worker process barbican.conf"},{"line_number":96,"context_line":"- *Keystone Credentials (Barbican service account)* - should be configured to"},{"line_number":97,"context_line":"  only allow token validation but in some configurations may have higher"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a8bc5a2_07e7b0b0","line":94,"range":{"start_line":93,"start_character":64,"end_line":94,"end_character":36},"in_reply_to":"5a8bc5a2_95796aff","updated":"2016-09-23 20:42:37.000000000","message":"Done","commit_id":"fd5430d9d64ff315ed6710a9980ea6807c0a2abf"},{"author":{"_account_id":15515,"name":"Charles Neill","email":"charles.neill@rackspace.com","username":"cneill"},"change_message_id":"c6e45bfe9a2c89ddae9dca9abfbee227f5a7ce3f","unresolved":false,"context_lines":[{"line_number":96,"context_line":"- *Keystone Credentials (Barbican service account)* - should be configured to"},{"line_number":97,"context_line":"  only allow token validation but in some configurations may have higher"},{"line_number":98,"context_line":"  privileges"},{"line_number":99,"context_line":"- *Client keystone token* - ephemeral token provided by client, validated"},{"line_number":100,"context_line":"  against Keystone by Barbican service account, could be any level of"},{"line_number":101,"context_line":"  permissions (e.g. service accounts for other services)"},{"line_number":102,"context_line":"- *CADF Credentials* - write only access to rabbit server"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a8bc5a2_35d976f4","line":99,"range":{"start_line":99,"start_character":10,"end_line":99,"end_character":11},"updated":"2016-09-22 20:07:42.000000000","message":"Nit: Keystone","commit_id":"fd5430d9d64ff315ed6710a9980ea6807c0a2abf"},{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"2942a21ea3ec9c3341291114e58f16a0e84ce4b6","unresolved":false,"context_lines":[{"line_number":96,"context_line":"- *Keystone Credentials (Barbican service account)* - should be configured to"},{"line_number":97,"context_line":"  only allow token validation but in some configurations may have higher"},{"line_number":98,"context_line":"  privileges"},{"line_number":99,"context_line":"- *Client keystone token* - ephemeral token provided by client, validated"},{"line_number":100,"context_line":"  against Keystone by Barbican service account, could be any level of"},{"line_number":101,"context_line":"  permissions (e.g. service accounts for other services)"},{"line_number":102,"context_line":"- *CADF Credentials* - write only access to rabbit server"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a8bc5a2_47eff886","line":99,"range":{"start_line":99,"start_character":10,"end_line":99,"end_character":11},"in_reply_to":"5a8bc5a2_35d976f4","updated":"2016-09-23 20:42:37.000000000","message":"Done","commit_id":"fd5430d9d64ff315ed6710a9980ea6807c0a2abf"},{"author":{"_account_id":15515,"name":"Charles Neill","email":"charles.neill@rackspace.com","username":"cneill"},"change_message_id":"c6e45bfe9a2c89ddae9dca9abfbee227f5a7ce3f","unresolved":false,"context_lines":[{"line_number":124,"context_line":""},{"line_number":125,"context_line":"  - Integrity Failure Impact: Barbican ignores metadata, it is there as a"},{"line_number":126,"context_line":"    facility for users. User applications could be affected by changes to this"},{"line_number":127,"context_line":"    metadata. Future UI designers should ensure that metadata should be"},{"line_number":128,"context_line":"    sanitized before being rendered to avoid things like XSS in metadata."},{"line_number":129,"context_line":"  - Confidentiality Failure Impact: Metadata is not confidential and Barbican"},{"line_number":130,"context_line":"    does not encrypt it."}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a8bc5a2_55ab621d","line":127,"range":{"start_line":127,"start_character":62,"end_line":127,"end_character":71},"updated":"2016-09-22 20:07:42.000000000","message":"Nit: is? (\"should\" is used x2 here)","commit_id":"fd5430d9d64ff315ed6710a9980ea6807c0a2abf"},{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"2942a21ea3ec9c3341291114e58f16a0e84ce4b6","unresolved":false,"context_lines":[{"line_number":124,"context_line":""},{"line_number":125,"context_line":"  - Integrity Failure Impact: Barbican ignores metadata, it is there as a"},{"line_number":126,"context_line":"    facility for users. User applications could be affected by changes to this"},{"line_number":127,"context_line":"    metadata. Future UI designers should ensure that metadata should be"},{"line_number":128,"context_line":"    sanitized before being rendered to avoid things like XSS in metadata."},{"line_number":129,"context_line":"  - Confidentiality Failure Impact: Metadata is not confidential and Barbican"},{"line_number":130,"context_line":"    does not encrypt it."}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a8bc5a2_27902cec","line":127,"range":{"start_line":127,"start_character":62,"end_line":127,"end_character":71},"in_reply_to":"5a8bc5a2_55ab621d","updated":"2016-09-23 20:42:37.000000000","message":"Done","commit_id":"fd5430d9d64ff315ed6710a9980ea6807c0a2abf"},{"author":{"_account_id":15515,"name":"Charles Neill","email":"charles.neill@rackspace.com","username":"cneill"},"change_message_id":"c6e45bfe9a2c89ddae9dca9abfbee227f5a7ce3f","unresolved":false,"context_lines":[{"line_number":126,"context_line":"    facility for users. User applications could be affected by changes to this"},{"line_number":127,"context_line":"    metadata. Future UI designers should ensure that metadata should be"},{"line_number":128,"context_line":"    sanitized before being rendered to avoid things like XSS in metadata."},{"line_number":129,"context_line":"  - Confidentiality Failure Impact: Metadata is not confidential and Barbican"},{"line_number":130,"context_line":"    does not encrypt it."},{"line_number":131,"context_line":"  - Availability Failure: Barbican unaffected"},{"line_number":132,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a8bc5a2_352336bf","line":129,"updated":"2016-09-22 20:07:42.000000000","message":"Might be good to mention that metadata is _intended_ not to be confidential, but end users can put whatever they want in there. Potentially worth calling out in docs that this is stored unencrypted so that end-users don\u0027t use it for sensitive info","commit_id":"fd5430d9d64ff315ed6710a9980ea6807c0a2abf"},{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"2942a21ea3ec9c3341291114e58f16a0e84ce4b6","unresolved":false,"context_lines":[{"line_number":126,"context_line":"    facility for users. User applications could be affected by changes to this"},{"line_number":127,"context_line":"    metadata. Future UI designers should ensure that metadata should be"},{"line_number":128,"context_line":"    sanitized before being rendered to avoid things like XSS in metadata."},{"line_number":129,"context_line":"  - Confidentiality Failure Impact: Metadata is not confidential and Barbican"},{"line_number":130,"context_line":"    does not encrypt it."},{"line_number":131,"context_line":"  - Availability Failure: Barbican unaffected"},{"line_number":132,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a8bc5a2_4a38dda0","line":129,"in_reply_to":"5a8bc5a2_352336bf","updated":"2016-09-23 20:42:37.000000000","message":"Done, and added a recommendation.","commit_id":"fd5430d9d64ff315ed6710a9980ea6807c0a2abf"},{"author":{"_account_id":15515,"name":"Charles Neill","email":"charles.neill@rackspace.com","username":"cneill"},"change_message_id":"c6e45bfe9a2c89ddae9dca9abfbee227f5a7ce3f","unresolved":false,"context_lines":[{"line_number":159,"context_line":"      secrets would be lost."},{"line_number":160,"context_line":"    - [KMIP] Attacker is able to retrieve all secrets from the HSM"},{"line_number":161,"context_line":""},{"line_number":162,"context_line":"  - Availability: Barbican won\u0027t be able to access HSM fail to CRUD secrets in"},{"line_number":163,"context_line":"    KMIP, unable to decrypt or encrypt secrets in PKCS#11."},{"line_number":164,"context_line":""},{"line_number":165,"context_line":"- *RabbitMQ Credentials*:"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a8bc5a2_586397dc","line":162,"range":{"start_line":162,"start_character":51,"end_line":162,"end_character":59},"updated":"2016-09-22 20:07:42.000000000","message":"This could use something like \"and will\" for clarity","commit_id":"fd5430d9d64ff315ed6710a9980ea6807c0a2abf"},{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"2942a21ea3ec9c3341291114e58f16a0e84ce4b6","unresolved":false,"context_lines":[{"line_number":159,"context_line":"      secrets would be lost."},{"line_number":160,"context_line":"    - [KMIP] Attacker is able to retrieve all secrets from the HSM"},{"line_number":161,"context_line":""},{"line_number":162,"context_line":"  - Availability: Barbican won\u0027t be able to access HSM fail to CRUD secrets in"},{"line_number":163,"context_line":"    KMIP, unable to decrypt or encrypt secrets in PKCS#11."},{"line_number":164,"context_line":""},{"line_number":165,"context_line":"- *RabbitMQ Credentials*:"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a8bc5a2_c75f883f","line":162,"range":{"start_line":162,"start_character":51,"end_line":162,"end_character":59},"in_reply_to":"5a8bc5a2_586397dc","updated":"2016-09-23 20:42:37.000000000","message":"Done","commit_id":"fd5430d9d64ff315ed6710a9980ea6807c0a2abf"},{"author":{"_account_id":15515,"name":"Charles Neill","email":"charles.neill@rackspace.com","username":"cneill"},"change_message_id":"c6e45bfe9a2c89ddae9dca9abfbee227f5a7ce3f","unresolved":false,"context_lines":[{"line_number":234,"context_line":"    credentials and fail. DoS."},{"line_number":235,"context_line":"  - Confidentially Failure Impact: A malicious user might be able to abuse"},{"line_number":236,"context_line":"    other OpenStack services (depending on Keystone role configurations) but"},{"line_number":237,"context_line":"    Barbican is unaffected."},{"line_number":238,"context_line":"  - Availability Failure Impact: Barbican will not be able to validate user"},{"line_number":239,"context_line":"    credentials and fail. DoS."},{"line_number":240,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a8bc5a2_18cbcf54","line":237,"updated":"2016-09-22 20:07:42.000000000","message":"Wonder if it\u0027s worth mentioning here (or elsewhere) not to use Keystone credentials for token validation that ALSO have god-mode in Barbican. I don\u0027t think anything prevents that scenario but good sense on the operator\u0027s part at this point","commit_id":"fd5430d9d64ff315ed6710a9980ea6807c0a2abf"},{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"2942a21ea3ec9c3341291114e58f16a0e84ce4b6","unresolved":false,"context_lines":[{"line_number":234,"context_line":"    credentials and fail. DoS."},{"line_number":235,"context_line":"  - Confidentially Failure Impact: A malicious user might be able to abuse"},{"line_number":236,"context_line":"    other OpenStack services (depending on Keystone role configurations) but"},{"line_number":237,"context_line":"    Barbican is unaffected."},{"line_number":238,"context_line":"  - Availability Failure Impact: Barbican will not be able to validate user"},{"line_number":239,"context_line":"    credentials and fail. DoS."},{"line_number":240,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a8bc5a2_cd7de71d","line":237,"in_reply_to":"5a8bc5a2_18cbcf54","updated":"2016-09-23 20:42:37.000000000","message":"Any chance you can expand on this, so I can try and write it into a finding or recommendation.","commit_id":"fd5430d9d64ff315ed6710a9980ea6807c0a2abf"},{"author":{"_account_id":15515,"name":"Charles Neill","email":"charles.neill@rackspace.com","username":"cneill"},"change_message_id":"ba9b5711b0cf0d425ab5e43f8cb8720c66e969a0","unresolved":false,"context_lines":[{"line_number":234,"context_line":"    credentials and fail. DoS."},{"line_number":235,"context_line":"  - Confidentially Failure Impact: A malicious user might be able to abuse"},{"line_number":236,"context_line":"    other OpenStack services (depending on Keystone role configurations) but"},{"line_number":237,"context_line":"    Barbican is unaffected."},{"line_number":238,"context_line":"  - Availability Failure Impact: Barbican will not be able to validate user"},{"line_number":239,"context_line":"    credentials and fail. DoS."},{"line_number":240,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a8bc5a2_30eea4ec","line":237,"in_reply_to":"5a8bc5a2_cd7de71d","updated":"2016-09-23 21:11:18.000000000","message":"Sure thing.\n\nIn reference to Keystone Credentials at the top we say, \"should be configured to only allow token validation but in some configurations may have higher privileges.\" I think we originally intended the \"higher privileges\" part to mean \"bleedover into other OpenStack components,\" but it\u0027s conceivable that you might have a service account with token validation, that you ALSO has barbican god-mode privileges. In that case you\u0027d include those credentials in the barbican config for token validation, and any attacker who got that config file could then manipulate barbican admin functions (which I think invalidates the \"Barbican unaffected\" in this bullet point)\n\nI think this is not a very reasonable thing to do, but I\u0027m curious if others think this is a guard rail we should put up in the form of documentation, or if it\u0027s too stupid to consider.","commit_id":"fd5430d9d64ff315ed6710a9980ea6807c0a2abf"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"c64145ffc2d159d120b4c483c45155dd5b17edd2","unresolved":false,"context_lines":[{"line_number":4,"context_line":""},{"line_number":5,"context_line":"Barbican - 3.0.0.0b2/newton"},{"line_number":6,"context_line":"---------------------------"},{"line_number":7,"context_line":""},{"line_number":8,"context_line":"**Status**: Draft"},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"**Release**: Newton"}],"source_content_type":"text/x-rst","patch_set":6,"id":"7a8ec9b2_9ee1cb2c","line":7,"updated":"2016-09-19 09:05:14.000000000","message":"I haven\u0027t looked at this rendered but I didn\u0027t think you needed whitespace after a heading?","commit_id":"f5e3754322d31ef1ad2ef53b4a6655678ada4f66"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"c64145ffc2d159d120b4c483c45155dd5b17edd2","unresolved":false,"context_lines":[{"line_number":43,"context_line":"Barbican depends on an external Authentication/Authorization service.  In"},{"line_number":44,"context_line":"a typical deployment this dependency will be fulfilled by the Keystone service."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"Components"},{"line_number":48,"context_line":"~~~~~~~~~~"},{"line_number":49,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"7a8ec9b2_9e70eb41","line":46,"updated":"2016-09-19 09:05:14.000000000","message":"I think we need a clear case-description of what we are reviewing. Either here or after components which describes exactly what we are reviewing, specifically here we\u0027re looking at a Barbican deployment with CMS [which we don\u0027t really call out as a descrete thing] and PKCS#11.\n\nIronically here as with our findings, KMIP is more secure though less scalable. Heh.","commit_id":"f5e3754322d31ef1ad2ef53b4a6655678ada4f66"},{"author":{"_account_id":18462,"name":"Rahul U Nair","email":"rahulunair@gmail.com","username":"rahulunair"},"change_message_id":"87c021999000f551379611a8ab6274955447b8b1","unresolved":false,"context_lines":[{"line_number":6,"context_line":"---------------------------"},{"line_number":7,"context_line":"**Status**: Draft"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"**Release**: Newton"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"**Version**: 3.0.0.0b2"},{"line_number":12,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a8bc5a2_76366453","line":9,"range":{"start_line":9,"start_character":13,"end_line":9,"end_character":19},"updated":"2016-09-23 22:24:20.000000000","message":"Should this be Ocata as we are in Ocata now.?","commit_id":"a1c38758816a09a18ee667e87aa66d4b4a86350a"},{"author":{"_account_id":18462,"name":"Rahul U Nair","email":"rahulunair@gmail.com","username":"rahulunair"},"change_message_id":"41da3c2b2eebc8326e65ff024e7be7b46f08c6d1","unresolved":false,"context_lines":[{"line_number":37,"context_line":"External dependencies \u0026 associated security assumptions"},{"line_number":38,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":39,"context_line":"Barbican depends on an external Authentication/Authorization service.  In"},{"line_number":40,"context_line":"a typical deployment this dependency will be fulfilled by the Keystone service."},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"This review is of a Barbican deployment with a certificate management system"},{"line_number":43,"context_line":"(CMS) and PKCS#11."}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a8bc5a2_5bbef1d4","line":40,"range":{"start_line":40,"start_character":62,"end_line":40,"end_character":70},"updated":"2016-09-23 22:21:05.000000000","message":"The OpenStack styling guide[1] suggests that we should use small letters for project names and caps for what the service is, so like: Identity service (keystone) .\n\n[1]. http://docs.openstack.org/contributor-guide/writing-style/openstack-components.html","commit_id":"a1c38758816a09a18ee667e87aa66d4b4a86350a"},{"author":{"_account_id":18462,"name":"Rahul U Nair","email":"rahulunair@gmail.com","username":"rahulunair"},"change_message_id":"41da3c2b2eebc8326e65ff024e7be7b46f08c6d1","unresolved":false,"context_lines":[{"line_number":48,"context_line":"- API Process (python): Python web service listening for web requests."},{"line_number":49,"context_line":"- Worker Process (python): Python process that executes tasks"},{"line_number":50,"context_line":"  retrieved from the worker queue."},{"line_number":51,"context_line":"- Keystone Listener Process (python): Python process that consumes Keystone"},{"line_number":52,"context_line":"  events published by the Keystone service."},{"line_number":53,"context_line":"- Database (MySQL): MySQL database to store Barbican state data related to its"},{"line_number":54,"context_line":"  managed entities and their metadata."}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a8bc5a2_9bb879e7","line":51,"range":{"start_line":51,"start_character":67,"end_line":51,"end_character":75},"updated":"2016-09-23 22:21:05.000000000","message":"Opinion: I think other docs are following the approach to use small letters for project names and Caps for what the service is, so like: Identity service (keystone) .","commit_id":"a1c38758816a09a18ee667e87aa66d4b4a86350a"},{"author":{"_account_id":18462,"name":"Rahul U Nair","email":"rahulunair@gmail.com","username":"rahulunair"},"change_message_id":"41da3c2b2eebc8326e65ff024e7be7b46f08c6d1","unresolved":false,"context_lines":[{"line_number":48,"context_line":"- API Process (python): Python web service listening for web requests."},{"line_number":49,"context_line":"- Worker Process (python): Python process that executes tasks"},{"line_number":50,"context_line":"  retrieved from the worker queue."},{"line_number":51,"context_line":"- Keystone Listener Process (python): Python process that consumes Keystone"},{"line_number":52,"context_line":"  events published by the Keystone service."},{"line_number":53,"context_line":"- Database (MySQL): MySQL database to store Barbican state data related to its"},{"line_number":54,"context_line":"  managed entities and their metadata."}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a8bc5a2_5ba511b3","line":51,"range":{"start_line":51,"start_character":29,"end_line":51,"end_character":35},"updated":"2016-09-23 22:21:05.000000000","message":"Python","commit_id":"a1c38758816a09a18ee667e87aa66d4b4a86350a"},{"author":{"_account_id":18462,"name":"Rahul U Nair","email":"rahulunair@gmail.com","username":"rahulunair"},"change_message_id":"41da3c2b2eebc8326e65ff024e7be7b46f08c6d1","unresolved":false,"context_lines":[{"line_number":49,"context_line":"- Worker Process (python): Python process that executes tasks"},{"line_number":50,"context_line":"  retrieved from the worker queue."},{"line_number":51,"context_line":"- Keystone Listener Process (python): Python process that consumes Keystone"},{"line_number":52,"context_line":"  events published by the Keystone service."},{"line_number":53,"context_line":"- Database (MySQL): MySQL database to store Barbican state data related to its"},{"line_number":54,"context_line":"  managed entities and their metadata."},{"line_number":55,"context_line":"- Worker Queue (rabbitmq): This queue is used to process new order"}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a8bc5a2_36d13c58","line":52,"range":{"start_line":52,"start_character":26,"end_line":52,"end_character":34},"updated":"2016-09-23 22:21:05.000000000","message":"nit: keystone","commit_id":"a1c38758816a09a18ee667e87aa66d4b4a86350a"},{"author":{"_account_id":18462,"name":"Rahul U Nair","email":"rahulunair@gmail.com","username":"rahulunair"},"change_message_id":"41da3c2b2eebc8326e65ff024e7be7b46f08c6d1","unresolved":false,"context_lines":[{"line_number":50,"context_line":"  retrieved from the worker queue."},{"line_number":51,"context_line":"- Keystone Listener Process (python): Python process that consumes Keystone"},{"line_number":52,"context_line":"  events published by the Keystone service."},{"line_number":53,"context_line":"- Database (MySQL): MySQL database to store Barbican state data related to its"},{"line_number":54,"context_line":"  managed entities and their metadata."},{"line_number":55,"context_line":"- Worker Queue (rabbitmq): This queue is used to process new order"},{"line_number":56,"context_line":"  requests."}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a8bc5a2_fba09da1","line":53,"range":{"start_line":53,"start_character":44,"end_line":53,"end_character":52},"updated":"2016-09-23 22:21:05.000000000","message":"Opinion: :s/B/b","commit_id":"a1c38758816a09a18ee667e87aa66d4b4a86350a"},{"author":{"_account_id":18462,"name":"Rahul U Nair","email":"rahulunair@gmail.com","username":"rahulunair"},"change_message_id":"41da3c2b2eebc8326e65ff024e7be7b46f08c6d1","unresolved":false,"context_lines":[{"line_number":52,"context_line":"  events published by the Keystone service."},{"line_number":53,"context_line":"- Database (MySQL): MySQL database to store Barbican state data related to its"},{"line_number":54,"context_line":"  managed entities and their metadata."},{"line_number":55,"context_line":"- Worker Queue (rabbitmq): This queue is used to process new order"},{"line_number":56,"context_line":"  requests."},{"line_number":57,"context_line":"- Configurable secure backend.  One of the following:"},{"line_number":58,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a8bc5a2_fbf33d9c","line":55,"range":{"start_line":55,"start_character":16,"end_line":55,"end_character":24},"updated":"2016-09-23 22:21:05.000000000","message":"RabbitMQ?","commit_id":"a1c38758816a09a18ee667e87aa66d4b4a86350a"},{"author":{"_account_id":18462,"name":"Rahul U Nair","email":"rahulunair@gmail.com","username":"rahulunair"},"change_message_id":"41da3c2b2eebc8326e65ff024e7be7b46f08c6d1","unresolved":false,"context_lines":[{"line_number":56,"context_line":"  requests."},{"line_number":57,"context_line":"- Configurable secure backend.  One of the following:"},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"  - DogTag Service: An instance of the RedHat DogTag service."},{"line_number":60,"context_line":"  - Hardware Security Module (HSM): Dedicated hardware security module with"},{"line_number":61,"context_line":"    either a PKCS#11 or KMIP interface"},{"line_number":62,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a8bc5a2_d6d9f884","line":59,"range":{"start_line":59,"start_character":46,"end_line":59,"end_character":52},"updated":"2016-09-23 22:21:05.000000000","message":"nit: Dogtag","commit_id":"a1c38758816a09a18ee667e87aa66d4b4a86350a"},{"author":{"_account_id":18462,"name":"Rahul U Nair","email":"rahulunair@gmail.com","username":"rahulunair"},"change_message_id":"41da3c2b2eebc8326e65ff024e7be7b46f08c6d1","unresolved":false,"context_lines":[{"line_number":83,"context_line":"- *HSM Credentials* - persisted in barbican.conf, clients are also paired with"},{"line_number":84,"context_line":"  the HSM (for Safenet anyway) via PKI"},{"line_number":85,"context_line":"- *RabbitMQ Credentials* - persisted in barbican.conf"},{"line_number":86,"context_line":"- *Keystone Event Queue Credentials* - persisted in barbican.conf"},{"line_number":87,"context_line":"- *Middleware configuration* - persisted in paste.ini"},{"line_number":88,"context_line":"- *[PKCS#11] HSM HMAC Key* - persisted in HSM"},{"line_number":89,"context_line":"- *[PKCS#11] HSM Master Key Encryption Key (MKEK)* - persisted in HSM"}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a8bc5a2_36ea1c10","line":86,"range":{"start_line":86,"start_character":3,"end_line":86,"end_character":11},"updated":"2016-09-23 22:21:05.000000000","message":"nit: keystone","commit_id":"a1c38758816a09a18ee667e87aa66d4b4a86350a"},{"author":{"_account_id":18462,"name":"Rahul U Nair","email":"rahulunair@gmail.com","username":"rahulunair"},"change_message_id":"41da3c2b2eebc8326e65ff024e7be7b46f08c6d1","unresolved":false,"context_lines":[{"line_number":88,"context_line":"- *[PKCS#11] HSM HMAC Key* - persisted in HSM"},{"line_number":89,"context_line":"- *[PKCS#11] HSM Master Key Encryption Key (MKEK)* - persisted in HSM"},{"line_number":90,"context_line":"- *Per-project KEKs wrapped by MKEK* - stored in DB"},{"line_number":91,"context_line":"- *CA (dogtag) credentials* - persisted in worker process barbican.conf"},{"line_number":92,"context_line":"- *Keystone Credentials (Barbican service account)* - should be configured to"},{"line_number":93,"context_line":"  only allow token validation but in some configurations may have higher"},{"line_number":94,"context_line":"  privileges"}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a8bc5a2_168d207b","line":91,"range":{"start_line":91,"start_character":7,"end_line":91,"end_character":13},"updated":"2016-09-23 22:21:05.000000000","message":"nit: Dogtag","commit_id":"a1c38758816a09a18ee667e87aa66d4b4a86350a"},{"author":{"_account_id":18462,"name":"Rahul U Nair","email":"rahulunair@gmail.com","username":"rahulunair"},"change_message_id":"41da3c2b2eebc8326e65ff024e7be7b46f08c6d1","unresolved":false,"context_lines":[{"line_number":89,"context_line":"- *[PKCS#11] HSM Master Key Encryption Key (MKEK)* - persisted in HSM"},{"line_number":90,"context_line":"- *Per-project KEKs wrapped by MKEK* - stored in DB"},{"line_number":91,"context_line":"- *CA (dogtag) credentials* - persisted in worker process barbican.conf"},{"line_number":92,"context_line":"- *Keystone Credentials (Barbican service account)* - should be configured to"},{"line_number":93,"context_line":"  only allow token validation but in some configurations may have higher"},{"line_number":94,"context_line":"  privileges"},{"line_number":95,"context_line":"- *Client Keystone token* - ephemeral token provided by client, validated"}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a8bc5a2_3b904543","line":92,"range":{"start_line":92,"start_character":3,"end_line":92,"end_character":11},"updated":"2016-09-23 22:21:05.000000000","message":"Opinion: keystone","commit_id":"a1c38758816a09a18ee667e87aa66d4b4a86350a"},{"author":{"_account_id":18462,"name":"Rahul U Nair","email":"rahulunair@gmail.com","username":"rahulunair"},"change_message_id":"41da3c2b2eebc8326e65ff024e7be7b46f08c6d1","unresolved":false,"context_lines":[{"line_number":92,"context_line":"- *Keystone Credentials (Barbican service account)* - should be configured to"},{"line_number":93,"context_line":"  only allow token validation but in some configurations may have higher"},{"line_number":94,"context_line":"  privileges"},{"line_number":95,"context_line":"- *Client Keystone token* - ephemeral token provided by client, validated"},{"line_number":96,"context_line":"  against Keystone by Barbican service account, could be any level of"},{"line_number":97,"context_line":"  permissions (e.g. service accounts for other services)"},{"line_number":98,"context_line":"- *CADF Credentials* - write only access to rabbit server"}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a8bc5a2_bb7d351e","line":95,"range":{"start_line":95,"start_character":10,"end_line":95,"end_character":18},"updated":"2016-09-23 22:21:05.000000000","message":"keystone","commit_id":"a1c38758816a09a18ee667e87aa66d4b4a86350a"},{"author":{"_account_id":18462,"name":"Rahul U Nair","email":"rahulunair@gmail.com","username":"rahulunair"},"change_message_id":"41da3c2b2eebc8326e65ff024e7be7b46f08c6d1","unresolved":false,"context_lines":[{"line_number":93,"context_line":"  only allow token validation but in some configurations may have higher"},{"line_number":94,"context_line":"  privileges"},{"line_number":95,"context_line":"- *Client Keystone token* - ephemeral token provided by client, validated"},{"line_number":96,"context_line":"  against Keystone by Barbican service account, could be any level of"},{"line_number":97,"context_line":"  permissions (e.g. service accounts for other services)"},{"line_number":98,"context_line":"- *CADF Credentials* - write only access to rabbit server"},{"line_number":99,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a8bc5a2_db78412e","line":96,"range":{"start_line":96,"start_character":10,"end_line":96,"end_character":18},"updated":"2016-09-23 22:21:05.000000000","message":"keystone","commit_id":"a1c38758816a09a18ee667e87aa66d4b4a86350a"},{"author":{"_account_id":18462,"name":"Rahul U Nair","email":"rahulunair@gmail.com","username":"rahulunair"},"change_message_id":"41da3c2b2eebc8326e65ff024e7be7b46f08c6d1","unresolved":false,"context_lines":[{"line_number":117,"context_line":""},{"line_number":118,"context_line":"- *Secret metadata*:"},{"line_number":119,"context_line":""},{"line_number":120,"context_line":"  - Integrity Failure Impact: Barbican ignores metadata, it is there as a"},{"line_number":121,"context_line":"    facility for users. User applications could be affected by changes to this"},{"line_number":122,"context_line":"    metadata. Future UI designers should ensure that metadata is sanitized"},{"line_number":123,"context_line":"    before being rendered to avoid things like XSS in metadata."}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a8bc5a2_96805048","line":120,"range":{"start_line":120,"start_character":30,"end_line":120,"end_character":38},"updated":"2016-09-23 22:21:05.000000000","message":"nit: barbican","commit_id":"a1c38758816a09a18ee667e87aa66d4b4a86350a"},{"author":{"_account_id":18462,"name":"Rahul U Nair","email":"rahulunair@gmail.com","username":"rahulunair"},"change_message_id":"41da3c2b2eebc8326e65ff024e7be7b46f08c6d1","unresolved":false,"context_lines":[{"line_number":125,"context_line":"    and Barbican does not encrpyt it, but end-users could use metadata to"},{"line_number":126,"context_line":"    store confidential information."},{"line_number":127,"context_line":"    does not encrypt it."},{"line_number":128,"context_line":"  - Availability Failure: Barbican unaffected"},{"line_number":129,"context_line":""},{"line_number":130,"context_line":"- *RBAC/ACL rulesets*:"},{"line_number":131,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a8bc5a2_5686c865","line":128,"range":{"start_line":128,"start_character":26,"end_line":128,"end_character":34},"updated":"2016-09-23 22:21:05.000000000","message":"nit: barbican","commit_id":"a1c38758816a09a18ee667e87aa66d4b4a86350a"},{"author":{"_account_id":18462,"name":"Rahul U Nair","email":"rahulunair@gmail.com","username":"rahulunair"},"change_message_id":"41da3c2b2eebc8326e65ff024e7be7b46f08c6d1","unresolved":false,"context_lines":[{"line_number":132,"context_line":"  - Integrity Failure Impact: Attacker with valid AuthN could be granted access"},{"line_number":133,"context_line":"    to any secret."},{"line_number":134,"context_line":"  - Confidentiality Failure Impact: Mappings between users and secrets"},{"line_number":135,"context_line":"  - Availability Failure Impact: Barbican will not start if the file is not"},{"line_number":136,"context_line":"    readable."},{"line_number":137,"context_line":""},{"line_number":138,"context_line":"- *DB Credentials*:"}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a8bc5a2_16b6003d","line":135,"range":{"start_line":135,"start_character":33,"end_line":135,"end_character":41},"updated":"2016-09-23 22:21:05.000000000","message":"nit: barbican","commit_id":"a1c38758816a09a18ee667e87aa66d4b4a86350a"},{"author":{"_account_id":18462,"name":"Rahul U Nair","email":"rahulunair@gmail.com","username":"rahulunair"},"change_message_id":"41da3c2b2eebc8326e65ff024e7be7b46f08c6d1","unresolved":false,"context_lines":[{"line_number":137,"context_line":""},{"line_number":138,"context_line":"- *DB Credentials*:"},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"  - Integrity Failure Impact: Barbican won\u0027t be able to access DB and fail to"},{"line_number":141,"context_line":"    start."},{"line_number":142,"context_line":"  - Confidentiality Failure Impact: ACLs could be abused to grant access to all"},{"line_number":143,"context_line":"    secrets for any Authenticated user (AuthZ failure). All Secrets could be"}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a8bc5a2_76a66411","line":140,"range":{"start_line":140,"start_character":30,"end_line":140,"end_character":38},"updated":"2016-09-23 22:21:05.000000000","message":"nit: babrican","commit_id":"a1c38758816a09a18ee667e87aa66d4b4a86350a"},{"author":{"_account_id":18462,"name":"Rahul U Nair","email":"rahulunair@gmail.com","username":"rahulunair"},"change_message_id":"41da3c2b2eebc8326e65ff024e7be7b46f08c6d1","unresolved":false,"context_lines":[{"line_number":142,"context_line":"  - Confidentiality Failure Impact: ACLs could be abused to grant access to all"},{"line_number":143,"context_line":"    secrets for any Authenticated user (AuthZ failure). All Secrets could be"},{"line_number":144,"context_line":"    deleted / mangled."},{"line_number":145,"context_line":"  - Availability Failure Impact: Barbican won\u0027t be able to access DB and fail"},{"line_number":146,"context_line":"    to start."},{"line_number":147,"context_line":""},{"line_number":148,"context_line":"- *HSM Credentials*:"}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a8bc5a2_369cdcbf","line":145,"range":{"start_line":145,"start_character":33,"end_line":145,"end_character":41},"updated":"2016-09-23 22:21:05.000000000","message":"nit: barbican","commit_id":"a1c38758816a09a18ee667e87aa66d4b4a86350a"},{"author":{"_account_id":18462,"name":"Rahul U Nair","email":"rahulunair@gmail.com","username":"rahulunair"},"change_message_id":"41da3c2b2eebc8326e65ff024e7be7b46f08c6d1","unresolved":false,"context_lines":[{"line_number":147,"context_line":""},{"line_number":148,"context_line":"- *HSM Credentials*:"},{"line_number":149,"context_line":""},{"line_number":150,"context_line":"  - Integrity Failure Impact: Barbican can no longer authenticate to HSM,"},{"line_number":151,"context_line":"    there is potential here to cause the HSM to purge on multiple reconnects."},{"line_number":152,"context_line":"  - Confidentiality Failure Impact:"},{"line_number":153,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a8bc5a2_f66354da","line":150,"range":{"start_line":150,"start_character":30,"end_line":150,"end_character":38},"updated":"2016-09-23 22:21:05.000000000","message":"nit: barbican","commit_id":"a1c38758816a09a18ee667e87aa66d4b4a86350a"},{"author":{"_account_id":18462,"name":"Rahul U Nair","email":"rahulunair@gmail.com","username":"rahulunair"},"change_message_id":"41da3c2b2eebc8326e65ff024e7be7b46f08c6d1","unresolved":false,"context_lines":[{"line_number":156,"context_line":"      secrets would be lost."},{"line_number":157,"context_line":"    - [KMIP] Attacker is able to retrieve all secrets from the HSM"},{"line_number":158,"context_line":""},{"line_number":159,"context_line":"  - Availability: Barbican won\u0027t be able to access HSM and will fail to CRUD"},{"line_number":160,"context_line":"    secrets in KMIP, unable to decrypt or encrypt secrets in PKCS#11."},{"line_number":161,"context_line":""},{"line_number":162,"context_line":"- *RabbitMQ Credentials*:"}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a8bc5a2_b669ccc0","line":159,"range":{"start_line":159,"start_character":18,"end_line":159,"end_character":26},"updated":"2016-09-23 22:21:05.000000000","message":"nit: barbican","commit_id":"a1c38758816a09a18ee667e87aa66d4b4a86350a"},{"author":{"_account_id":18462,"name":"Rahul U Nair","email":"rahulunair@gmail.com","username":"rahulunair"},"change_message_id":"41da3c2b2eebc8326e65ff024e7be7b46f08c6d1","unresolved":false,"context_lines":[{"line_number":161,"context_line":""},{"line_number":162,"context_line":"- *RabbitMQ Credentials*:"},{"line_number":163,"context_line":""},{"line_number":164,"context_line":"  - Integrity Failure Impact: Barbican and Workers can no longer access the"},{"line_number":165,"context_line":"    queue. Denial of service."},{"line_number":166,"context_line":"  - Confidentiality Failure Impact: An attacker could add new tasks to the"},{"line_number":167,"context_line":"    queue which would be executed by workers. User quotas could be exhausted by"}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a8bc5a2_766f44c5","line":164,"range":{"start_line":164,"start_character":30,"end_line":164,"end_character":38},"updated":"2016-09-23 22:21:05.000000000","message":"nit: barbican","commit_id":"a1c38758816a09a18ee667e87aa66d4b4a86350a"},{"author":{"_account_id":18462,"name":"Rahul U Nair","email":"rahulunair@gmail.com","username":"rahulunair"},"change_message_id":"41da3c2b2eebc8326e65ff024e7be7b46f08c6d1","unresolved":false,"context_lines":[{"line_number":169,"context_line":"  - Availability Failure Impact: Barbican could no longer create new secrets"},{"line_number":170,"context_line":"    without access to the queue."},{"line_number":171,"context_line":""},{"line_number":172,"context_line":"- *Keystone Event Queue Credentials [Including endpoint address]*:"},{"line_number":173,"context_line":""},{"line_number":174,"context_line":"  - Integrity Failure Impact: An attacker could setup their own queue, point"},{"line_number":175,"context_line":"    barbican to this rogue queue and by publishing events, delete all"}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a8bc5a2_3b7a05f2","line":172,"range":{"start_line":172,"start_character":3,"end_line":172,"end_character":11},"updated":"2016-09-23 22:21:05.000000000","message":"nit: Identity service (keystone)","commit_id":"a1c38758816a09a18ee667e87aa66d4b4a86350a"},{"author":{"_account_id":18462,"name":"Rahul U Nair","email":"rahulunair@gmail.com","username":"rahulunair"},"change_message_id":"41da3c2b2eebc8326e65ff024e7be7b46f08c6d1","unresolved":false,"context_lines":[{"line_number":175,"context_line":"    barbican to this rogue queue and by publishing events, delete all"},{"line_number":176,"context_line":"    users/projects/secrets in barbican. Additionally, typical DoS scenario"},{"line_number":177,"context_line":"    using incorrect credentials for the legitimate queue."},{"line_number":178,"context_line":"  - Confidentiality Failure Impact: Barbican should only be able to subscribe"},{"line_number":179,"context_line":"    to the event queue. An attacker with the credentials could create their own"},{"line_number":180,"context_line":"    subscriber meaning that legitimate events don\u0027t get consumed by barbican."},{"line_number":181,"context_line":"    Race condition?"}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a8bc5a2_bb037541","line":178,"range":{"start_line":178,"start_character":36,"end_line":178,"end_character":44},"updated":"2016-09-23 22:21:05.000000000","message":"nit: barbican","commit_id":"a1c38758816a09a18ee667e87aa66d4b4a86350a"},{"author":{"_account_id":18462,"name":"Rahul U Nair","email":"rahulunair@gmail.com","username":"rahulunair"},"change_message_id":"41da3c2b2eebc8326e65ff024e7be7b46f08c6d1","unresolved":false,"context_lines":[{"line_number":180,"context_line":"    subscriber meaning that legitimate events don\u0027t get consumed by barbican."},{"line_number":181,"context_line":"    Race condition?"},{"line_number":182,"context_line":"  - Availability Failure Impact: Projects might not get deleted when they"},{"line_number":183,"context_line":"    should be but the overall run state of Barbican is unaffected."},{"line_number":184,"context_line":""},{"line_number":185,"context_line":"- *Middleware Configuration*:"},{"line_number":186,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a8bc5a2_fbfdfd3a","line":183,"range":{"start_line":183,"start_character":43,"end_line":183,"end_character":51},"updated":"2016-09-23 22:21:05.000000000","message":"nit: barbican","commit_id":"a1c38758816a09a18ee667e87aa66d4b4a86350a"},{"author":{"_account_id":18462,"name":"Rahul U Nair","email":"rahulunair@gmail.com","username":"rahulunair"},"change_message_id":"41da3c2b2eebc8326e65ff024e7be7b46f08c6d1","unresolved":false,"context_lines":[{"line_number":184,"context_line":""},{"line_number":185,"context_line":"- *Middleware Configuration*:"},{"line_number":186,"context_line":""},{"line_number":187,"context_line":"  - Integrity Failure Impact: Can remove/replace Keystone auth middleware -"},{"line_number":188,"context_line":"    allows you to capture tokens and also could cause Barbican to fail open"},{"line_number":189,"context_line":"    (everything authorized). If Keystone Auth Middleware is deleted from"},{"line_number":190,"context_line":"    paste.ini, an attacker could add their own keystone headers to REST"}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a8bc5a2_3b9685f0","line":187,"range":{"start_line":187,"start_character":49,"end_line":187,"end_character":57},"updated":"2016-09-23 22:21:05.000000000","message":"nit: keystone","commit_id":"a1c38758816a09a18ee667e87aa66d4b4a86350a"},{"author":{"_account_id":18462,"name":"Rahul U Nair","email":"rahulunair@gmail.com","username":"rahulunair"},"change_message_id":"41da3c2b2eebc8326e65ff024e7be7b46f08c6d1","unresolved":false,"context_lines":[{"line_number":185,"context_line":"- *Middleware Configuration*:"},{"line_number":186,"context_line":""},{"line_number":187,"context_line":"  - Integrity Failure Impact: Can remove/replace Keystone auth middleware -"},{"line_number":188,"context_line":"    allows you to capture tokens and also could cause Barbican to fail open"},{"line_number":189,"context_line":"    (everything authorized). If Keystone Auth Middleware is deleted from"},{"line_number":190,"context_line":"    paste.ini, an attacker could add their own keystone headers to REST"},{"line_number":191,"context_line":"    requests and Barbican would interpret them as valid. If an attacker had"}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a8bc5a2_3675bc97","line":188,"range":{"start_line":188,"start_character":54,"end_line":188,"end_character":62},"updated":"2016-09-23 22:21:05.000000000","message":"nit: barbican","commit_id":"a1c38758816a09a18ee667e87aa66d4b4a86350a"},{"author":{"_account_id":18462,"name":"Rahul U Nair","email":"rahulunair@gmail.com","username":"rahulunair"},"change_message_id":"41da3c2b2eebc8326e65ff024e7be7b46f08c6d1","unresolved":false,"context_lines":[{"line_number":186,"context_line":""},{"line_number":187,"context_line":"  - Integrity Failure Impact: Can remove/replace Keystone auth middleware -"},{"line_number":188,"context_line":"    allows you to capture tokens and also could cause Barbican to fail open"},{"line_number":189,"context_line":"    (everything authorized). If Keystone Auth Middleware is deleted from"},{"line_number":190,"context_line":"    paste.ini, an attacker could add their own keystone headers to REST"},{"line_number":191,"context_line":"    requests and Barbican would interpret them as valid. If an attacker had"},{"line_number":192,"context_line":"    access to the filesystem they could inject their own middleware by dropping"}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a8bc5a2_7ba00d44","line":189,"range":{"start_line":189,"start_character":32,"end_line":189,"end_character":40},"updated":"2016-09-23 22:21:05.000000000","message":"keystone","commit_id":"a1c38758816a09a18ee667e87aa66d4b4a86350a"},{"author":{"_account_id":18462,"name":"Rahul U Nair","email":"rahulunair@gmail.com","username":"rahulunair"},"change_message_id":"41da3c2b2eebc8326e65ff024e7be7b46f08c6d1","unresolved":false,"context_lines":[{"line_number":186,"context_line":""},{"line_number":187,"context_line":"  - Integrity Failure Impact: Can remove/replace Keystone auth middleware -"},{"line_number":188,"context_line":"    allows you to capture tokens and also could cause Barbican to fail open"},{"line_number":189,"context_line":"    (everything authorized). If Keystone Auth Middleware is deleted from"},{"line_number":190,"context_line":"    paste.ini, an attacker could add their own keystone headers to REST"},{"line_number":191,"context_line":"    requests and Barbican would interpret them as valid. If an attacker had"},{"line_number":192,"context_line":"    access to the filesystem they could inject their own middleware by dropping"}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a8bc5a2_bb8a95bd","line":189,"range":{"start_line":189,"start_character":41,"end_line":189,"end_character":45},"updated":"2016-09-23 22:21:05.000000000","message":"nit: auth","commit_id":"a1c38758816a09a18ee667e87aa66d4b4a86350a"},{"author":{"_account_id":18462,"name":"Rahul U Nair","email":"rahulunair@gmail.com","username":"rahulunair"},"change_message_id":"41da3c2b2eebc8326e65ff024e7be7b46f08c6d1","unresolved":false,"context_lines":[{"line_number":186,"context_line":""},{"line_number":187,"context_line":"  - Integrity Failure Impact: Can remove/replace Keystone auth middleware -"},{"line_number":188,"context_line":"    allows you to capture tokens and also could cause Barbican to fail open"},{"line_number":189,"context_line":"    (everything authorized). If Keystone Auth Middleware is deleted from"},{"line_number":190,"context_line":"    paste.ini, an attacker could add their own keystone headers to REST"},{"line_number":191,"context_line":"    requests and Barbican would interpret them as valid. If an attacker had"},{"line_number":192,"context_line":"    access to the filesystem they could inject their own middleware by dropping"}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a8bc5a2_1b90e9eb","line":189,"range":{"start_line":189,"start_character":46,"end_line":189,"end_character":56},"updated":"2016-09-23 22:21:05.000000000","message":"nit: middleware","commit_id":"a1c38758816a09a18ee667e87aa66d4b4a86350a"},{"author":{"_account_id":18462,"name":"Rahul U Nair","email":"rahulunair@gmail.com","username":"rahulunair"},"change_message_id":"41da3c2b2eebc8326e65ff024e7be7b46f08c6d1","unresolved":false,"context_lines":[{"line_number":188,"context_line":"    allows you to capture tokens and also could cause Barbican to fail open"},{"line_number":189,"context_line":"    (everything authorized). If Keystone Auth Middleware is deleted from"},{"line_number":190,"context_line":"    paste.ini, an attacker could add their own keystone headers to REST"},{"line_number":191,"context_line":"    requests and Barbican would interpret them as valid. If an attacker had"},{"line_number":192,"context_line":"    access to the filesystem they could inject their own middleware by dropping"},{"line_number":193,"context_line":"    a class on the FS (in the python path) and directing paste.ini to use that."},{"line_number":194,"context_line":"  - Confidentiality Failure Impact: Minimal - an attacker can enumerate the"}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a8bc5a2_5bc0b1e0","line":191,"range":{"start_line":191,"start_character":17,"end_line":191,"end_character":25},"updated":"2016-09-23 22:21:05.000000000","message":"nit: barbican","commit_id":"a1c38758816a09a18ee667e87aa66d4b4a86350a"},{"author":{"_account_id":18462,"name":"Rahul U Nair","email":"rahulunair@gmail.com","username":"rahulunair"},"change_message_id":"41da3c2b2eebc8326e65ff024e7be7b46f08c6d1","unresolved":false,"context_lines":[{"line_number":190,"context_line":"    paste.ini, an attacker could add their own keystone headers to REST"},{"line_number":191,"context_line":"    requests and Barbican would interpret them as valid. If an attacker had"},{"line_number":192,"context_line":"    access to the filesystem they could inject their own middleware by dropping"},{"line_number":193,"context_line":"    a class on the FS (in the python path) and directing paste.ini to use that."},{"line_number":194,"context_line":"  - Confidentiality Failure Impact: Minimal - an attacker can enumerate the"},{"line_number":195,"context_line":"    middleware."},{"line_number":196,"context_line":"  - Availability Failure Impact: Barbican breaks"}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a8bc5a2_3b64c520","line":193,"range":{"start_line":193,"start_character":30,"end_line":193,"end_character":36},"updated":"2016-09-23 22:21:05.000000000","message":"nit: Python","commit_id":"a1c38758816a09a18ee667e87aa66d4b4a86350a"},{"author":{"_account_id":18462,"name":"Rahul U Nair","email":"rahulunair@gmail.com","username":"rahulunair"},"change_message_id":"41da3c2b2eebc8326e65ff024e7be7b46f08c6d1","unresolved":false,"context_lines":[{"line_number":193,"context_line":"    a class on the FS (in the python path) and directing paste.ini to use that."},{"line_number":194,"context_line":"  - Confidentiality Failure Impact: Minimal - an attacker can enumerate the"},{"line_number":195,"context_line":"    middleware."},{"line_number":196,"context_line":"  - Availability Failure Impact: Barbican breaks"},{"line_number":197,"context_line":""},{"line_number":198,"context_line":"- *PKCS#11 MKEK/HMAC*: - Stored un-retrievable in HSM"},{"line_number":199,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a8bc5a2_7b6e4d02","line":196,"range":{"start_line":196,"start_character":33,"end_line":196,"end_character":41},"updated":"2016-09-23 22:21:05.000000000","message":"nit: barbican","commit_id":"a1c38758816a09a18ee667e87aa66d4b4a86350a"},{"author":{"_account_id":18462,"name":"Rahul U Nair","email":"rahulunair@gmail.com","username":"rahulunair"},"change_message_id":"41da3c2b2eebc8326e65ff024e7be7b46f08c6d1","unresolved":false,"context_lines":[{"line_number":227,"context_line":""},{"line_number":228,"context_line":"- *Keystone Credentials*:"},{"line_number":229,"context_line":""},{"line_number":230,"context_line":"  - Integrity Failure Impact: Barbican will not be able to validate user"},{"line_number":231,"context_line":"    credentials and fail. DoS."},{"line_number":232,"context_line":"  - Confidentially Failure Impact: A malicious user might be able to abuse"},{"line_number":233,"context_line":"    other OpenStack services (depending on Keystone role configurations) but"}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a8bc5a2_9b3f99d5","line":230,"range":{"start_line":230,"start_character":30,"end_line":230,"end_character":38},"updated":"2016-09-23 22:21:05.000000000","message":"nit: barbican","commit_id":"a1c38758816a09a18ee667e87aa66d4b4a86350a"},{"author":{"_account_id":18462,"name":"Rahul U Nair","email":"rahulunair@gmail.com","username":"rahulunair"},"change_message_id":"41da3c2b2eebc8326e65ff024e7be7b46f08c6d1","unresolved":false,"context_lines":[{"line_number":231,"context_line":"    credentials and fail. DoS."},{"line_number":232,"context_line":"  - Confidentially Failure Impact: A malicious user might be able to abuse"},{"line_number":233,"context_line":"    other OpenStack services (depending on Keystone role configurations) but"},{"line_number":234,"context_line":"    Barbican is unaffected."},{"line_number":235,"context_line":"  - Availability Failure Impact: Barbican will not be able to validate user"},{"line_number":236,"context_line":"    credentials and fail. DoS."},{"line_number":237,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a8bc5a2_fb309d03","line":234,"range":{"start_line":234,"start_character":4,"end_line":234,"end_character":12},"updated":"2016-09-23 22:21:05.000000000","message":"nit: barbican","commit_id":"a1c38758816a09a18ee667e87aa66d4b4a86350a"},{"author":{"_account_id":18462,"name":"Rahul U Nair","email":"rahulunair@gmail.com","username":"rahulunair"},"change_message_id":"41da3c2b2eebc8326e65ff024e7be7b46f08c6d1","unresolved":false,"context_lines":[{"line_number":232,"context_line":"  - Confidentially Failure Impact: A malicious user might be able to abuse"},{"line_number":233,"context_line":"    other OpenStack services (depending on Keystone role configurations) but"},{"line_number":234,"context_line":"    Barbican is unaffected."},{"line_number":235,"context_line":"  - Availability Failure Impact: Barbican will not be able to validate user"},{"line_number":236,"context_line":"    credentials and fail. DoS."},{"line_number":237,"context_line":""},{"line_number":238,"context_line":"- *Client Keystone Token*:"}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a8bc5a2_3b192589","line":235,"range":{"start_line":235,"start_character":32,"end_line":235,"end_character":33},"updated":"2016-09-23 22:21:05.000000000","message":"nit: barbican","commit_id":"a1c38758816a09a18ee667e87aa66d4b4a86350a"},{"author":{"_account_id":18462,"name":"Rahul U Nair","email":"rahulunair@gmail.com","username":"rahulunair"},"change_message_id":"41da3c2b2eebc8326e65ff024e7be7b46f08c6d1","unresolved":false,"context_lines":[{"line_number":237,"context_line":""},{"line_number":238,"context_line":"- *Client Keystone Token*:"},{"line_number":239,"context_line":""},{"line_number":240,"context_line":"  - Integrity Failure Impact: Barbican will not be able to validate user"},{"line_number":241,"context_line":"    credentials and fail. DoS."},{"line_number":242,"context_line":"  - Confidentially Failure Impact: A malicious user might be able to abuse"},{"line_number":243,"context_line":"    OpenStack services including barbican. If the token had an admin scope then"}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a8bc5a2_7b13ad66","line":240,"range":{"start_line":240,"start_character":30,"end_line":240,"end_character":38},"updated":"2016-09-23 22:21:05.000000000","message":"nit: barbican","commit_id":"a1c38758816a09a18ee667e87aa66d4b4a86350a"},{"author":{"_account_id":18462,"name":"Rahul U Nair","email":"rahulunair@gmail.com","username":"rahulunair"},"change_message_id":"41da3c2b2eebc8326e65ff024e7be7b46f08c6d1","unresolved":false,"context_lines":[{"line_number":240,"context_line":"  - Integrity Failure Impact: Barbican will not be able to validate user"},{"line_number":241,"context_line":"    credentials and fail. DoS."},{"line_number":242,"context_line":"  - Confidentially Failure Impact: A malicious user might be able to abuse"},{"line_number":243,"context_line":"    OpenStack services including barbican. If the token had an admin scope then"},{"line_number":244,"context_line":"    an attacker may be able to subvert multiple cloud services. [Total fail]."},{"line_number":245,"context_line":"  - Availability Failure Impact: Not a persistent asset, provided and used at"},{"line_number":246,"context_line":"    the same time."}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a8bc5a2_bb0d3540","line":243,"range":{"start_line":243,"start_character":33,"end_line":243,"end_character":41},"updated":"2016-09-23 22:21:05.000000000","message":"nit: barbican","commit_id":"a1c38758816a09a18ee667e87aa66d4b4a86350a"},{"author":{"_account_id":18462,"name":"Rahul U Nair","email":"rahulunair@gmail.com","username":"rahulunair"},"change_message_id":"41da3c2b2eebc8326e65ff024e7be7b46f08c6d1","unresolved":false,"context_lines":[{"line_number":259,"context_line":""},{"line_number":260,"context_line":"   - Assets in flight: User Keystone Credentials, Plaintext Secrets, HTTP Verb,"},{"line_number":261,"context_line":"     Secret ID, Path"},{"line_number":262,"context_line":"   - Access to Keystone Credentials or Plaintext Secrets is considered a total"},{"line_number":263,"context_line":"     security failure of the system - this interface must have robust"},{"line_number":264,"context_line":"     confidentiality and integrity controls, i.e. TLS."},{"line_number":265,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a8bc5a2_b6146c44","line":262,"range":{"start_line":262,"start_character":24,"end_line":262,"end_character":35},"updated":"2016-09-23 22:21:05.000000000","message":"nit: credentials","commit_id":"a1c38758816a09a18ee667e87aa66d4b4a86350a"},{"author":{"_account_id":18462,"name":"Rahul U Nair","email":"rahulunair@gmail.com","username":"rahulunair"},"change_message_id":"41da3c2b2eebc8326e65ff024e7be7b46f08c6d1","unresolved":false,"context_lines":[{"line_number":259,"context_line":""},{"line_number":260,"context_line":"   - Assets in flight: User Keystone Credentials, Plaintext Secrets, HTTP Verb,"},{"line_number":261,"context_line":"     Secret ID, Path"},{"line_number":262,"context_line":"   - Access to Keystone Credentials or Plaintext Secrets is considered a total"},{"line_number":263,"context_line":"     security failure of the system - this interface must have robust"},{"line_number":264,"context_line":"     confidentiality and integrity controls, i.e. TLS."},{"line_number":265,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a8bc5a2_960db039","line":262,"range":{"start_line":262,"start_character":15,"end_line":262,"end_character":23},"updated":"2016-09-23 22:21:05.000000000","message":"nit: keystone","commit_id":"a1c38758816a09a18ee667e87aa66d4b4a86350a"},{"author":{"_account_id":18462,"name":"Rahul U Nair","email":"rahulunair@gmail.com","username":"rahulunair"},"change_message_id":"41da3c2b2eebc8326e65ff024e7be7b46f08c6d1","unresolved":false,"context_lines":[{"line_number":259,"context_line":""},{"line_number":260,"context_line":"   - Assets in flight: User Keystone Credentials, Plaintext Secrets, HTTP Verb,"},{"line_number":261,"context_line":"     Secret ID, Path"},{"line_number":262,"context_line":"   - Access to Keystone Credentials or Plaintext Secrets is considered a total"},{"line_number":263,"context_line":"     security failure of the system - this interface must have robust"},{"line_number":264,"context_line":"     confidentiality and integrity controls, i.e. TLS."},{"line_number":265,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a8bc5a2_161a806e","line":262,"range":{"start_line":262,"start_character":49,"end_line":262,"end_character":56},"updated":"2016-09-23 22:21:05.000000000","message":"nit: secrets","commit_id":"a1c38758816a09a18ee667e87aa66d4b4a86350a"},{"author":{"_account_id":18462,"name":"Rahul U Nair","email":"rahulunair@gmail.com","username":"rahulunair"},"change_message_id":"41da3c2b2eebc8326e65ff024e7be7b46f08c6d1","unresolved":false,"context_lines":[{"line_number":265,"context_line":""},{"line_number":266,"context_line":"2. Administrator-\u003eAPI Process *[TLS]*:"},{"line_number":267,"context_line":""},{"line_number":268,"context_line":"   - Assets in flight: Barbican Admin Keystone Credentials"},{"line_number":269,"context_line":"   - An attacker with access to the admin credentials can modify quotas,"},{"line_number":270,"context_line":"     expanding or reducing them for any user. This has potential availability"},{"line_number":271,"context_line":"     impact. DoS."}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a8bc5a2_1631a0ec","line":268,"range":{"start_line":268,"start_character":23,"end_line":268,"end_character":31},"updated":"2016-09-23 22:21:05.000000000","message":"nit: barbican","commit_id":"a1c38758816a09a18ee667e87aa66d4b4a86350a"},{"author":{"_account_id":18462,"name":"Rahul U Nair","email":"rahulunair@gmail.com","username":"rahulunair"},"change_message_id":"41da3c2b2eebc8326e65ff024e7be7b46f08c6d1","unresolved":false,"context_lines":[{"line_number":265,"context_line":""},{"line_number":266,"context_line":"2. Administrator-\u003eAPI Process *[TLS]*:"},{"line_number":267,"context_line":""},{"line_number":268,"context_line":"   - Assets in flight: Barbican Admin Keystone Credentials"},{"line_number":269,"context_line":"   - An attacker with access to the admin credentials can modify quotas,"},{"line_number":270,"context_line":"     expanding or reducing them for any user. This has potential availability"},{"line_number":271,"context_line":"     impact. DoS."}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a8bc5a2_b642ac3c","line":268,"range":{"start_line":268,"start_character":38,"end_line":268,"end_character":46},"updated":"2016-09-23 22:21:05.000000000","message":"nit: keystone","commit_id":"a1c38758816a09a18ee667e87aa66d4b4a86350a"}],"doc/source/artifacts/barbican/newton/review-findings.rst":[{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"5fdcb1a632f36a9966f9a14e98126dfb3baabcc3","unresolved":false,"context_lines":[{"line_number":27,"context_line":"Findings:"},{"line_number":28,"context_line":"---------"},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"1. Weak config file ACLs could be abused to grant access to all secrets"},{"line_number":31,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"- Risk: Weak file permissions on the RBAC/ACLs (policy.json) would allow any"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7a8ec9b2_09fcd53c","line":30,"updated":"2016-09-16 17:23:24.000000000","message":"I\u0027m not sure if two ideas have crossed over here or this is another issue but this is what I recall:\n\nBarbican has a feature that allows a one tenant to grant another one access to a secret. This is a fairly simple tenant mapping within the database. \n\nThe security model of the Barbican database is such that all cryptographic operations are performed in the HSM, the implication is that a confidentiality or integrity breach of the database will not directly result in secrets being compromised.\n\nHowever during review we identified that if an attacker was able to modify the ACL mapping, they could grant a tenant access to any/all secrets stored in the HSM. Once the mapping is manipulated the attacker could simply retreive secrets using the normal Barbican ReST API.","commit_id":"80e4c62c2ede84551bbfce7113f4b098aa21bb0d"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"e80e8479ec60535cca8b61d41dcb4e199d14da99","unresolved":false,"context_lines":[{"line_number":21,"context_line":""},{"line_number":22,"context_line":"- Architect: Douglas Mendizábal - redrobot"},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"- Security Reviewer: Robert Clark - hyakuei"},{"line_number":25,"context_line":""},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"Findings:"}],"source_content_type":"text/x-rst","patch_set":5,"id":"7a8ec9b2_e0d17624","line":24,"updated":"2016-09-16 19:28:38.000000000","message":"hyakuhei","commit_id":"fd5430d9d64ff315ed6710a9980ea6807c0a2abf"},{"author":{"_account_id":15515,"name":"Charles Neill","email":"charles.neill@rackspace.com","username":"cneill"},"change_message_id":"c6e45bfe9a2c89ddae9dca9abfbee227f5a7ce3f","unresolved":false,"context_lines":[{"line_number":31,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"- Risk: Barbican has a feature that allows a tenant to grant another tenant"},{"line_number":34,"context_line":"  access to a secret. This is controled via a simple tenant mapping within the"},{"line_number":35,"context_line":"  database. The security model of the Barbican database is such that all"},{"line_number":36,"context_line":"  cryptographic operations are performed in the HSM, so a confidentiality"},{"line_number":37,"context_line":"  or integrity breach of the database will not directly result in secrets being"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a8bc5a2_b594a637","line":34,"range":{"start_line":34,"start_character":30,"end_line":34,"end_character":39},"updated":"2016-09-22 20:07:42.000000000","message":"Nit: controlled","commit_id":"fd5430d9d64ff315ed6710a9980ea6807c0a2abf"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"e80e8479ec60535cca8b61d41dcb4e199d14da99","unresolved":false,"context_lines":[{"line_number":31,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"- Risk: Barbican has a feature that allows a tenant to grant another tenant"},{"line_number":34,"context_line":"  access to a secret. This is controled via a simple tenant mapping within the"},{"line_number":35,"context_line":"  database. The security model of the Barbican database is such that all"},{"line_number":36,"context_line":"  cryptographic operations are performed in the HSM, so a confidentiality"},{"line_number":37,"context_line":"  or integrity breach of the database will not directly result in secrets being"}],"source_content_type":"text/x-rst","patch_set":5,"id":"7a8ec9b2_e0fb3677","line":34,"updated":"2016-09-16 19:28:38.000000000","message":"possibly should say Barbican database just to be explicit","commit_id":"fd5430d9d64ff315ed6710a9980ea6807c0a2abf"},{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"2942a21ea3ec9c3341291114e58f16a0e84ce4b6","unresolved":false,"context_lines":[{"line_number":31,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"- Risk: Barbican has a feature that allows a tenant to grant another tenant"},{"line_number":34,"context_line":"  access to a secret. This is controled via a simple tenant mapping within the"},{"line_number":35,"context_line":"  database. The security model of the Barbican database is such that all"},{"line_number":36,"context_line":"  cryptographic operations are performed in the HSM, so a confidentiality"},{"line_number":37,"context_line":"  or integrity breach of the database will not directly result in secrets being"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a8bc5a2_ea7369e5","line":34,"range":{"start_line":34,"start_character":30,"end_line":34,"end_character":39},"in_reply_to":"5a8bc5a2_b594a637","updated":"2016-09-23 20:42:37.000000000","message":"Done","commit_id":"fd5430d9d64ff315ed6710a9980ea6807c0a2abf"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"e80e8479ec60535cca8b61d41dcb4e199d14da99","unresolved":false,"context_lines":[{"line_number":33,"context_line":"- Risk: Barbican has a feature that allows a tenant to grant another tenant"},{"line_number":34,"context_line":"  access to a secret. This is controled via a simple tenant mapping within the"},{"line_number":35,"context_line":"  database. The security model of the Barbican database is such that all"},{"line_number":36,"context_line":"  cryptographic operations are performed in the HSM, so a confidentiality"},{"line_number":37,"context_line":"  or integrity breach of the database will not directly result in secrets being"},{"line_number":38,"context_line":"  compromised. However if an attacker was able to modify the ACL mapping, they"},{"line_number":39,"context_line":"  could grant a tenant access to any/all secrets stored in the HSM. Once the"}],"source_content_type":"text/x-rst","patch_set":5,"id":"7a8ec9b2_20499ed0","line":36,"range":{"start_line":36,"start_character":53,"end_line":36,"end_character":55},"updated":"2016-09-16 19:28:38.000000000","message":"\"so\" isn\u0027t required","commit_id":"fd5430d9d64ff315ed6710a9980ea6807c0a2abf"},{"author":{"_account_id":15515,"name":"Charles Neill","email":"charles.neill@rackspace.com","username":"cneill"},"change_message_id":"c6e45bfe9a2c89ddae9dca9abfbee227f5a7ce3f","unresolved":false,"context_lines":[{"line_number":37,"context_line":"  or integrity breach of the database will not directly result in secrets being"},{"line_number":38,"context_line":"  compromised. However if an attacker was able to modify the ACL mapping, they"},{"line_number":39,"context_line":"  could grant a tenant access to any/all secrets stored in the HSM. Once the"},{"line_number":40,"context_line":"  mapping is manipulated the attacker could retreive secrets using the normal"},{"line_number":41,"context_line":"  Barbican API."},{"line_number":42,"context_line":"- Impact: All secrets stored in Barbican are exposed."},{"line_number":43,"context_line":"- Likelihood: Medium"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a8bc5a2_f59e2e55","line":40,"range":{"start_line":40,"start_character":44,"end_line":40,"end_character":52},"updated":"2016-09-22 20:07:42.000000000","message":"Nit: retrieve","commit_id":"fd5430d9d64ff315ed6710a9980ea6807c0a2abf"},{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"2942a21ea3ec9c3341291114e58f16a0e84ce4b6","unresolved":false,"context_lines":[{"line_number":37,"context_line":"  or integrity breach of the database will not directly result in secrets being"},{"line_number":38,"context_line":"  compromised. However if an attacker was able to modify the ACL mapping, they"},{"line_number":39,"context_line":"  could grant a tenant access to any/all secrets stored in the HSM. Once the"},{"line_number":40,"context_line":"  mapping is manipulated the attacker could retreive secrets using the normal"},{"line_number":41,"context_line":"  Barbican API."},{"line_number":42,"context_line":"- Impact: All secrets stored in Barbican are exposed."},{"line_number":43,"context_line":"- Likelihood: Medium"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a8bc5a2_0a833599","line":40,"range":{"start_line":40,"start_character":44,"end_line":40,"end_character":52},"in_reply_to":"5a8bc5a2_f59e2e55","updated":"2016-09-23 20:42:37.000000000","message":"Done","commit_id":"fd5430d9d64ff315ed6710a9980ea6807c0a2abf"},{"author":{"_account_id":18462,"name":"Rahul U Nair","email":"rahulunair@gmail.com","username":"rahulunair"},"change_message_id":"41da3c2b2eebc8326e65ff024e7be7b46f08c6d1","unresolved":false,"context_lines":[{"line_number":26,"context_line":"Findings:"},{"line_number":27,"context_line":"---------"},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"1. Modification of ACLs in Barbian database could compromise all secrets"},{"line_number":30,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":31,"context_line":"- Risk: Barbican has a feature that allows a tenant to grant another tenant"},{"line_number":32,"context_line":"  access to a secret. This is controlled via a simple tenant mapping within the"}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a8bc5a2_f66d1499","line":29,"range":{"start_line":29,"start_character":27,"end_line":29,"end_character":34},"updated":"2016-09-23 22:21:05.000000000","message":"nit: barbican","commit_id":"a1c38758816a09a18ee667e87aa66d4b4a86350a"},{"author":{"_account_id":18462,"name":"Rahul U Nair","email":"rahulunair@gmail.com","username":"rahulunair"},"change_message_id":"41da3c2b2eebc8326e65ff024e7be7b46f08c6d1","unresolved":false,"context_lines":[{"line_number":30,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":31,"context_line":"- Risk: Barbican has a feature that allows a tenant to grant another tenant"},{"line_number":32,"context_line":"  access to a secret. This is controlled via a simple tenant mapping within the"},{"line_number":33,"context_line":"  Barbican database. The security model of the Barbican database is such that"},{"line_number":34,"context_line":"  all cryptographic operations are performed in the HSM, a confidentiality"},{"line_number":35,"context_line":"  or integrity breach of the database will not directly result in secrets being"},{"line_number":36,"context_line":"  compromised. However if an attacker was able to modify the ACL mapping, they"}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a8bc5a2_1669a08b","line":33,"range":{"start_line":33,"start_character":47,"end_line":33,"end_character":55},"updated":"2016-09-23 22:21:05.000000000","message":"nit: barbican","commit_id":"a1c38758816a09a18ee667e87aa66d4b4a86350a"},{"author":{"_account_id":18462,"name":"Rahul U Nair","email":"rahulunair@gmail.com","username":"rahulunair"},"change_message_id":"41da3c2b2eebc8326e65ff024e7be7b46f08c6d1","unresolved":false,"context_lines":[{"line_number":30,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":31,"context_line":"- Risk: Barbican has a feature that allows a tenant to grant another tenant"},{"line_number":32,"context_line":"  access to a secret. This is controlled via a simple tenant mapping within the"},{"line_number":33,"context_line":"  Barbican database. The security model of the Barbican database is such that"},{"line_number":34,"context_line":"  all cryptographic operations are performed in the HSM, a confidentiality"},{"line_number":35,"context_line":"  or integrity breach of the database will not directly result in secrets being"},{"line_number":36,"context_line":"  compromised. However if an attacker was able to modify the ACL mapping, they"}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a8bc5a2_560968dc","line":33,"range":{"start_line":33,"start_character":2,"end_line":33,"end_character":10},"updated":"2016-09-23 22:21:05.000000000","message":"nit: barbican","commit_id":"a1c38758816a09a18ee667e87aa66d4b4a86350a"},{"author":{"_account_id":18462,"name":"Rahul U Nair","email":"rahulunair@gmail.com","username":"rahulunair"},"change_message_id":"41da3c2b2eebc8326e65ff024e7be7b46f08c6d1","unresolved":false,"context_lines":[{"line_number":36,"context_line":"  compromised. However if an attacker was able to modify the ACL mapping, they"},{"line_number":37,"context_line":"  could grant a tenant access to any/all secrets stored in the HSM. Once the"},{"line_number":38,"context_line":"  mapping is manipulated the attacker could retrieve secrets using the normal"},{"line_number":39,"context_line":"  Barbican API."},{"line_number":40,"context_line":"- Impact: All secrets stored in Barbican are exposed."},{"line_number":41,"context_line":"- Likelihood: Medium"},{"line_number":42,"context_line":"- Impact: High"}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a8bc5a2_d6f578cb","line":39,"range":{"start_line":39,"start_character":2,"end_line":39,"end_character":10},"updated":"2016-09-23 22:21:05.000000000","message":"nit: barbican","commit_id":"a1c38758816a09a18ee667e87aa66d4b4a86350a"},{"author":{"_account_id":18462,"name":"Rahul U Nair","email":"rahulunair@gmail.com","username":"rahulunair"},"change_message_id":"41da3c2b2eebc8326e65ff024e7be7b46f08c6d1","unresolved":false,"context_lines":[{"line_number":37,"context_line":"  could grant a tenant access to any/all secrets stored in the HSM. Once the"},{"line_number":38,"context_line":"  mapping is manipulated the attacker could retrieve secrets using the normal"},{"line_number":39,"context_line":"  Barbican API."},{"line_number":40,"context_line":"- Impact: All secrets stored in Barbican are exposed."},{"line_number":41,"context_line":"- Likelihood: Medium"},{"line_number":42,"context_line":"- Impact: High"},{"line_number":43,"context_line":"- Overall Risk Rating: High"}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a8bc5a2_962a102b","line":40,"range":{"start_line":40,"start_character":32,"end_line":40,"end_character":40},"updated":"2016-09-23 22:21:05.000000000","message":"nit: barbican","commit_id":"a1c38758816a09a18ee667e87aa66d4b4a86350a"},{"author":{"_account_id":18462,"name":"Rahul U Nair","email":"rahulunair@gmail.com","username":"rahulunair"},"change_message_id":"41da3c2b2eebc8326e65ff024e7be7b46f08c6d1","unresolved":false,"context_lines":[{"line_number":80,"context_line":""},{"line_number":81,"context_line":"4. Weak Keystone credentials could result in loss of barbican users/secrets."},{"line_number":82,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":83,"context_line":"- Risk: An integrity failure of the Keystone event queue credentials could"},{"line_number":84,"context_line":"  allow an attacker to point barbican at a keystone event queue controlled by"},{"line_number":85,"context_line":"  the attacker, the attacker could then publish events triggering deletion of"},{"line_number":86,"context_line":"  all users/projects/secrets in barbican."}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a8bc5a2_96e13001","line":83,"range":{"start_line":83,"start_character":36,"end_line":83,"end_character":44},"updated":"2016-09-23 22:21:05.000000000","message":"nit: keystone","commit_id":"a1c38758816a09a18ee667e87aa66d4b4a86350a"},{"author":{"_account_id":18462,"name":"Rahul U Nair","email":"rahulunair@gmail.com","username":"rahulunair"},"change_message_id":"41da3c2b2eebc8326e65ff024e7be7b46f08c6d1","unresolved":false,"context_lines":[{"line_number":98,"context_line":"5. Compromise of PKCS#11 MKEK/HMAC backup could cause compromise of all secrets"},{"line_number":99,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":100,"context_line":"- Risk: Loss of confidentiality of the PKCS#11 MKEK/HMAC backup could allow an"},{"line_number":101,"context_line":"  attacker to decrypt all secrets in the Barbican database."},{"line_number":102,"context_line":"- Impact: Compromise of all secrets"},{"line_number":103,"context_line":"- Likelihood: Low"},{"line_number":104,"context_line":"- Impact: High"}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a8bc5a2_36bbfce6","line":101,"range":{"start_line":101,"start_character":41,"end_line":101,"end_character":49},"updated":"2016-09-23 22:21:05.000000000","message":"nit: barbican","commit_id":"a1c38758816a09a18ee667e87aa66d4b4a86350a"},{"author":{"_account_id":18462,"name":"Rahul U Nair","email":"rahulunair@gmail.com","username":"rahulunair"},"change_message_id":"41da3c2b2eebc8326e65ff024e7be7b46f08c6d1","unresolved":false,"context_lines":[{"line_number":119,"context_line":""},{"line_number":120,"context_line":"2. Document metadata useage"},{"line_number":121,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":122,"context_line":"- Recommendation: Barbican metadata is not encrpyted, but users could store"},{"line_number":123,"context_line":"  confidential data there. Barbican documentation should highlight this to"},{"line_number":124,"context_line":"  users."}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a8bc5a2_96af7093","line":122,"range":{"start_line":122,"start_character":18,"end_line":122,"end_character":26},"updated":"2016-09-23 22:21:05.000000000","message":"nit: barbican","commit_id":"a1c38758816a09a18ee667e87aa66d4b4a86350a"},{"author":{"_account_id":18462,"name":"Rahul U Nair","email":"rahulunair@gmail.com","username":"rahulunair"},"change_message_id":"41da3c2b2eebc8326e65ff024e7be7b46f08c6d1","unresolved":false,"context_lines":[{"line_number":120,"context_line":"2. Document metadata useage"},{"line_number":121,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":122,"context_line":"- Recommendation: Barbican metadata is not encrpyted, but users could store"},{"line_number":123,"context_line":"  confidential data there. Barbican documentation should highlight this to"},{"line_number":124,"context_line":"  users."}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a8bc5a2_d6cad86d","line":123,"range":{"start_line":123,"start_character":27,"end_line":123,"end_character":35},"updated":"2016-09-23 22:21:05.000000000","message":"nit: barbican","commit_id":"a1c38758816a09a18ee667e87aa66d4b4a86350a"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"74f765c65cf60c3b1777dcb27b277f8b5fe70886","unresolved":false,"context_lines":[{"line_number":20,"context_line":""},{"line_number":21,"context_line":"- Architect: Douglas Mendizábal - redrobot"},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"- Security Reviewer: Robert Clark - hyakuhei"},{"line_number":24,"context_line":""},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"Findings:"}],"source_content_type":"text/x-rst","patch_set":11,"id":"1a95cdbc_0b60a900","line":23,"updated":"2016-10-06 11:04:14.000000000","message":"I think Doug Chivers should have credit here also","commit_id":"8219232244b387368ce94dd2b9e66d5d1fbb9458"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"74f765c65cf60c3b1777dcb27b277f8b5fe70886","unresolved":false,"context_lines":[{"line_number":26,"context_line":"Findings:"},{"line_number":27,"context_line":"---------"},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"1. Modification of ACLs in Barbian database could compromise all secrets"},{"line_number":30,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":31,"context_line":"- Risk: barbican has a feature that allows a tenant to grant another tenant"},{"line_number":32,"context_line":"  access to a secret. This is controlled via a simple tenant mapping within the"}],"source_content_type":"text/x-rst","patch_set":11,"id":"1a95cdbc_4b31d104","line":29,"updated":"2016-10-06 11:04:14.000000000","message":"seems to be lower case \u0027barbican\u0027 in other places","commit_id":"8219232244b387368ce94dd2b9e66d5d1fbb9458"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"74f765c65cf60c3b1777dcb27b277f8b5fe70886","unresolved":false,"context_lines":[{"line_number":29,"context_line":"1. Modification of ACLs in Barbian database could compromise all secrets"},{"line_number":30,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":31,"context_line":"- Risk: barbican has a feature that allows a tenant to grant another tenant"},{"line_number":32,"context_line":"  access to a secret. This is controlled via a simple tenant mapping within the"},{"line_number":33,"context_line":"  barbican database. The security model of the barbican database is such that"},{"line_number":34,"context_line":"  all cryptographic operations are performed in the HSM, a confidentiality"},{"line_number":35,"context_line":"  or integrity breach of the database will not directly result in secrets being"}],"source_content_type":"text/x-rst","patch_set":11,"id":"1a95cdbc_cb132165","line":32,"updated":"2016-10-06 11:04:14.000000000","message":"mapping table?","commit_id":"8219232244b387368ce94dd2b9e66d5d1fbb9458"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"74f765c65cf60c3b1777dcb27b277f8b5fe70886","unresolved":false,"context_lines":[{"line_number":29,"context_line":"1. Modification of ACLs in Barbian database could compromise all secrets"},{"line_number":30,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":31,"context_line":"- Risk: barbican has a feature that allows a tenant to grant another tenant"},{"line_number":32,"context_line":"  access to a secret. This is controlled via a simple tenant mapping within the"},{"line_number":33,"context_line":"  barbican database. The security model of the barbican database is such that"},{"line_number":34,"context_line":"  all cryptographic operations are performed in the HSM, a confidentiality"},{"line_number":35,"context_line":"  or integrity breach of the database will not directly result in secrets being"}],"source_content_type":"text/x-rst","patch_set":11,"id":"1a95cdbc_86003003","line":32,"range":{"start_line":32,"start_character":47,"end_line":32,"end_character":53},"updated":"2016-10-06 11:04:14.000000000","message":"s/simple//","commit_id":"8219232244b387368ce94dd2b9e66d5d1fbb9458"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"74f765c65cf60c3b1777dcb27b277f8b5fe70886","unresolved":false,"context_lines":[{"line_number":32,"context_line":"  access to a secret. This is controlled via a simple tenant mapping within the"},{"line_number":33,"context_line":"  barbican database. The security model of the barbican database is such that"},{"line_number":34,"context_line":"  all cryptographic operations are performed in the HSM, a confidentiality"},{"line_number":35,"context_line":"  or integrity breach of the database will not directly result in secrets being"},{"line_number":36,"context_line":"  compromised. However if an attacker was able to modify the ACL mapping, they"},{"line_number":37,"context_line":"  could grant a tenant access to any/all secrets stored in the HSM. Once the"},{"line_number":38,"context_line":"  mapping is manipulated the attacker could retrieve secrets using the normal"}],"source_content_type":"text/x-rst","patch_set":11,"id":"1a95cdbc_e62494b0","line":35,"range":{"start_line":35,"start_character":38,"end_line":35,"end_character":42},"updated":"2016-10-06 11:04:14.000000000","message":"should?","commit_id":"8219232244b387368ce94dd2b9e66d5d1fbb9458"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"74f765c65cf60c3b1777dcb27b277f8b5fe70886","unresolved":false,"context_lines":[{"line_number":30,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":31,"context_line":"- Risk: barbican has a feature that allows a tenant to grant another tenant"},{"line_number":32,"context_line":"  access to a secret. This is controlled via a simple tenant mapping within the"},{"line_number":33,"context_line":"  barbican database. The security model of the barbican database is such that"},{"line_number":34,"context_line":"  all cryptographic operations are performed in the HSM, a confidentiality"},{"line_number":35,"context_line":"  or integrity breach of the database will not directly result in secrets being"},{"line_number":36,"context_line":"  compromised. However if an attacker was able to modify the ACL mapping, they"},{"line_number":37,"context_line":"  could grant a tenant access to any/all secrets stored in the HSM. Once the"},{"line_number":38,"context_line":"  mapping is manipulated the attacker could retrieve secrets using the normal"},{"line_number":39,"context_line":"  barbican API."}],"source_content_type":"text/x-rst","patch_set":11,"id":"1a95cdbc_e65bb42c","line":36,"range":{"start_line":33,"start_character":21,"end_line":36,"end_character":14},"updated":"2016-10-06 11:04:14.000000000","message":"So the problem here is that the model is broken. I\u0027d probably say something like:\n\nThe implied security model of the Barbican database (when running with PKCS#11) is that all cryptographic operations....","commit_id":"8219232244b387368ce94dd2b9e66d5d1fbb9458"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"74f765c65cf60c3b1777dcb27b277f8b5fe70886","unresolved":false,"context_lines":[{"line_number":38,"context_line":"  mapping is manipulated the attacker could retrieve secrets using the normal"},{"line_number":39,"context_line":"  barbican API."},{"line_number":40,"context_line":"- Impact: All secrets stored in barbican are exposed."},{"line_number":41,"context_line":"- Likelihood: Medium"},{"line_number":42,"context_line":"- Impact: High"},{"line_number":43,"context_line":"- Overall Risk Rating: High"},{"line_number":44,"context_line":"- Bug: \u003clink to launchpad bug for this finding\u003e"}],"source_content_type":"text/x-rst","patch_set":11,"id":"1a95cdbc_066a60b3","line":41,"updated":"2016-10-06 11:04:14.000000000","message":"These will always be finger in the air...","commit_id":"8219232244b387368ce94dd2b9e66d5d1fbb9458"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"74f765c65cf60c3b1777dcb27b277f8b5fe70886","unresolved":false,"context_lines":[{"line_number":48,"context_line":""},{"line_number":49,"context_line":"2. Misconfigured HSM credential could cause DoS via HSM auto-purge"},{"line_number":50,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":51,"context_line":"- Risk: A misconfigured or tampered barbican hardware security module (HSM)"},{"line_number":52,"context_line":"  credential could cause a denial-of-service of barbican (and potentially other"},{"line_number":53,"context_line":"  services using the HSM if it is shared), if the HSM is configured to purge"},{"line_number":54,"context_line":"  after a number of failed connection attempts."}],"source_content_type":"text/x-rst","patch_set":11,"id":"1a95cdbc_c6f4f8f3","line":51,"updated":"2016-10-06 11:04:14.000000000","message":"This is an interesting one. Tampering implies access to the credentials.\n\nNow I realise that not all access is created equal and here we are discussing an integrity failure. That could be a blind integrity failure i.e Write Only.\n\nWe don\u0027t however have a similar finding for a confidentiality failure for this credential. Should we?","commit_id":"8219232244b387368ce94dd2b9e66d5d1fbb9458"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"a1d5d7ec2a8af5be6975c8395d6232ea50ce7fc1","unresolved":false,"context_lines":[{"line_number":66,"context_line":"  period or auto backoff to barbican connection attempts to allow a SOC time"},{"line_number":67,"context_line":"  to respond."},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"3. Compromised HSM credential lets attacker access all secrets (KMIP only)"},{"line_number":70,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":71,"context_line":"- Risk: When using KMIP to connect barbican to a HSM, a compromised HSM"},{"line_number":72,"context_line":"  credential allows an attacker to access all secrets stored in the HSM."}],"source_content_type":"text/x-rst","patch_set":12,"id":"1a95cdbc_d931ada3","line":69,"updated":"2016-10-10 15:39:39.000000000","message":"I\u0027m not sure we should have this finding as KMIP was out of scope? Or at least be explicit in the Risk description, not everyone will recognise that KMIP !\u003d PKCS#11.\n\nRisk: Although this review focusses on PKCS#11 barbican deployments, the following KMIP finding was discovered during review and is included here for completeness.\n\nWhen using KMIP to connect barbican to a HSM....","commit_id":"4ce5884a7ab6760d10dd49ee9c720d587d4660bb"}]}