)]}'
{"security-guide/section_introduction-to-ssl-tls.xml":[{"author":{"_account_id":2807,"name":"Bryan D. Payne","email":"bdpayne@acm.org","username":"bdpayne"},"change_message_id":"b192dddb469d8c3694cf4db526a048dbab035aa6","unresolved":false,"context_lines":[{"line_number":67,"context_line":"    \u003c/section\u003e"},{"line_number":68,"context_line":"    \u003csection xml:id\u003d\"introduction-to-ssl-tls-cryptographic-algorithms-cipher-modes-and-protocols\"\u003e"},{"line_number":69,"context_line":"      \u003ctitle\u003eCryptographic algorithms, cipher modes, and protocols\u003c/title\u003e"},{"line_number":70,"context_line":"      \u003cpara\u003eWe recommend only using v1.2. TLSv1.0 may be used for"},{"line_number":71,"context_line":"broad client compatibility but we recommend using caution and only enabling"},{"line_number":72,"context_line":"this protocol if you have a strong requirement to do so. Other SSL/TLS versions, explicitly"},{"line_number":73,"context_line":"older versions, should not be used. These older versions include SSLv1 and"}],"source_content_type":"application/xml","patch_set":2,"id":"5a890539_bc3e9a27","line":70,"updated":"2014-11-20 17:23:29.000000000","message":"Please make this explicit \"TLSv1.2\".\n\nThe next sentence should begin with \"TLSv1.0 and TLSv1.1...\"","commit_id":"4053743872da9eb347a11cd16e3fac7ce044ebf4"},{"author":{"_account_id":2807,"name":"Bryan D. Payne","email":"bdpayne@acm.org","username":"bdpayne"},"change_message_id":"b192dddb469d8c3694cf4db526a048dbab035aa6","unresolved":false,"context_lines":[{"line_number":69,"context_line":"      \u003ctitle\u003eCryptographic algorithms, cipher modes, and protocols\u003c/title\u003e"},{"line_number":70,"context_line":"      \u003cpara\u003eWe recommend only using v1.2. TLSv1.0 may be used for"},{"line_number":71,"context_line":"broad client compatibility but we recommend using caution and only enabling"},{"line_number":72,"context_line":"this protocol if you have a strong requirement to do so. Other SSL/TLS versions, explicitly"},{"line_number":73,"context_line":"older versions, should not be used. These older versions include SSLv1 and"},{"line_number":74,"context_line":"SSLv2, and SSLv3 which suffers from the attack known as POODLE."},{"line_number":75,"context_line":"When using TLS v1.2 the cipher suite should be limited to \u003cliteral\u003eECDHE-ECDSA-AES256-GCM-SHA384\u003c/literal\u003e,"}],"source_content_type":"application/xml","patch_set":2,"id":"5a890539_9cd47ebe","line":72,"updated":"2014-11-20 17:23:29.000000000","message":"This then becomes \"these protocols\".","commit_id":"4053743872da9eb347a11cd16e3fac7ce044ebf4"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"29607269e807568b77165d20062b7d2e921117d1","unresolved":false,"context_lines":[{"line_number":71,"context_line":"broad client compatibility but we recommend using caution and only enabling"},{"line_number":72,"context_line":"this protocol if you have a strong requirement to do so. Other SSL/TLS versions, explicitly"},{"line_number":73,"context_line":"older versions, should not be used. These older versions include SSLv1 and"},{"line_number":74,"context_line":"SSLv2, and SSLv3 which suffers from the attack known as POODLE."},{"line_number":75,"context_line":"When using TLS v1.2 the cipher suite should be limited to \u003cliteral\u003eECDHE-ECDSA-AES256-GCM-SHA384\u003c/literal\u003e,"},{"line_number":76,"context_line":" and for TLS v1+ \u003cliteral\u003eHIGH:!aNULL:!eNULL:!DES:!3DES\u003c/literal\u003e is a"},{"line_number":77,"context_line":"reasonable selection.\u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":2,"id":"5a890539_f1da1be8","line":74,"updated":"2014-11-20 11:54:44.000000000","message":"include SSLv1, SSLv2, and SSLv3...","commit_id":"4053743872da9eb347a11cd16e3fac7ce044ebf4"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"2f925941a8f3c7c1062fe06329301695864e00c0","unresolved":false,"context_lines":[{"line_number":73,"context_line":"older versions, should not be used. These older versions include SSLv1 and"},{"line_number":74,"context_line":"SSLv2, and SSLv3 which suffers from the attack known as POODLE."},{"line_number":75,"context_line":"When using TLS v1.2 the cipher suite should be limited to \u003cliteral\u003eECDHE-ECDSA-AES256-GCM-SHA384\u003c/literal\u003e,"},{"line_number":76,"context_line":" and for TLS v1+ \u003cliteral\u003eHIGH:!aNULL:!eNULL:!DES:!3DES\u003c/literal\u003e is a"},{"line_number":77,"context_line":"reasonable selection.\u003c/para\u003e"},{"line_number":78,"context_line":"\u003cpara\u003e"},{"line_number":79,"context_line":"As this book does not intend to be a thorough reference on cryptography we do"}],"source_content_type":"application/xml","patch_set":2,"id":"5a890539_19f2739a","line":76,"updated":"2014-11-20 09:07:57.000000000","message":"Why so prescriptive for 1.2 but not 1.0 ?","commit_id":"4053743872da9eb347a11cd16e3fac7ce044ebf4"},{"author":{"_account_id":612,"name":"Tom Fifield","email":"tom@openstack.org","username":"fifieldt"},"change_message_id":"f1e16e1f18aa9a0da990c14423f19d062b0a2751","unresolved":false,"context_lines":[{"line_number":73,"context_line":"older versions, should not be used. These older versions include SSLv1 and"},{"line_number":74,"context_line":"SSLv2, and SSLv3 which suffers from the attack known as POODLE."},{"line_number":75,"context_line":"When using TLS v1.2 the cipher suite should be limited to \u003cliteral\u003eECDHE-ECDSA-AES256-GCM-SHA384\u003c/literal\u003e,"},{"line_number":76,"context_line":" and for TLS v1+ \u003cliteral\u003eHIGH:!aNULL:!eNULL:!DES:!3DES\u003c/literal\u003e is a"},{"line_number":77,"context_line":"reasonable selection.\u003c/para\u003e"},{"line_number":78,"context_line":"\u003cpara\u003e"},{"line_number":79,"context_line":"As this book does not intend to be a thorough reference on cryptography we do"}],"source_content_type":"application/xml","patch_set":2,"id":"5a890539_bff69ff7","line":76,"in_reply_to":"5a890539_19f2739a","updated":"2014-11-20 10:06:36.000000000","message":"I was just trying to copy the style from the bug report, which seemed more \"sure\" about the former, but only said the latter should \"probably\" be . Happy to change to anything :)","commit_id":"4053743872da9eb347a11cd16e3fac7ce044ebf4"},{"author":{"_account_id":2807,"name":"Bryan D. Payne","email":"bdpayne@acm.org","username":"bdpayne"},"change_message_id":"b192dddb469d8c3694cf4db526a048dbab035aa6","unresolved":false,"context_lines":[{"line_number":73,"context_line":"older versions, should not be used. These older versions include SSLv1 and"},{"line_number":74,"context_line":"SSLv2, and SSLv3 which suffers from the attack known as POODLE."},{"line_number":75,"context_line":"When using TLS v1.2 the cipher suite should be limited to \u003cliteral\u003eECDHE-ECDSA-AES256-GCM-SHA384\u003c/literal\u003e,"},{"line_number":76,"context_line":" and for TLS v1+ \u003cliteral\u003eHIGH:!aNULL:!eNULL:!DES:!3DES\u003c/literal\u003e is a"},{"line_number":77,"context_line":"reasonable selection.\u003c/para\u003e"},{"line_number":78,"context_line":"\u003cpara\u003e"},{"line_number":79,"context_line":"As this book does not intend to be a thorough reference on cryptography we do"}],"source_content_type":"application/xml","patch_set":2,"id":"5a890539_7c443274","line":76,"in_reply_to":"5a890539_bff69ff7","updated":"2014-11-20 17:23:29.000000000","message":"The idea here is that we recommend that specific cipher suite _if and only if_ you control both the client and the server.  Otherwise you\u0027ll run into all kinds of trouble.  If you only control the server, then the more general cipher suite is recommended.  I believe the specific cipher suite mentioned there will only work with TLS 1.2.  But if you control both ends, you should be using TLS 1.2 anyway.  Hopefully this clears it up a bit.  I think that the proposes text here needs a little more clarification on that point (as does, perhaps, the ticket I wrote!).","commit_id":"4053743872da9eb347a11cd16e3fac7ce044ebf4"},{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"68b14e9be5e53495e3f9054392821fe78cbbf271","unresolved":false,"context_lines":[{"line_number":6,"context_line":"  xml:id\u003d\"introduction-to-ssl-tls\"\u003e"},{"line_number":7,"context_line":"  \u003c?dbhtml stop-chunking?\u003e"},{"line_number":8,"context_line":"    \u003ctitle\u003eIntroduction to SSL/TLS\u003c/title\u003e"},{"line_number":9,"context_line":"    \u003cpara\u003eOpenStack services receive requests on behalf of users on public networks as well as from other internal services over management networks. Inter-service communications can also occur over public networks depending on deployment and architecture choices.\u003c/para\u003e"},{"line_number":10,"context_line":"    \u003cpara\u003eWhile it is commonly accepted that data over public networks should be secured using cryptographic measures, such as Secure Sockets Layer or Transport Layer Security (SSL/TLS) protocols, it is insufficient to rely on security domain separation to protect internal traffic. Using a security-in-depth approach, we recommend securing all domains with SSL/TLS, including the management domain services. It is important that should a tenant escape their VM isolation and gain access to the hypervisor or host resources, compromise an API endpoint, or any other service, they must not be able to easily inject or capture messages, commands, or otherwise affect or control management capabilities of the cloud. SSL/TLS provides the mechanisms to ensure authentication, non-repudiation, confidentiality, and integrity of user communications to the OpenStack services and between the OpenStack services themselves.\u003c/para\u003e"},{"line_number":11,"context_line":"    \u003cpara\u003e"},{"line_number":12,"context_line":"      Public Key Infrastructure (PKI) is a set of hardware, software,"}],"source_content_type":"application/xml","patch_set":3,"id":"5a890539_4a1dc065","line":9,"updated":"2014-11-21 15:15:38.000000000","message":"Suggest rephrasing the introduction to exclude SSL too. \n\nFor example:\n\u003cpara\u003eWhile it is commonly accepted that data over public networks should be secured using cryptographic measures, such as Transport Layer Security (TLS) protocols, it is insufficient to rely on security domain separation to protect internal traffic. Using a security-in-depth approach, we recommend securing all domains with TLS, including the management domain services. It is important that should a tenant escape their VM isolation and gain access to the hypervisor or host resources, compromise an API endpoint, or any other service, they must not be able to easily inject or capture messages, commands, or otherwise affect or control management capabilities of the cloud. TLS provides the mechanisms to ensure authentication, non-repudiation, confidentiality, and integrity of user communications to the OpenStack services and between the OpenStack services themselves.\u003c/para\u003e\n\u003cpara\u003eDue to the published vulnerabilities in the Secure Sockets Layer (SSL) protocols, we strongly recommend that TLS is used in preference to SSL, and that SSL is disabled in all cases, unless compatibility with obsolete browsers/libraries is required.\u003c/para\u003e","commit_id":"7792e0e0d0b632ef10338b34bef2d26b7e9f1549"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"ed547e63e7a71e7c7a82e98bc15e09f48b35a6f0","unresolved":false,"context_lines":[{"line_number":69,"context_line":"      \u003ctitle\u003eCryptographic algorithms, cipher modes, and protocols\u003c/title\u003e"},{"line_number":70,"context_line":"      \u003cpara\u003eWe recommend only using TLSv1.2. TLSv1.0 and TLSv1.1 may be used for"},{"line_number":71,"context_line":"broad client compatibility but we recommend using caution and only enabling"},{"line_number":72,"context_line":"these protocol if you have a strong requirement to do so. Other SSL/TLS versions, explicitly"},{"line_number":73,"context_line":"older versions, should not be used. These older versions include SSLv1,"},{"line_number":74,"context_line":"SSLv2, and SSLv3 which suffers from the attack known as POODLE."},{"line_number":75,"context_line":"When using TLS v1.2 and in control of both the clients and the server,"}],"source_content_type":"application/xml","patch_set":3,"id":"5a890539_867c0eb7","line":72,"updated":"2014-11-21 11:24:25.000000000","message":"plural now: protocols","commit_id":"7792e0e0d0b632ef10338b34bef2d26b7e9f1549"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"ed547e63e7a71e7c7a82e98bc15e09f48b35a6f0","unresolved":false,"context_lines":[{"line_number":71,"context_line":"broad client compatibility but we recommend using caution and only enabling"},{"line_number":72,"context_line":"these protocol if you have a strong requirement to do so. Other SSL/TLS versions, explicitly"},{"line_number":73,"context_line":"older versions, should not be used. These older versions include SSLv1,"},{"line_number":74,"context_line":"SSLv2, and SSLv3 which suffers from the attack known as POODLE."},{"line_number":75,"context_line":"When using TLS v1.2 and in control of both the clients and the server,"},{"line_number":76,"context_line":"the cipher suite should be limited to \u003cliteral\u003eECDHE-ECDSA-AES256-GCM-SHA384\u003c/literal\u003e."},{"line_number":77,"context_line":"Where you don\u0027t control both ends and are using TLS v1+, the more general"}],"source_content_type":"application/xml","patch_set":3,"id":"5a890539_66580257","line":74,"updated":"2014-11-21 11:24:25.000000000","message":"plural: suffer","commit_id":"7792e0e0d0b632ef10338b34bef2d26b7e9f1549"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"327a98db3c1146e6e7317811fe320f5f30ebf6a8","unresolved":false,"context_lines":[{"line_number":67,"context_line":"    \u003c/section\u003e"},{"line_number":68,"context_line":"    \u003csection xml:id\u003d\"introduction-to-ssl-tls-cryptographic-algorithms-cipher-modes-and-protocols\"\u003e"},{"line_number":69,"context_line":"      \u003ctitle\u003eCryptographic algorithms, cipher modes, and protocols\u003c/title\u003e"},{"line_number":70,"context_line":"      \u003cpara\u003eWe recommend only using TLSv1.2. TLSv1.0 and TLSv1.1 may be used for broad client compatibility but we recommend using caution and only enabling these protocols if you have a strong requirement to do so. Other SSL/TLS versions, explicitly older versions, should not be used. These older versions include SSLv2 which is deprecated, and SSLv3 which suffers from the attack known as POODLE. When using TLS v1.2 and in control of both the clients and the server, the cipher suite should be limited to \u003cliteral\u003eECDHE-ECDSA-AES256-GCM-SHA384\u003c/literal\u003e. Where you don\u0027t control both ends and are using TLS v1+, the more general \u003cliteral\u003eHIGH:!aNULL:!eNULL:!DES:!3DES\u003c/literal\u003e is a reasonable cipher selection.\u003c/para\u003e "},{"line_number":71,"context_line":"      \u003cpara\u003eHowever, as this book does not intend to be a thorough reference on cryptography we do not wish to be prescriptive about what specific algorithms or cipher modes you should enable or disable in your OpenStack services. However, there are some authoritative references we would like to recommend for further information:\u003c/para\u003e"},{"line_number":72,"context_line":"      \u003citemizedlist\u003e\u003clistitem\u003e"},{"line_number":73,"context_line":"          \u003cpara\u003e\u003clink xlink:href\u003d\"http://www.nsa.gov/ia/programs/suiteb_cryptography/index.shtml\"\u003eNational Security Agency, Suite B Cryptography\u003c/link\u003e\u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":4,"id":"5a890539_5e146fe8","line":70,"updated":"2014-11-24 19:10:44.000000000","message":"Extra space at EOL - please remove. This will fail  the niceness gate\n\nPlease do not write lines that are longer than 78 chars.","commit_id":"305178c094a6c629e30ffa050b557ed6d7d879a8"},{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"d80f7bea6d08faca93c1f5e4a0be88df88c633a7","unresolved":false,"context_lines":[{"line_number":67,"context_line":"    \u003c/section\u003e"},{"line_number":68,"context_line":"    \u003csection xml:id\u003d\"introduction-to-ssl-tls-cryptographic-algorithms-cipher-modes-and-protocols\"\u003e"},{"line_number":69,"context_line":"      \u003ctitle\u003eCryptographic algorithms, cipher modes, and protocols\u003c/title\u003e"},{"line_number":70,"context_line":"      \u003cpara\u003eWe recommend only using TLSv1.2. TLSv1.0 and TLSv1.1 may be used for broad client compatibility but we recommend using caution and only enabling these protocols if you have a strong requirement to do so. Other SSL/TLS versions, explicitly older versions, should not be used. These older versions include SSLv2 which is deprecated, and SSLv3 which suffers from the attack known as POODLE. When using TLS v1.2 and in control of both the clients and the server, the cipher suite should be limited to \u003cliteral\u003eECDHE-ECDSA-AES256-GCM-SHA384\u003c/literal\u003e. Where you don\u0027t control both ends and are using TLS v1+, the more general \u003cliteral\u003eHIGH:!aNULL:!eNULL:!DES:!3DES\u003c/literal\u003e is a reasonable cipher selection.\u003c/para\u003e "},{"line_number":71,"context_line":"      \u003cpara\u003eHowever, as this book does not intend to be a thorough reference on cryptography we do not wish to be prescriptive about what specific algorithms or cipher modes you should enable or disable in your OpenStack services. However, there are some authoritative references we would like to recommend for further information:\u003c/para\u003e"},{"line_number":72,"context_line":"      \u003citemizedlist\u003e\u003clistitem\u003e"},{"line_number":73,"context_line":"          \u003cpara\u003e\u003clink xlink:href\u003d\"http://www.nsa.gov/ia/programs/suiteb_cryptography/index.shtml\"\u003eNational Security Agency, Suite B Cryptography\u003c/link\u003e\u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":4,"id":"5a890539_7eb76bd8","line":70,"in_reply_to":"5a890539_5e146fe8","updated":"2014-11-24 19:17:42.000000000","message":"Done","commit_id":"305178c094a6c629e30ffa050b557ed6d7d879a8"}]}