)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"704158fe5dbf73aad459e2f33728b35513d81b6f","unresolved":false,"context_lines":[{"line_number":4,"context_line":"Commit:     Bruce Benjamin \u003cbruce.benjamin@jhuapl.edu\u003e"},{"line_number":5,"context_line":"CommitDate: 2015-03-03 17:34:29 -0500"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Added input re- volume encryption feature"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Updates highlighting volume encryption and ephemeral disk encryption features and deleting outdated material"},{"line_number":10,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"9a80dd14_91d58545","line":7,"updated":"2015-03-04 18:12:49.000000000","message":"nit: \"about\" may be preferable to \"re-\"","commit_id":"1eec58cf37ebc3a86d6cf4a3f9edb043d747dd78"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"704158fe5dbf73aad459e2f33728b35513d81b6f","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Added input re- volume encryption feature"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Updates highlighting volume encryption and ephemeral disk encryption features and deleting outdated material"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"Also includes Barbican update"},{"line_number":12,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"9a80dd14_4d37fbb0","line":9,"updated":"2015-03-04 18:12:49.000000000","message":"Line should wrap at 70 characters.","commit_id":"1eec58cf37ebc3a86d6cf4a3f9edb043d747dd78"}],"security-guide/section_data-encryption.xml":[{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"704158fe5dbf73aad459e2f33728b35513d81b6f","unresolved":false,"context_lines":[{"line_number":29,"context_line":"    \u003c/section\u003e"},{"line_number":30,"context_line":"    \u003csection xml:id\u003d\"data-encryption-block-storage-volumes-and-instance-ephemeral-filesystems\"\u003e"},{"line_number":31,"context_line":"      \u003ctitle\u003eBlock Storage volumes and instance ephemeral filesystems\u003c/title\u003e"},{"line_number":32,"context_line":"      \u003cpara\u003eBlock Storage supports a variety of mechanisms for supplying mountable volumes. The ability to encrypt volumes depends on the service back ends chosen. Some back ends may not support this at all. It is outside the scope of this guide to specify recommendations for each Block Storage back-end driver.\u003c/para\u003e"},{"line_number":33,"context_line":"      \u003cpara\u003eFor the purpose of performance, many storage protocols are unencrypted. Some protocols such as iSCSI can provide authentication and encrypted sessions, it is our recommendation to enable these features.\u003c/para\u003e"},{"line_number":34,"context_line":"      \u003cpara\u003eAs both block storage and compute support LVM backed storage, we can easily provide an example applicable to both systems. In deployments using LVM, encryption may be performed against the backing physical volumes. An encrypted block device would be created using the standard Linux tools, with the LVM physical volume (PV) created on top of the decrypted block device using pvcreate. Then, the vgcreate or vgmodify tool may be used to add the encrypted physical volume to an LVM volume group (VG).\u003c/para\u003e"},{"line_number":35,"context_line":"      \u003cpara\u003eA feature aimed for the Havana release provides encryption of the VM\u0027s data before it is written to disk. This allows the privacy of data to be maintained while residing on the storage device. The idea is similar to how self-encrypting drives work. This feature presents a normal block storage device to the VM but encrypts the bytes in the virtualization host before writing them to the disk. The block server operates exactly as it does when reading and writing unencrypted blocks, except special handling will be required for Block Storage features such as snapshots and live migration. Note that this feature uses an independent key manager.\u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":1,"id":"9a80dd14_ec40a837","side":"PARENT","line":32,"updated":"2015-03-04 18:12:49.000000000","message":"Might want to retain this paragraph.","commit_id":"f716fe618424e690878e57bbdb139f71a118d5ca"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"704158fe5dbf73aad459e2f33728b35513d81b6f","unresolved":false,"context_lines":[{"line_number":30,"context_line":"    \u003csection xml:id\u003d\"data-encryption-block-storage-volumes-and-instance-ephemeral-filesystems\"\u003e"},{"line_number":31,"context_line":"      \u003ctitle\u003eBlock Storage volumes and instance ephemeral filesystems\u003c/title\u003e"},{"line_number":32,"context_line":"      \u003cpara\u003eBlock Storage supports a variety of mechanisms for supplying mountable volumes. The ability to encrypt volumes depends on the service back ends chosen. Some back ends may not support this at all. It is outside the scope of this guide to specify recommendations for each Block Storage back-end driver.\u003c/para\u003e"},{"line_number":33,"context_line":"      \u003cpara\u003eFor the purpose of performance, many storage protocols are unencrypted. Some protocols such as iSCSI can provide authentication and encrypted sessions, it is our recommendation to enable these features.\u003c/para\u003e"},{"line_number":34,"context_line":"      \u003cpara\u003eAs both block storage and compute support LVM backed storage, we can easily provide an example applicable to both systems. In deployments using LVM, encryption may be performed against the backing physical volumes. An encrypted block device would be created using the standard Linux tools, with the LVM physical volume (PV) created on top of the decrypted block device using pvcreate. Then, the vgcreate or vgmodify tool may be used to add the encrypted physical volume to an LVM volume group (VG).\u003c/para\u003e"},{"line_number":35,"context_line":"      \u003cpara\u003eA feature aimed for the Havana release provides encryption of the VM\u0027s data before it is written to disk. This allows the privacy of data to be maintained while residing on the storage device. The idea is similar to how self-encrypting drives work. This feature presents a normal block storage device to the VM but encrypts the bytes in the virtualization host before writing them to the disk. The block server operates exactly as it does when reading and writing unencrypted blocks, except special handling will be required for Block Storage features such as snapshots and live migration. Note that this feature uses an independent key manager.\u003c/para\u003e"},{"line_number":36,"context_line":"    \u003c/section\u003e"}],"source_content_type":"application/xml","patch_set":1,"id":"9a80dd14_ac6eb0c7","side":"PARENT","line":33,"updated":"2015-03-04 18:12:49.000000000","message":"ditto","commit_id":"f716fe618424e690878e57bbdb139f71a118d5ca"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"704158fe5dbf73aad459e2f33728b35513d81b6f","unresolved":false,"context_lines":[{"line_number":8,"context_line":"    \u003ctitle\u003eData encryption\u003c/title\u003e"},{"line_number":9,"context_line":"    \u003cpara\u003eThe option exists for implementers to encrypt tenant data wherever it is stored on disk or transported over a network, such as the OpenStack volume encryption feature described below. This is above and beyond the general recommendation that users encrypt their own data before sending it to their provider.\u003c/para\u003e"},{"line_number":10,"context_line":"    \u003cpara\u003eThe importance of encrypting data on behalf of tenants is largely related to the risk assumed by a provider that an attacker could access tenant data. There may be requirements here in government, as well as requirements per-policy, in private contract, or even in case law in regard to private contracts for public cloud providers. It is recommended that a risk assessment and legal consul advised before choosing tenant encryption policies.\u003c/para\u003e"},{"line_number":11,"context_line":"    \u003cpara\u003ePer-instance or per-object encryption is preferable over, in descending order, per-project, per-tenant, per-host, and per-cloud aggregations. This recommendation is inverse to the complexity and difficulty of implementation. Presently, in some projects it is difficult or impossible to implement encryption as loosely granular as even per-tenant. We recommend implementors make a best-effort in encrypting tenant data.\u003c/para\u003e"},{"line_number":12,"context_line":"    \u003cpara\u003eOften, data encryption relates positively to the ability to reliably destroy tenant and per-instance data, simply by throwing away the keys. It should be noted that in doing so, it becomes of great importance to destroy those keys in a reliable and secure manner.\u003c/para\u003e"},{"line_number":13,"context_line":"    \u003cpara\u003eOpportunities to encrypt data for users are present:\u003c/para\u003e"},{"line_number":14,"context_line":"    \u003citemizedlist\u003e\u003clistitem\u003e"}],"source_content_type":"application/xml","patch_set":1,"id":"9a80dd14_9163c5b0","line":11,"updated":"2015-03-04 18:12:49.000000000","message":"nit: This word removal could be extracted into a separate change for clarity.","commit_id":"1eec58cf37ebc3a86d6cf4a3f9edb043d747dd78"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"c49a01e894addb827102a1c1b6c8e69aea00054f","unresolved":false,"context_lines":[{"line_number":21,"context_line":"    \u003csection xml:id\u003d\"data-encryption-block-storage-volume-encryption\"\u003e"},{"line_number":22,"context_line":"      \u003ctitle\u003eVolume Encryption\u003c/title\u003e"},{"line_number":23,"context_line":"      \u003cpara\u003eA volume encryption feature in OpenStack supports privacy on a per-tenant basis.  As of the Kilo release, the following features are supported:\u003c/para\u003e"},{"line_number":24,"context_line":"    \u003citemizedlist\u003e\u003clistitem\u003e   "},{"line_number":25,"context_line":"      \u003cpara\u003eCreation and usage of encrypted volume types via the dashboard, command line, or a default encrypted setting via nova.conf\u003c/para\u003e"},{"line_number":26,"context_line":"           \u003citemizedlist\u003e      "},{"line_number":27,"context_line":"          \u003clistitem\u003e"}],"source_content_type":"application/xml","patch_set":1,"id":"ba7be1f8_757932c7","line":24,"updated":"2015-03-04 05:00:25.000000000","message":"So the red marks are \"trailing whitespace\" that exists at the end of a line and should be removed.","commit_id":"1eec58cf37ebc3a86d6cf4a3f9edb043d747dd78"},{"author":{"_account_id":10670,"name":"Michael McCune","email":"elmiko@redhat.com","username":"mimccune"},"change_message_id":"30bc79b500346fac349e02ee5ef5a05c0d1d5e80","unresolved":false,"context_lines":[{"line_number":21,"context_line":"    \u003csection xml:id\u003d\"data-encryption-block-storage-volume-encryption\"\u003e"},{"line_number":22,"context_line":"      \u003ctitle\u003eVolume Encryption\u003c/title\u003e"},{"line_number":23,"context_line":"      \u003cpara\u003eA volume encryption feature in OpenStack supports privacy on a per-tenant basis.  As of the Kilo release, the following features are supported:\u003c/para\u003e"},{"line_number":24,"context_line":"    \u003citemizedlist\u003e\u003clistitem\u003e   "},{"line_number":25,"context_line":"      \u003cpara\u003eCreation and usage of encrypted volume types via the dashboard, command line, or a default encrypted setting via nova.conf\u003c/para\u003e"},{"line_number":26,"context_line":"           \u003citemizedlist\u003e      "},{"line_number":27,"context_line":"          \u003clistitem\u003e"}],"source_content_type":"application/xml","patch_set":1,"id":"ba7be1f8_5d28d432","line":24,"updated":"2015-03-04 01:37:07.000000000","message":"this listtem tag is creating an error in the tests","commit_id":"1eec58cf37ebc3a86d6cf4a3f9edb043d747dd78"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"704158fe5dbf73aad459e2f33728b35513d81b6f","unresolved":false,"context_lines":[{"line_number":22,"context_line":"      \u003ctitle\u003eVolume Encryption\u003c/title\u003e"},{"line_number":23,"context_line":"      \u003cpara\u003eA volume encryption feature in OpenStack supports privacy on a per-tenant basis.  As of the Kilo release, the following features are supported:\u003c/para\u003e"},{"line_number":24,"context_line":"    \u003citemizedlist\u003e\u003clistitem\u003e   "},{"line_number":25,"context_line":"      \u003cpara\u003eCreation and usage of encrypted volume types via the dashboard, command line, or a default encrypted setting via nova.conf\u003c/para\u003e"},{"line_number":26,"context_line":"           \u003citemizedlist\u003e      "},{"line_number":27,"context_line":"          \u003clistitem\u003e"},{"line_number":28,"context_line":"          \u003cpara\u003eEnable encryption and select encryption algorithm, key size, etc.\u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":1,"id":"9a80dd14_11927557","line":25,"updated":"2015-03-04 18:12:49.000000000","message":"Nova currently lacks the ability to force all volumes to be encrypted. Conceptually it isn\u0027t a stretch, but it requires coordination with Cinder (that currently isn\u0027t available).","commit_id":"1eec58cf37ebc3a86d6cf4a3f9edb043d747dd78"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"c49a01e894addb827102a1c1b6c8e69aea00054f","unresolved":false,"context_lines":[{"line_number":25,"context_line":"      \u003cpara\u003eCreation and usage of encrypted volume types via the dashboard, command line, or a default encrypted setting via nova.conf\u003c/para\u003e"},{"line_number":26,"context_line":"           \u003citemizedlist\u003e      "},{"line_number":27,"context_line":"          \u003clistitem\u003e"},{"line_number":28,"context_line":"          \u003cpara\u003eEnable encryption and select encryption algorithm, key size, etc.\u003c/para\u003e"},{"line_number":29,"context_line":"          \u003c/listitem\u003e"},{"line_number":30,"context_line":"          \u003c/itemizedlist\u003e "},{"line_number":31,"context_line":"      \u003clistitem\u003e"}],"source_content_type":"application/xml","patch_set":1,"id":"ba7be1f8_55b8ae74","line":28,"updated":"2015-03-04 05:00:25.000000000","message":"I believe convention is to avoid \u0027etc\u0027 and other non-english abbreviations.","commit_id":"1eec58cf37ebc3a86d6cf4a3f9edb043d747dd78"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"704158fe5dbf73aad459e2f33728b35513d81b6f","unresolved":false,"context_lines":[{"line_number":29,"context_line":"          \u003c/listitem\u003e"},{"line_number":30,"context_line":"          \u003c/itemizedlist\u003e "},{"line_number":31,"context_line":"      \u003clistitem\u003e"},{"line_number":32,"context_line":"      \u003cpara\u003eDeletion of encrypted volume types\u003c/para\u003e"},{"line_number":33,"context_line":"      \u003c/listitem\u003e"},{"line_number":34,"context_line":"      \u003clistitem\u003e"},{"line_number":35,"context_line":"      \u003cpara\u003eModification of encrypted volume types, as long as the encrypted volume is not in use\u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":1,"id":"9a80dd14_f1c9615b","line":32,"updated":"2015-03-04 18:12:49.000000000","message":"Cannot be deleted if currently in use (similar to modification below).","commit_id":"1eec58cf37ebc3a86d6cf4a3f9edb043d747dd78"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"704158fe5dbf73aad459e2f33728b35513d81b6f","unresolved":false,"context_lines":[{"line_number":32,"context_line":"      \u003cpara\u003eDeletion of encrypted volume types\u003c/para\u003e"},{"line_number":33,"context_line":"      \u003c/listitem\u003e"},{"line_number":34,"context_line":"      \u003clistitem\u003e"},{"line_number":35,"context_line":"      \u003cpara\u003eModification of encrypted volume types, as long as the encrypted volume is not in use\u003c/para\u003e"},{"line_number":36,"context_line":"      \u003c/listitem\u003e"},{"line_number":37,"context_line":"      \u003clistitem\u003e "},{"line_number":38,"context_line":"      \u003cpara\u003eEncryption over the network, via iSCSI, to a block storage back-end\u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":1,"id":"9a80dd14_d1037d71","line":35,"updated":"2015-03-04 18:12:49.000000000","message":"These issues related to deletion and modification may disappear in the near future: https://blueprints.launchpad.net/cinder/+spec/volume-encryption-metadata\n\nPerhaps it would be better to omit these implementation details?","commit_id":"1eec58cf37ebc3a86d6cf4a3f9edb043d747dd78"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"704158fe5dbf73aad459e2f33728b35513d81b6f","unresolved":false,"context_lines":[{"line_number":35,"context_line":"      \u003cpara\u003eModification of encrypted volume types, as long as the encrypted volume is not in use\u003c/para\u003e"},{"line_number":36,"context_line":"      \u003c/listitem\u003e"},{"line_number":37,"context_line":"      \u003clistitem\u003e "},{"line_number":38,"context_line":"      \u003cpara\u003eEncryption over the network, via iSCSI, to a block storage back-end\u003c/para\u003e"},{"line_number":39,"context_line":"      \u003c/listitem\u003e  "},{"line_number":40,"context_line":"      \u003clistitem\u003e  "},{"line_number":41,"context_line":"      \u003cpara\u003eEncryption of backups\u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":1,"id":"9a80dd14_91cca537","line":38,"updated":"2015-03-04 18:12:49.000000000","message":"\"Encryption over the network\" makes me think of separate network encryption (e.g., IPsec), which currently isn\u0027t done. It might be good to clarify this claim with something like \"The volume data contained within iSCSI packets is encrypted\"","commit_id":"1eec58cf37ebc3a86d6cf4a3f9edb043d747dd78"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"c49a01e894addb827102a1c1b6c8e69aea00054f","unresolved":false,"context_lines":[{"line_number":35,"context_line":"      \u003cpara\u003eModification of encrypted volume types, as long as the encrypted volume is not in use\u003c/para\u003e"},{"line_number":36,"context_line":"      \u003c/listitem\u003e"},{"line_number":37,"context_line":"      \u003clistitem\u003e "},{"line_number":38,"context_line":"      \u003cpara\u003eEncryption over the network, via iSCSI, to a block storage back-end\u003c/para\u003e"},{"line_number":39,"context_line":"      \u003c/listitem\u003e  "},{"line_number":40,"context_line":"      \u003clistitem\u003e  "},{"line_number":41,"context_line":"      \u003cpara\u003eEncryption of backups\u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":1,"id":"ba7be1f8_d551fe30","line":38,"updated":"2015-03-04 05:00:25.000000000","message":"Again, I believe via should be changed to \u0027such as\u0027 or similar","commit_id":"1eec58cf37ebc3a86d6cf4a3f9edb043d747dd78"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"704158fe5dbf73aad459e2f33728b35513d81b6f","unresolved":false,"context_lines":[{"line_number":38,"context_line":"      \u003cpara\u003eEncryption over the network, via iSCSI, to a block storage back-end\u003c/para\u003e"},{"line_number":39,"context_line":"      \u003c/listitem\u003e  "},{"line_number":40,"context_line":"      \u003clistitem\u003e  "},{"line_number":41,"context_line":"      \u003cpara\u003eEncryption of backups\u003c/para\u003e"},{"line_number":42,"context_line":"      \u003c/listitem\u003e"},{"line_number":43,"context_line":"      \u003clistitem\u003e   "},{"line_number":44,"context_line":"      \u003cpara\u003eDashboard indication of volume encryption status.  Includes indication that a volume is encrypted, and includes the encryption parameters (algorithm, key size, etc.)\u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":1,"id":"9a80dd14_f1afa129","line":41,"updated":"2015-03-04 18:12:49.000000000","message":"Again, makes me think of a separate encryption mechanism for backups. What really happens is that the encryption metadata is stored with the backup so it can be restored and used later. The backup is just a copy of the existing data be it encrypted or unencrypted.","commit_id":"1eec58cf37ebc3a86d6cf4a3f9edb043d747dd78"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"c49a01e894addb827102a1c1b6c8e69aea00054f","unresolved":false,"context_lines":[{"line_number":41,"context_line":"      \u003cpara\u003eEncryption of backups\u003c/para\u003e"},{"line_number":42,"context_line":"      \u003c/listitem\u003e"},{"line_number":43,"context_line":"      \u003clistitem\u003e   "},{"line_number":44,"context_line":"      \u003cpara\u003eDashboard indication of volume encryption status.  Includes indication that a volume is encrypted, and includes the encryption parameters (algorithm, key size, etc.)\u003c/para\u003e"},{"line_number":45,"context_line":"      \u003c/listitem\u003e"},{"line_number":46,"context_line":"      \u003clistitem\u003e"},{"line_number":47,"context_line":"      \u003cpara\u003eInterface with the Barbican key manager via a wrapper.  When Barbican becomes available, it will provide secure key storage\u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":1,"id":"ba7be1f8_f5336211","line":44,"updated":"2015-03-04 05:00:25.000000000","message":"Update to change etc to something like \"...parameters such as algorithm and key size.\"","commit_id":"1eec58cf37ebc3a86d6cf4a3f9edb043d747dd78"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"c49a01e894addb827102a1c1b6c8e69aea00054f","unresolved":false,"context_lines":[{"line_number":47,"context_line":"      \u003cpara\u003eInterface with the Barbican key manager via a wrapper.  When Barbican becomes available, it will provide secure key storage\u003c/para\u003e"},{"line_number":48,"context_line":"          \u003citemizedlist\u003e      "},{"line_number":49,"context_line":"          \u003clistitem\u003e"},{"line_number":50,"context_line":"          \u003cpara\u003eVolume encryption can be supported by enterprise-grade key storage if a Hardware Security Module (HSM) is used as a Barbican back-end secret store\u003c/para\u003e"},{"line_number":51,"context_line":"          \u003c/listitem\u003e"},{"line_number":52,"context_line":"          \u003c/itemizedlist\u003e "},{"line_number":53,"context_line":"      \u003c/listitem\u003e"}],"source_content_type":"application/xml","patch_set":1,"id":"9a80dd14_e7b54232","line":50,"updated":"2015-03-04 05:00:25.000000000","message":"There is inconsistent use of punctuation throughout - some of these lines end in period and some do not","commit_id":"1eec58cf37ebc3a86d6cf4a3f9edb043d747dd78"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"704158fe5dbf73aad459e2f33728b35513d81b6f","unresolved":false,"context_lines":[{"line_number":47,"context_line":"      \u003cpara\u003eInterface with the Barbican key manager via a wrapper.  When Barbican becomes available, it will provide secure key storage\u003c/para\u003e"},{"line_number":48,"context_line":"          \u003citemizedlist\u003e      "},{"line_number":49,"context_line":"          \u003clistitem\u003e"},{"line_number":50,"context_line":"          \u003cpara\u003eVolume encryption can be supported by enterprise-grade key storage if a Hardware Security Module (HSM) is used as a Barbican back-end secret store\u003c/para\u003e"},{"line_number":51,"context_line":"          \u003c/listitem\u003e"},{"line_number":52,"context_line":"          \u003c/itemizedlist\u003e "},{"line_number":53,"context_line":"      \u003c/listitem\u003e"}],"source_content_type":"application/xml","patch_set":1,"id":"9a80dd14_117435ce","line":50,"updated":"2015-03-04 18:12:49.000000000","message":"What qualifies as \"enterprise-grade\"? The existing statement suggests that HSMs are necessary. Is that the normative definition?","commit_id":"1eec58cf37ebc3a86d6cf4a3f9edb043d747dd78"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"c49a01e894addb827102a1c1b6c8e69aea00054f","unresolved":false,"context_lines":[{"line_number":60,"context_line":"      \u003cpara\u003eCreation and usage of encrypted LVM ephemeral disks\u003c/para\u003e"},{"line_number":61,"context_line":"           \u003citemizedlist\u003e      "},{"line_number":62,"context_line":"          \u003clistitem\u003e"},{"line_number":63,"context_line":"          \u003cpara\u003eMinor file update to enable encryption and select encryption algorithm, key size, etc.\u003c/para\u003e"},{"line_number":64,"context_line":"          \u003c/listitem\u003e"},{"line_number":65,"context_line":"          \u003c/itemizedlist\u003e "},{"line_number":66,"context_line":"      \u003clistitem\u003e"}],"source_content_type":"application/xml","patch_set":1,"id":"ba7be1f8_95094633","line":63,"updated":"2015-03-04 05:00:25.000000000","message":"Update etc to \"...and other options as necessary.\" or similar","commit_id":"1eec58cf37ebc3a86d6cf4a3f9edb043d747dd78"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"704158fe5dbf73aad459e2f33728b35513d81b6f","unresolved":false,"context_lines":[{"line_number":60,"context_line":"      \u003cpara\u003eCreation and usage of encrypted LVM ephemeral disks\u003c/para\u003e"},{"line_number":61,"context_line":"           \u003citemizedlist\u003e      "},{"line_number":62,"context_line":"          \u003clistitem\u003e"},{"line_number":63,"context_line":"          \u003cpara\u003eMinor file update to enable encryption and select encryption algorithm, key size, etc.\u003c/para\u003e"},{"line_number":64,"context_line":"          \u003c/listitem\u003e"},{"line_number":65,"context_line":"          \u003c/itemizedlist\u003e "},{"line_number":66,"context_line":"      \u003clistitem\u003e"}],"source_content_type":"application/xml","patch_set":1,"id":"9a80dd14_acca309f","line":63,"updated":"2015-03-04 18:12:49.000000000","message":"What is meant by this statement? Perhaps what is meant is similar to the following: Nova configuration enables encryption...","commit_id":"1eec58cf37ebc3a86d6cf4a3f9edb043d747dd78"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"c49a01e894addb827102a1c1b6c8e69aea00054f","unresolved":false,"context_lines":[{"line_number":64,"context_line":"          \u003c/listitem\u003e"},{"line_number":65,"context_line":"          \u003c/itemizedlist\u003e "},{"line_number":66,"context_line":"      \u003clistitem\u003e"},{"line_number":67,"context_line":"      \u003cpara\u003eInterface with the Barbican key manager via a wrapper.   When Barbican becomes available, it will provide secure key storage\u003c/para\u003e"},{"line_number":68,"context_line":"          \u003citemizedlist\u003e      "},{"line_number":69,"context_line":"          \u003clistitem\u003e"},{"line_number":70,"context_line":"          \u003cpara\u003eBarbican will allow ephemeral disk encryption key to be supported on a per-tenant basis.  Note: Until Barbican support is available, all VMs within the host will have ephemeral disk encryption with the same key.  Data isolation will be supported when Barbican becomes available\u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":1,"id":"ba7be1f8_07028d09","line":67,"updated":"2015-03-04 05:00:25.000000000","message":"Change via to through or something similar","commit_id":"1eec58cf37ebc3a86d6cf4a3f9edb043d747dd78"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"704158fe5dbf73aad459e2f33728b35513d81b6f","unresolved":false,"context_lines":[{"line_number":73,"context_line":"          \u003cpara\u003eEphemeral disk encryption can be supported by enterprise-grade key storage if a Hardware Security Module (HSM) is used as a Barbican back-end secret store\u003c/para\u003e"},{"line_number":74,"context_line":"          \u003c/listitem\u003e"},{"line_number":75,"context_line":"          \u003clistitem\u003e "},{"line_number":76,"context_line":"          \u003cpara\u003eWith Barbican, when an ephemeral disk is no longer needed, simply deleting the key will take the place of overwriting the ephemeral disk storage area\u003c/para\u003e"},{"line_number":77,"context_line":"          \u003c/listitem\u003e"},{"line_number":78,"context_line":"          \u003c/itemizedlist\u003e "},{"line_number":79,"context_line":"      \u003c/listitem\u003e"}],"source_content_type":"application/xml","patch_set":1,"id":"9a80dd14_5155cd1b","line":76,"updated":"2015-03-04 18:12:49.000000000","message":"nit: \"...key will take...\" -\u003e \"...key may take...\"","commit_id":"1eec58cf37ebc3a86d6cf4a3f9edb043d747dd78"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"704158fe5dbf73aad459e2f33728b35513d81b6f","unresolved":false,"context_lines":[{"line_number":84,"context_line":"      \u003cpara\u003eThe ability to encrypt objects in Object Storage is presently limited to disk-level encryption per node. However, there does exist third-party extensions and modules for per-object encryption. These modules have been proposed upstream, but have not per this writing been formally accepted. Below are some pointers:\u003c/para\u003e"},{"line_number":85,"context_line":"      \u003cpara\u003e\u003clink xlink:href\u003d\"https://github.com/Mirantis/swift-encrypt\"\u003ehttps://github.com/Mirantis/swift-encrypt\u003c/link\u003e\u003c/para\u003e"},{"line_number":86,"context_line":"      \u003cpara\u003e\u003clink xlink:href\u003d\"http://www.mirantis.com/blog/on-disk-encryption-prototype-for-openstack-swift/\"\u003ehttp://www.mirantis.com/blog/on-disk-encryption-prototype-for-openstack-swift/\u003c/link\u003e\u003c/para\u003e"},{"line_number":87,"context_line":"      \u003cpara\u003eNote that the OpenStack Liberty release is expected to include development work to create a feature supporting per-image encryption and signing.\u003c/para\u003e "},{"line_number":88,"context_line":"    \u003c/section\u003e"},{"line_number":89,"context_line":"    \u003csection xml:id\u003d\"data-encryption-network-data\"\u003e"},{"line_number":90,"context_line":"      \u003ctitle\u003eNetwork data\u003c/title\u003e"}],"source_content_type":"application/xml","patch_set":1,"id":"9a80dd14_cc0e8434","line":87,"updated":"2015-03-04 18:12:49.000000000","message":"Don\u0027t think this section is the correct one for this statement. Image storage \u003c\u003e object storage (although Swift is often the backend for Glance).","commit_id":"1eec58cf37ebc3a86d6cf4a3f9edb043d747dd78"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"4e1791f672f81b1c53f7bed71d4a9e5310797dbc","unresolved":false,"context_lines":[{"line_number":31,"context_line":"      \u003ctitle\u003eBlock Storage volumes and instance ephemeral filesystems\u003c/title\u003e"},{"line_number":32,"context_line":"      \u003cpara\u003eBlock Storage supports a variety of mechanisms for supplying mountable volumes. The ability to encrypt volumes depends on the service back ends chosen. Some back ends may not support this at all. It is outside the scope of this guide to specify recommendations for each Block Storage back-end driver.\u003c/para\u003e"},{"line_number":33,"context_line":"      \u003cpara\u003eFor the purpose of performance, many storage protocols are unencrypted. Some protocols such as iSCSI can provide authentication and encrypted sessions, it is our recommendation to enable these features.\u003c/para\u003e"},{"line_number":34,"context_line":"      \u003cpara\u003eAs both block storage and compute support LVM backed storage, we can easily provide an example applicable to both systems. In deployments using LVM, encryption may be performed against the backing physical volumes. An encrypted block device would be created using the standard Linux tools, with the LVM physical volume (PV) created on top of the decrypted block device using pvcreate. Then, the vgcreate or vgmodify tool may be used to add the encrypted physical volume to an LVM volume group (VG).\u003c/para\u003e"},{"line_number":35,"context_line":"      \u003cpara\u003eA feature aimed for the Havana release provides encryption of the VM\u0027s data before it is written to disk. This allows the privacy of data to be maintained while residing on the storage device. The idea is similar to how self-encrypting drives work. This feature presents a normal block storage device to the VM but encrypts the bytes in the virtualization host before writing them to the disk. The block server operates exactly as it does when reading and writing unencrypted blocks, except special handling will be required for Block Storage features such as snapshots and live migration. Note that this feature uses an independent key manager.\u003c/para\u003e"},{"line_number":36,"context_line":"    \u003c/section\u003e"},{"line_number":37,"context_line":"    \u003csection xml:id\u003d\"data-encryption-network-data\"\u003e"}],"source_content_type":"application/xml","patch_set":3,"id":"9a80dd14_4a422a3f","side":"PARENT","line":34,"updated":"2015-03-05 22:13:04.000000000","message":"I think retaining the previous three paragraphs might be beneficial. Most of the statements still apply, and some cloud deployments might choose this approach rather than the features described above.","commit_id":"79116ca74a5aac2e81bcf501b1f1acaded465026"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"1d4be2deb4648fe5856069c8ea946ec3d71074da","unresolved":false,"context_lines":[{"line_number":22,"context_line":"      \u003ctitle\u003eVolume Encryption\u003c/title\u003e"},{"line_number":23,"context_line":"      \u003cpara\u003eA volume encryption feature in OpenStack supports privacy on a per-tenant basis.  As of the Kilo release, the following features are supported:\u003c/para\u003e"},{"line_number":24,"context_line":"    \u003citemizedlist\u003e\u003clistitem\u003e"},{"line_number":25,"context_line":"      \u003cpara\u003eCreation and usage of encrypted volume types via the dashboard or a command line interface\u003c/para\u003e"},{"line_number":26,"context_line":"           \u003citemizedlist\u003e"},{"line_number":27,"context_line":"          \u003clistitem\u003e"},{"line_number":28,"context_line":"          \u003cpara\u003eEnable encryption and select parameters such as encryption algorithm and key size\u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":3,"id":"9a80dd14_576f7892","line":25,"updated":"2015-03-04 20:58:35.000000000","message":"Doc convention is to not use \u0027via\u0027 - possibly change to \u0027through\u0027.","commit_id":"b7db84672c392dd811fee119381468ae2719b489"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"4e1791f672f81b1c53f7bed71d4a9e5310797dbc","unresolved":false,"context_lines":[{"line_number":27,"context_line":"          \u003clistitem\u003e"},{"line_number":28,"context_line":"          \u003cpara\u003eEnable encryption and select parameters such as encryption algorithm and key size\u003c/para\u003e"},{"line_number":29,"context_line":"          \u003c/listitem\u003e"},{"line_number":30,"context_line":"          \u003c/itemizedlist\u003e"},{"line_number":31,"context_line":"      \u003clistitem\u003e"},{"line_number":32,"context_line":"      \u003cpara\u003eVolume data contained within iSCSI packets is encrypted\u003c/para\u003e"},{"line_number":33,"context_line":"      \u003c/listitem\u003e"}],"source_content_type":"application/xml","patch_set":3,"id":"9a80dd14_34ed5d8c","line":30,"updated":"2015-03-05 22:13:04.000000000","message":"Looks like we\u0027re missing a \u003c/listitem\u003e here.","commit_id":"b7db84672c392dd811fee119381468ae2719b489"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"4e1791f672f81b1c53f7bed71d4a9e5310797dbc","unresolved":false,"context_lines":[{"line_number":32,"context_line":"      \u003cpara\u003eVolume data contained within iSCSI packets is encrypted\u003c/para\u003e"},{"line_number":33,"context_line":"      \u003c/listitem\u003e"},{"line_number":34,"context_line":"      \u003clistitem\u003e"},{"line_number":35,"context_line":"      \u003cpara\u003eSupports encryption of backups (through encryption metadata with backup)\u003c/para\u003e"},{"line_number":36,"context_line":"      \u003c/listitem\u003e"},{"line_number":37,"context_line":"      \u003clistitem\u003e"},{"line_number":38,"context_line":"      \u003cpara\u003eDashboard indication of volume encryption status.  Includes indication that a volume is encrypted, and includes the encryption parameters such as algorithm and key size\u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":3,"id":"9a80dd14_97bfebfa","line":35,"updated":"2015-03-05 22:13:04.000000000","message":"Perhaps \"Supports encrypted backups if the original volume is encrypted\"?","commit_id":"b7db84672c392dd811fee119381468ae2719b489"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"1d4be2deb4648fe5856069c8ea946ec3d71074da","unresolved":false,"context_lines":[{"line_number":38,"context_line":"      \u003cpara\u003eDashboard indication of volume encryption status.  Includes indication that a volume is encrypted, and includes the encryption parameters such as algorithm and key size\u003c/para\u003e"},{"line_number":39,"context_line":"      \u003c/listitem\u003e"},{"line_number":40,"context_line":"      \u003clistitem\u003e"},{"line_number":41,"context_line":"      \u003cpara\u003eInterface with the Barbican key manager via a wrapper.  When Barbican becomes available, it will provide secure key storage\u003c/para\u003e"},{"line_number":42,"context_line":"          \u003citemizedlist\u003e"},{"line_number":43,"context_line":"          \u003clistitem\u003e"},{"line_number":44,"context_line":"          \u003cpara\u003eVolume encryption can be supported by enterprise-grade key storage if a Hardware Security Module (HSM) is used as a Barbican back-end secret store\u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":3,"id":"9a80dd14_37f924c9","line":41,"updated":"2015-03-04 20:58:35.000000000","message":"Again, I think via should be updated to \u0027through\u0027","commit_id":"b7db84672c392dd811fee119381468ae2719b489"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"4e1791f672f81b1c53f7bed71d4a9e5310797dbc","unresolved":false,"context_lines":[{"line_number":41,"context_line":"      \u003cpara\u003eInterface with the Barbican key manager via a wrapper.  When Barbican becomes available, it will provide secure key storage\u003c/para\u003e"},{"line_number":42,"context_line":"          \u003citemizedlist\u003e"},{"line_number":43,"context_line":"          \u003clistitem\u003e"},{"line_number":44,"context_line":"          \u003cpara\u003eVolume encryption can be supported by enterprise-grade key storage if a Hardware Security Module (HSM) is used as a Barbican back-end secret store\u003c/para\u003e"},{"line_number":45,"context_line":"          \u003c/listitem\u003e"},{"line_number":46,"context_line":"          \u003c/itemizedlist\u003e"},{"line_number":47,"context_line":"      \u003c/listitem\u003e"}],"source_content_type":"application/xml","patch_set":3,"id":"9a80dd14_37d63fc6","line":44,"updated":"2015-03-05 22:13:04.000000000","message":"See comment on patch set 1. The existing sentence implicitly claims that HSMs are required for \"enterprise-grade\" key storage. Different Barbican backends may not store keys directly on an HSM, and others might claim that the solution is still \"enterprise-grade.\"\n\nPerhaps instead of \"enterprise-grade\" (which may not be normative terminology?), the sentence could be phrased more like the following: \"Volume encryption can use existing enterprise standards, such as the Key Management Interoperability Protocol (KMIP), for key storage on a Hardware Security Module (HSM)\" Does that convey the intended meaning?","commit_id":"b7db84672c392dd811fee119381468ae2719b489"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"4e1791f672f81b1c53f7bed71d4a9e5310797dbc","unresolved":false,"context_lines":[{"line_number":54,"context_line":"      \u003cpara\u003eCreation and usage of encrypted LVM ephemeral disks\u003c/para\u003e"},{"line_number":55,"context_line":"           \u003citemizedlist\u003e"},{"line_number":56,"context_line":"          \u003clistitem\u003e"},{"line_number":57,"context_line":"          \u003cpara\u003eNova configuration enables encryption and select encryption parameters such as algorithm and key size\u003c/para\u003e"},{"line_number":58,"context_line":"          \u003c/listitem\u003e"},{"line_number":59,"context_line":"          \u003c/itemizedlist\u003e"},{"line_number":60,"context_line":"      \u003clistitem\u003e"}],"source_content_type":"application/xml","patch_set":3,"id":"9a80dd14_574c9342","line":57,"updated":"2015-03-05 22:13:04.000000000","message":"nit: select -\u003e selection of OR select -\u003e specifies","commit_id":"b7db84672c392dd811fee119381468ae2719b489"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"4e1791f672f81b1c53f7bed71d4a9e5310797dbc","unresolved":false,"context_lines":[{"line_number":64,"context_line":"          \u003cpara\u003eBarbican will allow ephemeral disk encryption key to be supported on a per-tenant basis.  Note: Until Barbican support is available, all VMs within the host will have ephemeral disk encryption with the same key.  Data isolation will be supported when Barbican becomes available\u003c/para\u003e"},{"line_number":65,"context_line":"          \u003c/listitem\u003e"},{"line_number":66,"context_line":"          \u003clistitem\u003e"},{"line_number":67,"context_line":"          \u003cpara\u003eEphemeral disk encryption can be supported by enterprise-grade key storage if a Hardware Security Module (HSM) is used as a Barbican back-end secret store\u003c/para\u003e"},{"line_number":68,"context_line":"          \u003c/listitem\u003e"},{"line_number":69,"context_line":"          \u003clistitem\u003e"},{"line_number":70,"context_line":"          \u003cpara\u003eWith Barbican, when an ephemeral disk is no longer needed, simply deleting the key may take the place of overwriting the ephemeral disk storage area\u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":3,"id":"9a80dd14_7708b72d","line":67,"updated":"2015-03-05 22:13:04.000000000","message":"See comment above.","commit_id":"b7db84672c392dd811fee119381468ae2719b489"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"1d4be2deb4648fe5856069c8ea946ec3d71074da","unresolved":false,"context_lines":[{"line_number":85,"context_line":"      other tunnels. This is not functionality common or standard in"},{"line_number":86,"context_line":"      OpenStack, but is an option available to motivated and"},{"line_number":87,"context_line":"      interested implementors.\u003c/para\u003e"},{"line_number":88,"context_line":"      \u003cpara\u003eAs mentioned above, if the current OpenStack volume encryption feature is enabled, data to be stored is encrypted in Nova and carried encrypted over a iSCSI channel on the network to a back-end storage device. Likewise, reading of the encrypted data is encrypted over the network.\u003c/para\u003e"},{"line_number":89,"context_line":"    \u003c/section\u003e"},{"line_number":90,"context_line":"\u003c/section\u003e"}],"source_content_type":"application/xml","patch_set":3,"id":"9a80dd14_37268417","line":88,"updated":"2015-03-04 20:58:35.000000000","message":"The last sentence is a little awkward, maybe \"Likewise, encrypted data will remain so as it is transferred over the network.\" or something similar?","commit_id":"b7db84672c392dd811fee119381468ae2719b489"},{"author":{"_account_id":10670,"name":"Michael McCune","email":"elmiko@redhat.com","username":"mimccune"},"change_message_id":"db8ae817006820e757d95438a13cbdb4e12e6906","unresolved":false,"context_lines":[{"line_number":58,"context_line":"          \u003clistitem\u003e"},{"line_number":59,"context_line":"          \u003cpara\u003eNova configuration enables encryption and specifies encryption parameters such as algorithm and key size\u003c/para\u003e"},{"line_number":60,"context_line":"          \u003c/listitem\u003e"},{"line_number":61,"context_line":"          \u003c/itemizedlist\u003e"},{"line_number":62,"context_line":"      \u003clistitem\u003e"},{"line_number":63,"context_line":"      \u003cpara\u003eInterface with the Barbican key manager using a wrapper.   When Barbican becomes available, it will provide secure key storage\u003c/para\u003e"},{"line_number":64,"context_line":"          \u003citemizedlist\u003e"}],"source_content_type":"application/xml","patch_set":5,"id":"9a80dd14_cb50c534","line":61,"updated":"2015-03-12 20:18:44.000000000","message":"i think there needs to be a closing listitem element here","commit_id":"9e8b0fc751ef05e4f2cdb2191cfa49e80a872aff"},{"author":{"_account_id":6804,"name":"bruce-benjamin","email":"bruce.benjamin@jhuapl.edu","username":"bruce-benjamin"},"change_message_id":"719deb4834625d9e175c0a2a8fb957da2e57c917","unresolved":false,"context_lines":[{"line_number":59,"context_line":"          \u003cpara\u003eNova configuration enables encryption and specifies encryption parameters such as algorithm and key size\u003c/para\u003e"},{"line_number":60,"context_line":"          \u003c/listitem\u003e"},{"line_number":61,"context_line":"          \u003c/itemizedlist\u003e"},{"line_number":62,"context_line":"      \u003clistitem\u003e"},{"line_number":63,"context_line":"      \u003cpara\u003eInterface with the Barbican key manager using a wrapper.   When Barbican becomes available, it will provide secure key storage\u003c/para\u003e"},{"line_number":64,"context_line":"          \u003citemizedlist\u003e"},{"line_number":65,"context_line":"          \u003clistitem\u003e"}],"source_content_type":"application/xml","patch_set":5,"id":"9a80dd14_86b88412","line":62,"updated":"2015-03-12 20:25:35.000000000","message":"Thanks for spotting this error and the other one, Michael. I appreciate it.","commit_id":"9e8b0fc751ef05e4f2cdb2191cfa49e80a872aff"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"31a830ddcd2d764ac2524d17faf5d6938c954c6d","unresolved":false,"context_lines":[{"line_number":40,"context_line":"      \u003cpara\u003eDashboard indication of volume encryption status.  Includes indication that a volume is encrypted, and includes the encryption parameters such as algorithm and key size\u003c/para\u003e"},{"line_number":41,"context_line":"      \u003c/listitem\u003e"},{"line_number":42,"context_line":"      \u003clistitem\u003e"},{"line_number":43,"context_line":"      \u003cpara\u003eInterface with the Barbican key manager through a wrapper.  When Barbican becomes available, it will provide secure key storage\u003c/para\u003e"},{"line_number":44,"context_line":"          \u003citemizedlist\u003e"},{"line_number":45,"context_line":"          \u003clistitem\u003e"},{"line_number":46,"context_line":"          \u003cpara\u003eVolume encryption is supported by back-end key storage for enhanced security (e.g. a Hardware Security Module (HSM) or a KMIP server can be used as a Barbican back-end secret store)\u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":6,"id":"9a80dd14_6b9c100f","line":43,"updated":"2015-03-13 14:46:58.000000000","message":"nit: Barbican could already be considered available based on some comments I\u0027ve seen from the folks working on it. May want to remove the second sentence.","commit_id":"09ecddf505c229a5c2f60aa1d85d83bb2493f1f8"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"31a830ddcd2d764ac2524d17faf5d6938c954c6d","unresolved":false,"context_lines":[{"line_number":84,"context_line":"    \u003c/section\u003e"},{"line_number":85,"context_line":"    \u003csection xml:id\u003d\"data-encryption-block-storage-volumes-and-instance-ephemeral-filesystems\"\u003e"},{"line_number":86,"context_line":"      \u003ctitle\u003eBlock Storage volumes and instance ephemeral filesystems\u003c/title\u003e"},{"line_number":87,"context_line":"      \u003cpara\u003eBlock Storage supports a variety of mechanisms for supplying mountable volumes. The ability to encrypt volumes depends on the service back ends chosen. Some back ends may not support this at all. It is outside the scope of this guide to specify recommendations for each Block Storage back-end driver.\u003c/para\u003e"},{"line_number":88,"context_line":"      \u003cpara\u003eFor the purpose of performance, many storage protocols are unencrypted. Some protocols such as iSCSI can provide authentication and encrypted sessions, it is our recommendation to enable these features.\u003c/para\u003e"},{"line_number":89,"context_line":"      \u003cpara\u003eAs both block storage and compute support LVM backed storage, we can easily provide an example applicable to both systems. In deployments using LVM, encryption may be performed against the backing physical volumes. An encrypted block device would be created using the standard Linux tools, with the LVM physical volume (PV) created on top of the decrypted block device using pvcreate. Then, the vgcreate or vgmodify tool may be used to add the encrypted physical volume to an LVM volume group (VG).\u003c/para\u003e"},{"line_number":90,"context_line":"      \u003cpara\u003eA feature aimed for the Havana release provides encryption of the VM\u0027s data before it is written to disk. This allows the privacy of data to be maintained while residing on the storage device. The idea is similar to how self-encrypting drives work. This feature presents a normal block storage device to the VM but encrypts the bytes in the virtualization host before writing them to the disk. The block server operates exactly as it does when reading and writing unencrypted blocks, except special handling will be required for Block Storage features such as snapshots and live migration. Note that this feature uses an independent key manager.\u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":6,"id":"9a80dd14_665447fe","line":87,"updated":"2015-03-13 14:46:58.000000000","message":"Suggestion: ...to encrypt volumes... -\u003e to encrypt volumes on the storage host...\n\nEncryption can be performed by Nova (as described above), which is independent of encryption provided by the storage host. Either or both types of encryption can be used.","commit_id":"09ecddf505c229a5c2f60aa1d85d83bb2493f1f8"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"31a830ddcd2d764ac2524d17faf5d6938c954c6d","unresolved":false,"context_lines":[{"line_number":87,"context_line":"      \u003cpara\u003eBlock Storage supports a variety of mechanisms for supplying mountable volumes. The ability to encrypt volumes depends on the service back ends chosen. Some back ends may not support this at all. It is outside the scope of this guide to specify recommendations for each Block Storage back-end driver.\u003c/para\u003e"},{"line_number":88,"context_line":"      \u003cpara\u003eFor the purpose of performance, many storage protocols are unencrypted. Some protocols such as iSCSI can provide authentication and encrypted sessions, it is our recommendation to enable these features.\u003c/para\u003e"},{"line_number":89,"context_line":"      \u003cpara\u003eAs both block storage and compute support LVM backed storage, we can easily provide an example applicable to both systems. In deployments using LVM, encryption may be performed against the backing physical volumes. An encrypted block device would be created using the standard Linux tools, with the LVM physical volume (PV) created on top of the decrypted block device using pvcreate. Then, the vgcreate or vgmodify tool may be used to add the encrypted physical volume to an LVM volume group (VG).\u003c/para\u003e"},{"line_number":90,"context_line":"      \u003cpara\u003eA feature aimed for the Havana release provides encryption of the VM\u0027s data before it is written to disk. This allows the privacy of data to be maintained while residing on the storage device. The idea is similar to how self-encrypting drives work. This feature presents a normal block storage device to the VM but encrypts the bytes in the virtualization host before writing them to the disk. The block server operates exactly as it does when reading and writing unencrypted blocks, except special handling will be required for Block Storage features such as snapshots and live migration. Note that this feature uses an independent key manager.\u003c/para\u003e"},{"line_number":91,"context_line":"    \u003c/section\u003e"},{"line_number":92,"context_line":"    \u003csection xml:id\u003d\"data-encryption-network-data\"\u003e"},{"line_number":93,"context_line":"      \u003ctitle\u003eNetwork data\u003c/title\u003e"}],"source_content_type":"application/xml","patch_set":6,"id":"9a80dd14_4605830f","line":90,"updated":"2015-03-13 14:46:58.000000000","message":"Presumably described above in the \"Volume Encryption\" section. If so, this last paragraph should be removed.","commit_id":"09ecddf505c229a5c2f60aa1d85d83bb2493f1f8"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"31a830ddcd2d764ac2524d17faf5d6938c954c6d","unresolved":false,"context_lines":[{"line_number":95,"context_line":"      other tunnels. This is not functionality common or standard in"},{"line_number":96,"context_line":"      OpenStack, but is an option available to motivated and"},{"line_number":97,"context_line":"      interested implementors.\u003c/para\u003e"},{"line_number":98,"context_line":"      \u003cpara\u003eAs mentioned above, if the current OpenStack volume encryption feature is enabled, data to be stored is encrypted in Nova and carried encrypted over a iSCSI channel on the network to a back-end storage device. Likewise, reading of the encrypted data is encrypted over the network.\u003c/para\u003e"},{"line_number":99,"context_line":"    \u003c/section\u003e"},{"line_number":100,"context_line":"\u003c/section\u003e"}],"source_content_type":"application/xml","patch_set":6,"id":"9a80dd14_8b3dc4df","line":98,"updated":"2015-03-13 14:46:58.000000000","message":"See Nathaniel Dillon\u0027s comment on patch set 3:\n\n\u003e The last sentence is a little awkward, maybe \"Likewise, encrypted data will remain so as it is transferred over the network.\" or something similar?","commit_id":"09ecddf505c229a5c2f60aa1d85d83bb2493f1f8"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"a76e9eeead825fc51b39457ff3ebb4abaf71b4b6","unresolved":false,"context_lines":[{"line_number":19,"context_line":"      \u003c/listitem\u003e"},{"line_number":20,"context_line":"\u003c/itemizedlist\u003e"},{"line_number":21,"context_line":"    \u003csection xml:id\u003d\"data-encryption-block-storage-volume-encryption\"\u003e"},{"line_number":22,"context_line":"      \u003ctitle\u003eVolume Encryption\u003c/title\u003e"},{"line_number":23,"context_line":"      \u003cpara\u003eA volume encryption feature in OpenStack supports privacy on a per-tenant basis.  As of the Kilo release, the following features are supported:\u003c/para\u003e"},{"line_number":24,"context_line":"    \u003citemizedlist\u003e"},{"line_number":25,"context_line":"      \u003clistitem\u003e"}],"source_content_type":"application/xml","patch_set":7,"id":"9a80dd14_f4f8d8c5","line":22,"updated":"2015-03-19 19:09:06.000000000","message":"Titles use sentence style capitalizatoin -\u003e lowercase \"encryption\"","commit_id":"e054a51eb905fa23ea7e047357b5a24b5ac4aaf6"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"a76e9eeead825fc51b39457ff3ebb4abaf71b4b6","unresolved":false,"context_lines":[{"line_number":40,"context_line":"      \u003cpara\u003eDashboard indication of volume encryption status.  Includes indication that a volume is encrypted, and includes the encryption parameters such as algorithm and key size\u003c/para\u003e"},{"line_number":41,"context_line":"      \u003c/listitem\u003e"},{"line_number":42,"context_line":"      \u003clistitem\u003e"},{"line_number":43,"context_line":"      \u003cpara\u003eInterface with the Barbican key manager through a secure wrapper\u003c/para\u003e"},{"line_number":44,"context_line":"          \u003citemizedlist\u003e"},{"line_number":45,"context_line":"          \u003clistitem\u003e"},{"line_number":46,"context_line":"          \u003cpara\u003eVolume encryption is supported by back-end key storage for enhanced security (e.g. a Hardware Security Module (HSM) or a KMIP server can be used as a Barbican back-end secret store)\u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":7,"id":"9a80dd14_74ba28e2","line":43,"updated":"2015-03-19 19:09:06.000000000","message":"Use \"Key management service\" instead of Barbican everywhere - see also https://wiki.openstack.org/wiki/Documentation/Conventions#Service_and_project_names","commit_id":"e054a51eb905fa23ea7e047357b5a24b5ac4aaf6"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"a76e9eeead825fc51b39457ff3ebb4abaf71b4b6","unresolved":false,"context_lines":[{"line_number":50,"context_line":"    \u003c/itemizedlist\u003e"},{"line_number":51,"context_line":"    \u003c/section\u003e"},{"line_number":52,"context_line":"     \u003csection xml:id\u003d\"data-encryption-block-storage-ephemeral-disk-encryption\"\u003e"},{"line_number":53,"context_line":"      \u003ctitle\u003eEphemeral Disk Encryption\u003c/title\u003e"},{"line_number":54,"context_line":"      \u003cpara\u003eAn ephemeral disk encryption feature addresses data privacy.  The ephemeral disk is a temporary work space used by the virtual host operating system.  Without encryption, sensitive user information could be accessed on this disk, and vestigial information could remain after the disk is unmounted.  As of the Kilo release, the following ephemeral disk encryption features are supported:\u003c/para\u003e"},{"line_number":55,"context_line":"    \u003citemizedlist\u003e\u003clistitem\u003e"},{"line_number":56,"context_line":"      \u003cpara\u003eCreation and usage of encrypted LVM ephemeral disks\u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":7,"id":"9a80dd14_d4acb4a1","line":53,"updated":"2015-03-19 19:09:06.000000000","message":"Ephemeral disk encryption","commit_id":"e054a51eb905fa23ea7e047357b5a24b5ac4aaf6"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"a76e9eeead825fc51b39457ff3ebb4abaf71b4b6","unresolved":false,"context_lines":[{"line_number":57,"context_line":"           \u003citemizedlist\u003e"},{"line_number":58,"context_line":"          \u003clistitem\u003e"},{"line_number":59,"context_line":"          \u003cpara\u003eNova configuration enables encryption and specifies encryption parameters such as algorithm and key size\u003c/para\u003e"},{"line_number":60,"context_line":"          \u003c/listitem\u003e"},{"line_number":61,"context_line":"          \u003c/itemizedlist\u003e"},{"line_number":62,"context_line":"      \u003c/listitem\u003e"},{"line_number":63,"context_line":"      \u003clistitem\u003e"}],"source_content_type":"application/xml","patch_set":7,"id":"9a80dd14_1492cc56","line":60,"updated":"2015-03-19 19:09:06.000000000","message":"Nova -\u003e Compute, see my earlier comment on conventions.","commit_id":"e054a51eb905fa23ea7e047357b5a24b5ac4aaf6"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"a76e9eeead825fc51b39457ff3ebb4abaf71b4b6","unresolved":false,"context_lines":[{"line_number":67,"context_line":"          \u003cpara\u003eBarbican will support data isolation by providing ephemeral disk encryption keys on a per-tenant basis\u003c/para\u003e"},{"line_number":68,"context_line":"          \u003c/listitem\u003e"},{"line_number":69,"context_line":"          \u003clistitem\u003e"},{"line_number":70,"context_line":"          \u003cpara\u003eEphemeral disk encryption is supported by back-end key storage for enhanced security (e.g. an HSM or a KMIP server can be used as a Barbican back-end secret store)\u003c/para\u003e"},{"line_number":71,"context_line":"          \u003c/listitem\u003e"},{"line_number":72,"context_line":"          \u003clistitem\u003e"},{"line_number":73,"context_line":"          \u003cpara\u003eWith Barbican, when an ephemeral disk is no longer needed, simply deleting the key may take the place of overwriting the ephemeral disk storage area\u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":7,"id":"9a80dd14_f47b7826","line":70,"updated":"2015-03-19 19:09:06.000000000","message":"don\u0027t use e.g., see https://wiki.openstack.org/wiki/Documentation/Conventions#Remove_.22e.g..22","commit_id":"e054a51eb905fa23ea7e047357b5a24b5ac4aaf6"}],"security-guide/section_data-privacy-concerns.xml":[{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"704158fe5dbf73aad459e2f33728b35513d81b6f","unresolved":false,"context_lines":[{"line_number":140,"context_line":"        assurances your chosen volume back end provides and to see what"},{"line_number":141,"context_line":"        mediations may be available for those assurances not"},{"line_number":142,"context_line":"        provided.\u003c/para\u003e"},{"line_number":143,"context_line":"        \u003cpara\u003eFinally, while not a feature of OpenStack, vendors and"},{"line_number":144,"context_line":"          implementors may choose to add or support encryption of volumes."},{"line_number":145,"context_line":"          In this case, destruction of data is as simple as throwing"},{"line_number":146,"context_line":"          away the key.\u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":1,"id":"9a80dd14_8c63acb0","side":"PARENT","line":143,"updated":"2015-03-04 18:12:49.000000000","message":"Suggest retaining \"vendors and implementors...\"","commit_id":"f716fe618424e690878e57bbdb139f71a118d5ca"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"c49a01e894addb827102a1c1b6c8e69aea00054f","unresolved":false,"context_lines":[{"line_number":134,"context_line":"        discussed in the Data Encryption section below.  When this feature is used, "},{"line_number":135,"context_line":"        destruction of data is accomplished by securely deleting the encryption key."},{"line_number":136,"context_line":"        \u003cpara\u003eIn some unique cases, though not an optimum solution, there may be a need to "},{"line_number":137,"context_line":"        implement non-standard overwrite solutions via plugins."},{"line_number":138,"context_line":"        Plugins to OpenStack Block Storage will store data in a variety of ways. Many plug-ins are specific to a vendor or technology, whereas others are more DIY solutions around filesystems such as LVM or ZFS. Methods to securely destroy data will vary from one plugin to another, from one vendor\u0027s solution to another, and from one filesystem to another.\u003c/para\u003e"},{"line_number":139,"context_line":"        \u003cpara\u003eSome back ends such as ZFS will support copy-on-write to"},{"line_number":140,"context_line":"        prevent data exposure. In these cases, reads from unwritten"}],"source_content_type":"application/xml","patch_set":1,"id":"ba7be1f8_8cccdc6b","line":137,"updated":"2015-03-04 05:00:25.000000000","message":"Update via to \u0027through\u0027 or something similar, maybe \"implement a non-standard overwrite solution through the use of a plugin.\" or similar?","commit_id":"1eec58cf37ebc3a86d6cf4a3f9edb043d747dd78"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"704158fe5dbf73aad459e2f33728b35513d81b6f","unresolved":false,"context_lines":[{"line_number":145,"context_line":"        assurances your chosen volume back end provides and to see what"},{"line_number":146,"context_line":"        mediations may be available for those assurances not"},{"line_number":147,"context_line":"        provided.\u003c/para\u003e"},{"line_number":148,"context_line":"        "},{"line_number":149,"context_line":"      \u003c/section\u003e"},{"line_number":150,"context_line":"      \u003csection xml:id\u003d\"data-privacy-concerns-data-disposal-glance-delay-delete\"\u003e"},{"line_number":151,"context_line":"        \u003ctitle\u003eImage Service delay delete feature\u003c/title\u003e"}],"source_content_type":"application/xml","patch_set":1,"id":"9a80dd14_cc468423","line":148,"updated":"2015-03-04 18:12:49.000000000","message":"nit: trailing whitepage","commit_id":"1eec58cf37ebc3a86d6cf4a3f9edb043d747dd78"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"4e1791f672f81b1c53f7bed71d4a9e5310797dbc","unresolved":false,"context_lines":[{"line_number":132,"context_line":"        \u003ctitle\u003eCinder volume data\u003c/title\u003e"},{"line_number":133,"context_line":"        Use of the OpenStack volume encryption feature is highly encouraged. This is"},{"line_number":134,"context_line":"        discussed in the Data Encryption section below.  When this feature is used,"},{"line_number":135,"context_line":"        destruction of data is accomplished by securely deleting the encryption key."},{"line_number":136,"context_line":"        \u003cpara\u003eIn some unique cases, though not an optimum solution, there may be a need to"},{"line_number":137,"context_line":"        implement non-standard overwrite solutions through the use of plugins."},{"line_number":138,"context_line":"        Plugins to OpenStack Block Storage will store data in a variety of ways. Many plug-ins are specific to a vendor or technology, whereas others are more DIY solutions around filesystems such as LVM or ZFS. Methods to securely destroy data will vary from one plugin to another, from one vendor\u0027s solution to another, and from one filesystem to another.\u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":3,"id":"9a80dd14_ca837a54","line":135,"updated":"2015-03-05 22:13:04.000000000","message":"Should this sentence be surrounded by \u003cpara\u003e tags?","commit_id":"b7db84672c392dd811fee119381468ae2719b489"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"4e1791f672f81b1c53f7bed71d4a9e5310797dbc","unresolved":false,"context_lines":[{"line_number":133,"context_line":"        Use of the OpenStack volume encryption feature is highly encouraged. This is"},{"line_number":134,"context_line":"        discussed in the Data Encryption section below.  When this feature is used,"},{"line_number":135,"context_line":"        destruction of data is accomplished by securely deleting the encryption key."},{"line_number":136,"context_line":"        \u003cpara\u003eIn some unique cases, though not an optimum solution, there may be a need to"},{"line_number":137,"context_line":"        implement non-standard overwrite solutions through the use of plugins."},{"line_number":138,"context_line":"        Plugins to OpenStack Block Storage will store data in a variety of ways. Many plug-ins are specific to a vendor or technology, whereas others are more DIY solutions around filesystems such as LVM or ZFS. Methods to securely destroy data will vary from one plugin to another, from one vendor\u0027s solution to another, and from one filesystem to another.\u003c/para\u003e"},{"line_number":139,"context_line":"        \u003cpara\u003eSome back ends such as ZFS will support copy-on-write to"}],"source_content_type":"application/xml","patch_set":3,"id":"9a80dd14_8a56e2d0","line":136,"updated":"2015-03-05 22:13:04.000000000","message":"What unique cases? Can you provide an example?","commit_id":"b7db84672c392dd811fee119381468ae2719b489"},{"author":{"_account_id":10670,"name":"Michael McCune","email":"elmiko@redhat.com","username":"mimccune"},"change_message_id":"db8ae817006820e757d95438a13cbdb4e12e6906","unresolved":false,"context_lines":[{"line_number":132,"context_line":"        \u003ctitle\u003eCinder volume data\u003c/title\u003e"},{"line_number":133,"context_line":"        \u003cpara\u003eUse of the OpenStack volume encryption feature is highly encouraged. This is"},{"line_number":134,"context_line":"        discussed in the Data Encryption section below.  When this feature is used,"},{"line_number":135,"context_line":"        destruction of data is accomplished by securely deleting the encryption key.\u003cpara\u003e"},{"line_number":136,"context_line":"        \u003cpara\u003eIf a backend plugin is being used, there may be independent ways of doing encryption or non-standard overwrite solutions. Plugins to OpenStack Block Storage will store data in a variety of ways. Many plug-ins are specific to a vendor or technology, whereas others are more DIY solutions around filesystems such as LVM or ZFS. Methods to securely destroy data will vary from one plugin to another, from one vendor\u0027s solution to another, and from one filesystem to another.\u003c/para\u003e"},{"line_number":137,"context_line":"        \u003cpara\u003eSome back ends such as ZFS will support copy-on-write to"},{"line_number":138,"context_line":"        prevent data exposure. In these cases, reads from unwritten"}],"source_content_type":"application/xml","patch_set":5,"id":"9a80dd14_2b0de13e","line":135,"updated":"2015-03-12 20:18:44.000000000","message":"the para element should be a closing element","commit_id":"9e8b0fc751ef05e4f2cdb2191cfa49e80a872aff"}],"security-guide/section_key-management.xml":[{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"c49a01e894addb827102a1c1b6c8e69aea00054f","unresolved":false,"context_lines":[{"line_number":7,"context_line":"  \u003c?dbhtml stop-chunking?\u003e"},{"line_number":8,"context_line":"    \u003ctitle\u003eKey management\u003c/title\u003e"},{"line_number":9,"context_line":"    \u003cpara\u003eTo address the often mentioned concern of tenant data privacy and limiting cloud provider liability, there is greater interest within the OpenStack community to make data encryption more ubiquitous. It is relatively easy for an end-user to encrypt their data prior to saving it to the cloud, and this is a viable path for tenant objects such as media files, database archives among others. In some instances, client-side encryption is utilized to encrypt data held by the virtualization technologies which requires client interaction, such as presenting keys, to decrypt data for future use. To seamlessly secure the data and have it accessible without burdening the client with having to manage their keys and interactively provide them calls for a key management service within OpenStack. Providing encryption and key management services as part of OpenStack eases data-at-rest security adoption and addresses customer concerns about privacy or misuse of data, while also limiting cloud provider liability. This can help reduce a provider\u0027s liability when handling tenant data during an incident investigation in multi-tenant public clouds.\u003c/para\u003e"},{"line_number":10,"context_line":"    \u003cpara\u003eA key management service called Barbican is nearing the end of the incubation process, assuming that OpenStack will not deprecate its current incubation process for all future services.  In any case, Barbican has essentially already become the de facto standard in OpenStack at the end of the Kilo development cycle.  Refer to http://docs.openstack.org/developer/barbican/ for details.\u003c/para\u003e"},{"line_number":11,"context_line":"    is in the early stages of being developed and has a way to go before becoming an official component of OpenStack. Refer to \u003clink xlink:href\u003d\"http://docs.openstack.org/developer/barbican/\"\u003ehttp://docs.openstack.org/developer/barbican/\u003c/link\u003e for details.\u003c/para\u003e"},{"line_number":12,"context_line":"    \u003cpara\u003eBarbican shall support the creation of keys, and their secure storage (with a service master-key). Some of the design questions still being debated are how much of the Key Management Interchange Protocol (KMIP) to support, key formats, and certificate management. The key manager will be pluggable to facilitate deployments that need a third-party Hardware Security Module (HSM).\u003c/para\u003e"},{"line_number":13,"context_line":"    \u003cpara\u003eOpenStack Block Storage, cinder, is the first service looking to integrate with the key manager to provide volume encryption.\u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":1,"id":"ba7be1f8_0c638c42","line":10,"updated":"2015-03-04 05:00:25.000000000","message":"1)One of the Jenkins jobs is failing on line length - at 72 characters (or the nearest word break before 72) it should be taken to the next line.\n\n2) I\u0027d really like to rework the \u0027Barbican has essentially already become the de facto standard\u0027 line. \n\n3) Also, as we\u0027re doing away with \"incubation\" for tags, this sentence will be deprecated shortly, and I\u0027m not sure we should integrate a change when we know we\u0027ll need to change it almost immediately (without a specific need to).\n\n4) The barbican documentation is also in the next sentence, so I think the \u0027Refer to...\u0027 line should be removed.","commit_id":"1eec58cf37ebc3a86d6cf4a3f9edb043d747dd78"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"704158fe5dbf73aad459e2f33728b35513d81b6f","unresolved":false,"context_lines":[{"line_number":9,"context_line":"    \u003cpara\u003eTo address the often mentioned concern of tenant data privacy and limiting cloud provider liability, there is greater interest within the OpenStack community to make data encryption more ubiquitous. It is relatively easy for an end-user to encrypt their data prior to saving it to the cloud, and this is a viable path for tenant objects such as media files, database archives among others. In some instances, client-side encryption is utilized to encrypt data held by the virtualization technologies which requires client interaction, such as presenting keys, to decrypt data for future use. To seamlessly secure the data and have it accessible without burdening the client with having to manage their keys and interactively provide them calls for a key management service within OpenStack. Providing encryption and key management services as part of OpenStack eases data-at-rest security adoption and addresses customer concerns about privacy or misuse of data, while also limiting cloud provider liability. This can help reduce a provider\u0027s liability when handling tenant data during an incident investigation in multi-tenant public clouds.\u003c/para\u003e"},{"line_number":10,"context_line":"    \u003cpara\u003eA key management service called Barbican is nearing the end of the incubation process, assuming that OpenStack will not deprecate its current incubation process for all future services.  In any case, Barbican has essentially already become the de facto standard in OpenStack at the end of the Kilo development cycle.  Refer to http://docs.openstack.org/developer/barbican/ for details.\u003c/para\u003e"},{"line_number":11,"context_line":"    is in the early stages of being developed and has a way to go before becoming an official component of OpenStack. Refer to \u003clink xlink:href\u003d\"http://docs.openstack.org/developer/barbican/\"\u003ehttp://docs.openstack.org/developer/barbican/\u003c/link\u003e for details.\u003c/para\u003e"},{"line_number":12,"context_line":"    \u003cpara\u003eBarbican shall support the creation of keys, and their secure storage (with a service master-key). Some of the design questions still being debated are how much of the Key Management Interchange Protocol (KMIP) to support, key formats, and certificate management. The key manager will be pluggable to facilitate deployments that need a third-party Hardware Security Module (HSM).\u003c/para\u003e"},{"line_number":13,"context_line":"    \u003cpara\u003eOpenStack Block Storage, cinder, is the first service looking to integrate with the key manager to provide volume encryption.\u003c/para\u003e"},{"line_number":14,"context_line":"    \u003csection xml:id\u003d\"key-management-references\"\u003e"},{"line_number":15,"context_line":"      \u003ctitle\u003eBibliography:\u003c/title\u003e"}],"source_content_type":"application/xml","patch_set":1,"id":"9a80dd14_ac8230fe","line":12,"updated":"2015-03-04 18:12:49.000000000","message":"May want to remove \"shall\" because Barbican currently provides these capabilities. Also, different Barbican plugins may not use a service master key.","commit_id":"1eec58cf37ebc3a86d6cf4a3f9edb043d747dd78"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"4e1791f672f81b1c53f7bed71d4a9e5310797dbc","unresolved":false,"context_lines":[{"line_number":7,"context_line":"  \u003c?dbhtml stop-chunking?\u003e"},{"line_number":8,"context_line":"    \u003ctitle\u003eKey management\u003c/title\u003e"},{"line_number":9,"context_line":"    \u003cpara\u003eTo address the often mentioned concern of tenant data privacy and limiting cloud provider liability, there is greater interest within the OpenStack community to make data encryption more ubiquitous. It is relatively easy for an end-user to encrypt their data prior to saving it to the cloud, and this is a viable path for tenant objects such as media files, database archives among others. In some instances, client-side encryption is utilized to encrypt data held by the virtualization technologies which requires client interaction, such as presenting keys, to decrypt data for future use. To seamlessly secure the data and have it accessible without burdening the client with having to manage their keys and interactively provide them calls for a key management service within OpenStack. Providing encryption and key management services as part of OpenStack eases data-at-rest security adoption and addresses customer concerns about privacy or misuse of data, while also limiting cloud provider liability. This can help reduce a provider\u0027s liability when handling tenant data during an incident investigation in multi-tenant public clouds.\u003c/para\u003e"},{"line_number":10,"context_line":"    \u003cpara\u003eThe volume encryption and ephemeral disk encryption features rely on Barbican for key management. Barbican supports the creation and secure storage of keys. See reference below for details. The key manager will be pluggable to facilitate deployments that need a third-party Hardware Security Module (HSM) or the use of the Key Management Interchange Protocol (KMIP), which is supported by an open-source project called PyKMIP.\u003c/para\u003e"},{"line_number":11,"context_line":"    \u003csection xml:id\u003d\"key-management-references\"\u003e"},{"line_number":12,"context_line":"      \u003ctitle\u003eBibliography:\u003c/title\u003e"},{"line_number":13,"context_line":"      \u003citemizedlist\u003e"}],"source_content_type":"application/xml","patch_set":3,"id":"9a80dd14_0a111205","line":10,"updated":"2015-03-05 22:13:04.000000000","message":"nit: will be pluggable -\u003e is pluggable","commit_id":"b7db84672c392dd811fee119381468ae2719b489"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"a76e9eeead825fc51b39457ff3ebb4abaf71b4b6","unresolved":false,"context_lines":[{"line_number":7,"context_line":"  \u003c?dbhtml stop-chunking?\u003e"},{"line_number":8,"context_line":"    \u003ctitle\u003eKey management\u003c/title\u003e"},{"line_number":9,"context_line":"    \u003cpara\u003eTo address the often mentioned concern of tenant data privacy and limiting cloud provider liability, there is greater interest within the OpenStack community to make data encryption more ubiquitous. It is relatively easy for an end-user to encrypt their data prior to saving it to the cloud, and this is a viable path for tenant objects such as media files, database archives among others. In some instances, client-side encryption is utilized to encrypt data held by the virtualization technologies which requires client interaction, such as presenting keys, to decrypt data for future use. To seamlessly secure the data and have it accessible without burdening the client with having to manage their keys and interactively provide them calls for a key management service within OpenStack. Providing encryption and key management services as part of OpenStack eases data-at-rest security adoption and addresses customer concerns about privacy or misuse of data, while also limiting cloud provider liability. This can help reduce a provider\u0027s liability when handling tenant data during an incident investigation in multi-tenant public clouds.\u003c/para\u003e"},{"line_number":10,"context_line":"    \u003cpara\u003eThe volume encryption and ephemeral disk encryption features rely on Barbican for key management. Barbican supports the creation and secure storage of keys. See reference below for details. The key manager is pluggable to facilitate deployments that need a third-party Hardware Security Module (HSM) or the use of the Key Management Interchange Protocol (KMIP), which is supported by an open-source project called PyKMIP.\u003c/para\u003e"},{"line_number":11,"context_line":"    \u003csection xml:id\u003d\"key-management-references\"\u003e"},{"line_number":12,"context_line":"      \u003ctitle\u003eBibliography:\u003c/title\u003e"},{"line_number":13,"context_line":"      \u003citemizedlist\u003e"}],"source_content_type":"application/xml","patch_set":7,"id":"9a80dd14_748f8823","line":10,"updated":"2015-03-19 19:09:06.000000000","message":"Barbican -\u003e Key management service","commit_id":"e054a51eb905fa23ea7e047357b5a24b5ac4aaf6"}]}