)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":10497,"name":"KATO Tomoyuki","email":"kato.tomoyuki@jp.fujitsu.com","username":"to222"},"change_message_id":"c351c90b27bc344d0e705f6a9c56fca4c7b4f74c","unresolved":false,"context_lines":[{"line_number":4,"context_line":"Commit:     Bruce Benjamin \u003cbruce.benjamin@jhuapl.edu\u003e"},{"line_number":5,"context_line":"CommitDate: 2015-09-02 18:33:26 -0400"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"[security-guide] Ephemeral encryption setup"},{"line_number":8,"context_line":"The Data Encryption section in the OpenStack security guide needs"},{"line_number":9,"context_line":"some info added to describe how to enable ephemeral disk encryption."},{"line_number":10,"context_line":"Change-Id: I58766ee7481ee9cbba3cd2a960adcaf4809d8ee0"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"da20952f_4953db39","line":7,"updated":"2015-09-03 00:05:57.000000000","message":"need a blank line after the summary.","commit_id":"197cf61294aecd71dbca07db4b6993c817fbccb7"}],"security-guide/source/tenant-data/data-encryption.rst":[{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"247534f7ed3f463ab454817aa66ea2a2bdd0d4cd","unresolved":false,"context_lines":[{"line_number":66,"context_line":""},{"line_number":67,"context_line":"-  Creation and usage of encrypted LVM ephemeral disks"},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"   -  The compute configuration, nova.conf, has the following default"},{"line_number":70,"context_line":"      parameters within the [ephemeral_storage_encryption] section"},{"line_number":71,"context_line":"      - cipher \u003d aes-xts-plain64"},{"line_number":72,"context_line":"        - This field sets the cipher and mode used to encrypt ephemeral"}],"source_content_type":"text/x-rst","patch_set":2,"id":"da20952f_1f9efd06","line":69,"updated":"2015-08-31 17:22:52.000000000","message":":file:`nova.conf`","commit_id":"e40b74f708055eb961b1926b4e9e6652f6893643"},{"author":{"_account_id":6804,"name":"bruce-benjamin","email":"bruce.benjamin@jhuapl.edu","username":"bruce-benjamin"},"change_message_id":"c9167d6ae7a56694d5490abf51808ec1467f7cf4","unresolved":false,"context_lines":[{"line_number":66,"context_line":""},{"line_number":67,"context_line":"-  Creation and usage of encrypted LVM ephemeral disks"},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"   -  The compute configuration, nova.conf, has the following default"},{"line_number":70,"context_line":"      parameters within the [ephemeral_storage_encryption] section"},{"line_number":71,"context_line":"      - cipher \u003d aes-xts-plain64"},{"line_number":72,"context_line":"        - This field sets the cipher and mode used to encrypt ephemeral"}],"source_content_type":"text/x-rst","patch_set":2,"id":"da20952f_5b6c1c08","line":69,"in_reply_to":"da20952f_1f9efd06","updated":"2015-09-02 22:51:12.000000000","message":"Done","commit_id":"e40b74f708055eb961b1926b4e9e6652f6893643"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"247534f7ed3f463ab454817aa66ea2a2bdd0d4cd","unresolved":false,"context_lines":[{"line_number":67,"context_line":"-  Creation and usage of encrypted LVM ephemeral disks"},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"   -  The compute configuration, nova.conf, has the following default"},{"line_number":70,"context_line":"      parameters within the [ephemeral_storage_encryption] section"},{"line_number":71,"context_line":"      - cipher \u003d aes-xts-plain64"},{"line_number":72,"context_line":"        - This field sets the cipher and mode used to encrypt ephemeral"},{"line_number":73,"context_line":"          storage. Aes-xts is recommended by NIST specifically for disk"}],"source_content_type":"text/x-rst","patch_set":2,"id":"da20952f_5f3475fa","line":70,"updated":"2015-08-31 17:22:52.000000000","message":"``[ephemeral_storage_encryption]``","commit_id":"e40b74f708055eb961b1926b4e9e6652f6893643"},{"author":{"_account_id":6804,"name":"bruce-benjamin","email":"bruce.benjamin@jhuapl.edu","username":"bruce-benjamin"},"change_message_id":"c9167d6ae7a56694d5490abf51808ec1467f7cf4","unresolved":false,"context_lines":[{"line_number":67,"context_line":"-  Creation and usage of encrypted LVM ephemeral disks"},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"   -  The compute configuration, nova.conf, has the following default"},{"line_number":70,"context_line":"      parameters within the [ephemeral_storage_encryption] section"},{"line_number":71,"context_line":"      - cipher \u003d aes-xts-plain64"},{"line_number":72,"context_line":"        - This field sets the cipher and mode used to encrypt ephemeral"},{"line_number":73,"context_line":"          storage. Aes-xts is recommended by NIST specifically for disk"}],"source_content_type":"text/x-rst","patch_set":2,"id":"da20952f_1b0c6441","line":70,"in_reply_to":"da20952f_5f3475fa","updated":"2015-09-02 22:51:12.000000000","message":"Done","commit_id":"e40b74f708055eb961b1926b4e9e6652f6893643"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"247534f7ed3f463ab454817aa66ea2a2bdd0d4cd","unresolved":false,"context_lines":[{"line_number":68,"context_line":""},{"line_number":69,"context_line":"   -  The compute configuration, nova.conf, has the following default"},{"line_number":70,"context_line":"      parameters within the [ephemeral_storage_encryption] section"},{"line_number":71,"context_line":"      - cipher \u003d aes-xts-plain64"},{"line_number":72,"context_line":"        - This field sets the cipher and mode used to encrypt ephemeral"},{"line_number":73,"context_line":"          storage. Aes-xts is recommended by NIST specifically for disk"},{"line_number":74,"context_line":"          storage.* Available ciphers depend on kernel support.  At the"}],"source_content_type":"text/x-rst","patch_set":2,"id":"da20952f_9f2e8da3","line":71,"updated":"2015-08-31 17:22:52.000000000","message":":option:`[cipher \u003d aex-xts-plain64]`","commit_id":"e40b74f708055eb961b1926b4e9e6652f6893643"},{"author":{"_account_id":6804,"name":"bruce-benjamin","email":"bruce.benjamin@jhuapl.edu","username":"bruce-benjamin"},"change_message_id":"c9167d6ae7a56694d5490abf51808ec1467f7cf4","unresolved":false,"context_lines":[{"line_number":68,"context_line":""},{"line_number":69,"context_line":"   -  The compute configuration, nova.conf, has the following default"},{"line_number":70,"context_line":"      parameters within the [ephemeral_storage_encryption] section"},{"line_number":71,"context_line":"      - cipher \u003d aes-xts-plain64"},{"line_number":72,"context_line":"        - This field sets the cipher and mode used to encrypt ephemeral"},{"line_number":73,"context_line":"          storage. Aes-xts is recommended by NIST specifically for disk"},{"line_number":74,"context_line":"          storage.* Available ciphers depend on kernel support.  At the"}],"source_content_type":"text/x-rst","patch_set":2,"id":"da20952f_3b092832","line":71,"in_reply_to":"da20952f_9f2e8da3","updated":"2015-09-02 22:51:12.000000000","message":"Done","commit_id":"e40b74f708055eb961b1926b4e9e6652f6893643"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"247534f7ed3f463ab454817aa66ea2a2bdd0d4cd","unresolved":false,"context_lines":[{"line_number":71,"context_line":"      - cipher \u003d aes-xts-plain64"},{"line_number":72,"context_line":"        - This field sets the cipher and mode used to encrypt ephemeral"},{"line_number":73,"context_line":"          storage. Aes-xts is recommended by NIST specifically for disk"},{"line_number":74,"context_line":"          storage.* Available ciphers depend on kernel support.  At the"},{"line_number":75,"context_line":"          command line, type \u0027cyrptsetup benchmark\u0027 to determine the"},{"line_number":76,"context_line":"          available options (and see benchmark results), or go to"},{"line_number":77,"context_line":"          /proc/crypto"}],"source_content_type":"text/x-rst","patch_set":2,"id":"da20952f_4259fa33","line":74,"updated":"2015-08-31 17:22:52.000000000","message":"What is the asterix for here? Should there be a \u0027Note\u0027 interjection here?","commit_id":"e40b74f708055eb961b1926b4e9e6652f6893643"},{"author":{"_account_id":6804,"name":"bruce-benjamin","email":"bruce.benjamin@jhuapl.edu","username":"bruce-benjamin"},"change_message_id":"c9167d6ae7a56694d5490abf51808ec1467f7cf4","unresolved":false,"context_lines":[{"line_number":71,"context_line":"      - cipher \u003d aes-xts-plain64"},{"line_number":72,"context_line":"        - This field sets the cipher and mode used to encrypt ephemeral"},{"line_number":73,"context_line":"          storage. Aes-xts is recommended by NIST specifically for disk"},{"line_number":74,"context_line":"          storage.* Available ciphers depend on kernel support.  At the"},{"line_number":75,"context_line":"          command line, type \u0027cyrptsetup benchmark\u0027 to determine the"},{"line_number":76,"context_line":"          available options (and see benchmark results), or go to"},{"line_number":77,"context_line":"          /proc/crypto"}],"source_content_type":"text/x-rst","patch_set":2,"id":"da20952f_9807031d","line":74,"in_reply_to":"da20952f_4259fa33","updated":"2015-09-02 22:51:12.000000000","message":"Nathaniel, that\u0027s a reference, so I put it in an embedded link.  Done","commit_id":"e40b74f708055eb961b1926b4e9e6652f6893643"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"247534f7ed3f463ab454817aa66ea2a2bdd0d4cd","unresolved":false,"context_lines":[{"line_number":74,"context_line":"          storage.* Available ciphers depend on kernel support.  At the"},{"line_number":75,"context_line":"          command line, type \u0027cyrptsetup benchmark\u0027 to determine the"},{"line_number":76,"context_line":"          available options (and see benchmark results), or go to"},{"line_number":77,"context_line":"          /proc/crypto"},{"line_number":78,"context_line":"      - enabled \u003d false"},{"line_number":79,"context_line":"        - To use ephemeral disk encryption, set enabled \u003d true"},{"line_number":80,"context_line":"      - key_size \u003d 512"}],"source_content_type":"text/x-rst","patch_set":2,"id":"da20952f_df0f2535","line":77,"updated":"2015-08-31 17:22:52.000000000","message":":file:`/proc/crypto`","commit_id":"e40b74f708055eb961b1926b4e9e6652f6893643"},{"author":{"_account_id":6804,"name":"bruce-benjamin","email":"bruce.benjamin@jhuapl.edu","username":"bruce-benjamin"},"change_message_id":"c9167d6ae7a56694d5490abf51808ec1467f7cf4","unresolved":false,"context_lines":[{"line_number":74,"context_line":"          storage.* Available ciphers depend on kernel support.  At the"},{"line_number":75,"context_line":"          command line, type \u0027cyrptsetup benchmark\u0027 to determine the"},{"line_number":76,"context_line":"          available options (and see benchmark results), or go to"},{"line_number":77,"context_line":"          /proc/crypto"},{"line_number":78,"context_line":"      - enabled \u003d false"},{"line_number":79,"context_line":"        - To use ephemeral disk encryption, set enabled \u003d true"},{"line_number":80,"context_line":"      - key_size \u003d 512"}],"source_content_type":"text/x-rst","patch_set":2,"id":"da20952f_9687eb11","line":77,"in_reply_to":"da20952f_df0f2535","updated":"2015-09-02 22:51:12.000000000","message":"Done","commit_id":"e40b74f708055eb961b1926b4e9e6652f6893643"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"247534f7ed3f463ab454817aa66ea2a2bdd0d4cd","unresolved":false,"context_lines":[{"line_number":75,"context_line":"          command line, type \u0027cyrptsetup benchmark\u0027 to determine the"},{"line_number":76,"context_line":"          available options (and see benchmark results), or go to"},{"line_number":77,"context_line":"          /proc/crypto"},{"line_number":78,"context_line":"      - enabled \u003d false"},{"line_number":79,"context_line":"        - To use ephemeral disk encryption, set enabled \u003d true"},{"line_number":80,"context_line":"      - key_size \u003d 512"},{"line_number":81,"context_line":"        - Using the recommended 512-bit setting, the underlying XTS key"}],"source_content_type":"text/x-rst","patch_set":2,"id":"da20952f_8205d211","line":78,"updated":"2015-08-31 17:22:52.000000000","message":":option:`[enabled \u003d false]`","commit_id":"e40b74f708055eb961b1926b4e9e6652f6893643"},{"author":{"_account_id":6804,"name":"bruce-benjamin","email":"bruce.benjamin@jhuapl.edu","username":"bruce-benjamin"},"change_message_id":"c9167d6ae7a56694d5490abf51808ec1467f7cf4","unresolved":false,"context_lines":[{"line_number":75,"context_line":"          command line, type \u0027cyrptsetup benchmark\u0027 to determine the"},{"line_number":76,"context_line":"          available options (and see benchmark results), or go to"},{"line_number":77,"context_line":"          /proc/crypto"},{"line_number":78,"context_line":"      - enabled \u003d false"},{"line_number":79,"context_line":"        - To use ephemeral disk encryption, set enabled \u003d true"},{"line_number":80,"context_line":"      - key_size \u003d 512"},{"line_number":81,"context_line":"        - Using the recommended 512-bit setting, the underlying XTS key"}],"source_content_type":"text/x-rst","patch_set":2,"id":"da20952f_16f99bc8","line":78,"in_reply_to":"da20952f_8205d211","updated":"2015-09-02 22:51:12.000000000","message":"Done","commit_id":"e40b74f708055eb961b1926b4e9e6652f6893643"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"247534f7ed3f463ab454817aa66ea2a2bdd0d4cd","unresolved":false,"context_lines":[{"line_number":76,"context_line":"          available options (and see benchmark results), or go to"},{"line_number":77,"context_line":"          /proc/crypto"},{"line_number":78,"context_line":"      - enabled \u003d false"},{"line_number":79,"context_line":"        - To use ephemeral disk encryption, set enabled \u003d true"},{"line_number":80,"context_line":"      - key_size \u003d 512"},{"line_number":81,"context_line":"        - Using the recommended 512-bit setting, the underlying XTS key"},{"line_number":82,"context_line":"          size is only 256-bit.* Therefore, selecting a key size less than"}],"source_content_type":"text/x-rst","patch_set":2,"id":"da20952f_a21c966a","line":79,"updated":"2015-08-31 17:22:52.000000000","message":":option:`[enabled \u003d true]`","commit_id":"e40b74f708055eb961b1926b4e9e6652f6893643"},{"author":{"_account_id":6804,"name":"bruce-benjamin","email":"bruce.benjamin@jhuapl.edu","username":"bruce-benjamin"},"change_message_id":"c9167d6ae7a56694d5490abf51808ec1467f7cf4","unresolved":false,"context_lines":[{"line_number":76,"context_line":"          available options (and see benchmark results), or go to"},{"line_number":77,"context_line":"          /proc/crypto"},{"line_number":78,"context_line":"      - enabled \u003d false"},{"line_number":79,"context_line":"        - To use ephemeral disk encryption, set enabled \u003d true"},{"line_number":80,"context_line":"      - key_size \u003d 512"},{"line_number":81,"context_line":"        - Using the recommended 512-bit setting, the underlying XTS key"},{"line_number":82,"context_line":"          size is only 256-bit.* Therefore, selecting a key size less than"}],"source_content_type":"text/x-rst","patch_set":2,"id":"da20952f_76e1f7fd","line":79,"in_reply_to":"da20952f_a21c966a","updated":"2015-09-02 22:51:12.000000000","message":"Done","commit_id":"e40b74f708055eb961b1926b4e9e6652f6893643"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"247534f7ed3f463ab454817aa66ea2a2bdd0d4cd","unresolved":false,"context_lines":[{"line_number":77,"context_line":"          /proc/crypto"},{"line_number":78,"context_line":"      - enabled \u003d false"},{"line_number":79,"context_line":"        - To use ephemeral disk encryption, set enabled \u003d true"},{"line_number":80,"context_line":"      - key_size \u003d 512"},{"line_number":81,"context_line":"        - Using the recommended 512-bit setting, the underlying XTS key"},{"line_number":82,"context_line":"          size is only 256-bit.* Therefore, selecting a key size less than"},{"line_number":83,"context_line":"          the 512-bit default is not recommended"}],"source_content_type":"text/x-rst","patch_set":2,"id":"da20952f_42225aa4","line":80,"updated":"2015-08-31 17:22:52.000000000","message":"- :option:`[key_size \u003d 512]`","commit_id":"e40b74f708055eb961b1926b4e9e6652f6893643"},{"author":{"_account_id":6804,"name":"bruce-benjamin","email":"bruce.benjamin@jhuapl.edu","username":"bruce-benjamin"},"change_message_id":"c9167d6ae7a56694d5490abf51808ec1467f7cf4","unresolved":false,"context_lines":[{"line_number":77,"context_line":"          /proc/crypto"},{"line_number":78,"context_line":"      - enabled \u003d false"},{"line_number":79,"context_line":"        - To use ephemeral disk encryption, set enabled \u003d true"},{"line_number":80,"context_line":"      - key_size \u003d 512"},{"line_number":81,"context_line":"        - Using the recommended 512-bit setting, the underlying XTS key"},{"line_number":82,"context_line":"          size is only 256-bit.* Therefore, selecting a key size less than"},{"line_number":83,"context_line":"          the 512-bit default is not recommended"}],"source_content_type":"text/x-rst","patch_set":2,"id":"da20952f_36cb7f74","line":80,"in_reply_to":"da20952f_42225aa4","updated":"2015-09-02 22:51:12.000000000","message":"Done","commit_id":"e40b74f708055eb961b1926b4e9e6652f6893643"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"247534f7ed3f463ab454817aa66ea2a2bdd0d4cd","unresolved":false,"context_lines":[{"line_number":79,"context_line":"        - To use ephemeral disk encryption, set enabled \u003d true"},{"line_number":80,"context_line":"      - key_size \u003d 512"},{"line_number":81,"context_line":"        - Using the recommended 512-bit setting, the underlying XTS key"},{"line_number":82,"context_line":"          size is only 256-bit.* Therefore, selecting a key size less than"},{"line_number":83,"context_line":"          the 512-bit default is not recommended"},{"line_number":84,"context_line":"-  Interface with the Key management service through a secure wrapper"},{"line_number":85,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"da20952f_a24a5653","line":82,"updated":"2015-08-31 17:22:52.000000000","message":"Ditto on the asterix here again.","commit_id":"e40b74f708055eb961b1926b4e9e6652f6893643"},{"author":{"_account_id":6804,"name":"bruce-benjamin","email":"bruce.benjamin@jhuapl.edu","username":"bruce-benjamin"},"change_message_id":"c9167d6ae7a56694d5490abf51808ec1467f7cf4","unresolved":false,"context_lines":[{"line_number":79,"context_line":"        - To use ephemeral disk encryption, set enabled \u003d true"},{"line_number":80,"context_line":"      - key_size \u003d 512"},{"line_number":81,"context_line":"        - Using the recommended 512-bit setting, the underlying XTS key"},{"line_number":82,"context_line":"          size is only 256-bit.* Therefore, selecting a key size less than"},{"line_number":83,"context_line":"          the 512-bit default is not recommended"},{"line_number":84,"context_line":"-  Interface with the Key management service through a secure wrapper"},{"line_number":85,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"da20952f_0302a409","line":82,"in_reply_to":"da20952f_a24a5653","updated":"2015-09-02 22:51:12.000000000","message":"Done","commit_id":"e40b74f708055eb961b1926b4e9e6652f6893643"},{"author":{"_account_id":10497,"name":"KATO Tomoyuki","email":"kato.tomoyuki@jp.fujitsu.com","username":"to222"},"change_message_id":"574eb90b15bc2a2600334f6d1517e3eb4f271738","unresolved":false,"context_lines":[{"line_number":65,"context_line":"release, the following ephemeral disk encryption features are supported:"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"-  Creation and usage of encrypted LVM ephemeral disks"},{"line_number":68,"context_line":"   -  The compute configuration, :nova.conf:, has the following default"},{"line_number":69,"context_line":"      parameters within the \"[ephemeral_storage_encryption]\" section"},{"line_number":70,"context_line":"      - :option:\u0027cipher \u003d aes-xts-plain64\u0027"},{"line_number":71,"context_line":"        - This field sets the cipher and mode used to encrypt ephemeral"}],"source_content_type":"text/x-rst","patch_set":4,"id":"da20952f_d4509f34","line":68,"updated":"2015-09-04 11:03:49.000000000","message":"need blank line before a different level item.","commit_id":"f68b6519c3f2f924be6a60a2224129d99c4895ed"},{"author":{"_account_id":6804,"name":"bruce-benjamin","email":"bruce.benjamin@jhuapl.edu","username":"bruce-benjamin"},"change_message_id":"0874837db227edeef3dbc8a03c10253c378cc08e","unresolved":false,"context_lines":[{"line_number":65,"context_line":"release, the following ephemeral disk encryption features are supported:"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"-  Creation and usage of encrypted LVM ephemeral disks"},{"line_number":68,"context_line":"   -  The compute configuration, :nova.conf:, has the following default"},{"line_number":69,"context_line":"      parameters within the \"[ephemeral_storage_encryption]\" section"},{"line_number":70,"context_line":"      - :option:\u0027cipher \u003d aes-xts-plain64\u0027"},{"line_number":71,"context_line":"        - This field sets the cipher and mode used to encrypt ephemeral"}],"source_content_type":"text/x-rst","patch_set":4,"id":"da20952f_d65c104d","line":68,"in_reply_to":"da20952f_d4509f34","updated":"2015-09-04 19:05:23.000000000","message":"Done","commit_id":"f68b6519c3f2f924be6a60a2224129d99c4895ed"},{"author":{"_account_id":10497,"name":"KATO Tomoyuki","email":"kato.tomoyuki@jp.fujitsu.com","username":"to222"},"change_message_id":"574eb90b15bc2a2600334f6d1517e3eb4f271738","unresolved":false,"context_lines":[{"line_number":67,"context_line":"-  Creation and usage of encrypted LVM ephemeral disks"},{"line_number":68,"context_line":"   -  The compute configuration, :nova.conf:, has the following default"},{"line_number":69,"context_line":"      parameters within the \"[ephemeral_storage_encryption]\" section"},{"line_number":70,"context_line":"      - :option:\u0027cipher \u003d aes-xts-plain64\u0027"},{"line_number":71,"context_line":"        - This field sets the cipher and mode used to encrypt ephemeral"},{"line_number":72,"context_line":"          storage. Aes-xts is recommended by NIST_ specifically for disk"},{"line_number":73,"context_line":"          storage. Available ciphers depend on kernel support.  At the"}],"source_content_type":"text/x-rst","patch_set":4,"id":"da20952f_f455a31d","line":70,"updated":"2015-09-04 11:03:49.000000000","message":"ditto. and, all over.","commit_id":"f68b6519c3f2f924be6a60a2224129d99c4895ed"},{"author":{"_account_id":6804,"name":"bruce-benjamin","email":"bruce.benjamin@jhuapl.edu","username":"bruce-benjamin"},"change_message_id":"0874837db227edeef3dbc8a03c10253c378cc08e","unresolved":false,"context_lines":[{"line_number":67,"context_line":"-  Creation and usage of encrypted LVM ephemeral disks"},{"line_number":68,"context_line":"   -  The compute configuration, :nova.conf:, has the following default"},{"line_number":69,"context_line":"      parameters within the \"[ephemeral_storage_encryption]\" section"},{"line_number":70,"context_line":"      - :option:\u0027cipher \u003d aes-xts-plain64\u0027"},{"line_number":71,"context_line":"        - This field sets the cipher and mode used to encrypt ephemeral"},{"line_number":72,"context_line":"          storage. Aes-xts is recommended by NIST_ specifically for disk"},{"line_number":73,"context_line":"          storage. Available ciphers depend on kernel support.  At the"}],"source_content_type":"text/x-rst","patch_set":4,"id":"da20952f_36a22caf","line":70,"in_reply_to":"da20952f_f455a31d","updated":"2015-09-04 19:05:23.000000000","message":"Done.  Thanks Kato.","commit_id":"f68b6519c3f2f924be6a60a2224129d99c4895ed"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"97fba1ec5ee3974a0abaf3b362f30c57a1af1d4f","unresolved":false,"context_lines":[{"line_number":72,"context_line":"      - **option**: \u0027cipher \u003d aes-xts-plain64\u0027"},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"        - This field sets the cipher and mode used to encrypt ephemeral"},{"line_number":75,"context_line":"          storage. Aes-xts is recommended by NIST_ specifically for disk"},{"line_number":76,"context_line":"          storage. Available ciphers depend on kernel support.  At the"},{"line_number":77,"context_line":"          command line, type \u0027cyrptsetup benchmark\u0027 to determine the"},{"line_number":78,"context_line":"          available options (and see benchmark results), or go to"}],"source_content_type":"text/x-rst","patch_set":6,"id":"da20952f_a84c9142","line":75,"updated":"2015-09-04 21:52:40.000000000","message":"I think this should always be capitalized as AES-XTS","commit_id":"86ac5227237c610744c05127f2d1ab654876b3df"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"97fba1ec5ee3974a0abaf3b362f30c57a1af1d4f","unresolved":false,"context_lines":[{"line_number":86,"context_line":""},{"line_number":87,"context_line":"        - Using the recommended 512-bit setting, the underlying XTS key"},{"line_number":88,"context_line":"          size is only 256-bit (see NIST_). Therefore, selecting a key size"},{"line_number":89,"context_line":"          less than the 512-bit default is not recommended"},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"-  Interface with the Key management service through a secure wrapper"},{"line_number":92,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"da20952f_6869998b","line":89,"updated":"2015-09-04 21:52:40.000000000","message":"Technically there\u0027s nothing wrong with 128bit AES 0 I don\u0027t think we should be telling users it\u0027s bad. Much like horsepower and megapixels, bigger might be nice but might not always be the best tradeoff.","commit_id":"86ac5227237c610744c05127f2d1ab654876b3df"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"75cb360f588077ff99965e95b70506f4e95b522d","unresolved":false,"context_lines":[{"line_number":72,"context_line":"      - **option**: \u0027cipher \u003d aes-xts-plain64\u0027"},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"        - This field sets the cipher and mode used to encrypt ephemeral"},{"line_number":75,"context_line":"          storage. Aes-xts is recommended by NIST_ specifically for disk"},{"line_number":76,"context_line":"          storage. Available ciphers depend on kernel support.  At the"},{"line_number":77,"context_line":"          command line, type \u0027cyrptsetup benchmark\u0027 to determine the"},{"line_number":78,"context_line":"          available options (and see benchmark results), or go to"}],"source_content_type":"text/x-rst","patch_set":7,"id":"da20952f_28de4111","line":75,"updated":"2015-09-04 21:55:51.000000000","message":"I think this should be capitalized as AES-XTS","commit_id":"d7bf28e68aafc32bffea2583e1beabd1ef089117"},{"author":{"_account_id":6804,"name":"bruce-benjamin","email":"bruce.benjamin@jhuapl.edu","username":"bruce-benjamin"},"change_message_id":"d6e61388e02dafa181a28b6c490d094767a70cac","unresolved":false,"context_lines":[{"line_number":72,"context_line":"      - **option**: \u0027cipher \u003d aes-xts-plain64\u0027"},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"        - This field sets the cipher and mode used to encrypt ephemeral"},{"line_number":75,"context_line":"          storage. Aes-xts is recommended by NIST_ specifically for disk"},{"line_number":76,"context_line":"          storage. Available ciphers depend on kernel support.  At the"},{"line_number":77,"context_line":"          command line, type \u0027cyrptsetup benchmark\u0027 to determine the"},{"line_number":78,"context_line":"          available options (and see benchmark results), or go to"}],"source_content_type":"text/x-rst","patch_set":7,"id":"da20952f_55c1cd2d","line":75,"in_reply_to":"da20952f_28de4111","updated":"2015-09-05 02:13:53.000000000","message":"Done","commit_id":"d7bf28e68aafc32bffea2583e1beabd1ef089117"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"75cb360f588077ff99965e95b70506f4e95b522d","unresolved":false,"context_lines":[{"line_number":86,"context_line":""},{"line_number":87,"context_line":"        - Using the recommended 512-bit setting, the underlying XTS key"},{"line_number":88,"context_line":"          size is only 256-bit (see NIST_). Therefore, selecting a key size"},{"line_number":89,"context_line":"          less than the 512-bit default is not recommended"},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"-  Interface with the Key management service through a secure wrapper"},{"line_number":92,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"da20952f_08b25de5","line":89,"updated":"2015-09-04 21:55:51.000000000","message":"I don\u0027t think there\u0027s any reason to recommend against 128 bit encryption. Indeed users without access to AES-NI accelerated cryptoprocessing might choose to balance out performance with security. \n\nI don\u0027t think the security guide should be stating \"we don\u0027t recommend 128 bit encryption\" but perhaps we can express a preference for 256bit.","commit_id":"d7bf28e68aafc32bffea2583e1beabd1ef089117"},{"author":{"_account_id":6804,"name":"bruce-benjamin","email":"bruce.benjamin@jhuapl.edu","username":"bruce-benjamin"},"change_message_id":"d6e61388e02dafa181a28b6c490d094767a70cac","unresolved":false,"context_lines":[{"line_number":86,"context_line":""},{"line_number":87,"context_line":"        - Using the recommended 512-bit setting, the underlying XTS key"},{"line_number":88,"context_line":"          size is only 256-bit (see NIST_). Therefore, selecting a key size"},{"line_number":89,"context_line":"          less than the 512-bit default is not recommended"},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"-  Interface with the Key management service through a secure wrapper"},{"line_number":92,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"da20952f_75be51af","line":89,"in_reply_to":"da20952f_08b25de5","updated":"2015-09-05 02:13:53.000000000","message":"Done","commit_id":"d7bf28e68aafc32bffea2583e1beabd1ef089117"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"102ec0e5c6bea1e34166d1f4a9bf01a00c5908a4","unresolved":false,"context_lines":[{"line_number":85,"context_line":"      - **option**: \u0027key_size \u003d 512\u0027"},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"        - Using the recommended 512-bit setting, the underlying XTS key"},{"line_number":88,"context_line":"          size is only 256-bit (see NIST_)"},{"line_number":89,"context_line":""},{"line_number":90,"context_line":"-  Interface with the Key management service through a secure wrapper"},{"line_number":91,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"da20952f_97d5241d","line":88,"updated":"2015-09-05 15:37:35.000000000","message":"Perhaps something a little more expressive here?\n- AES-XTS is shorthand for AES encryption using the XTS encryption mode. XTS requires it\u0027s own \"tweak key\" in addition to the encryption key AES requires. This is often expressed as a single large key. In this case a 512bit key - 256bits of which will be used by AES and 256bits by XTS (see NIST_)","commit_id":"a2fffae02b9898161727d828a30f41daafffdbdc"},{"author":{"_account_id":6804,"name":"bruce-benjamin","email":"bruce.benjamin@jhuapl.edu","username":"bruce-benjamin"},"change_message_id":"75ea9a6d727716e76372e53870df05d4e9532e38","unresolved":false,"context_lines":[{"line_number":85,"context_line":"      - **option**: \u0027key_size \u003d 512\u0027"},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"        - Using the recommended 512-bit setting, the underlying XTS key"},{"line_number":88,"context_line":"          size is only 256-bit (see NIST_)"},{"line_number":89,"context_line":""},{"line_number":90,"context_line":"-  Interface with the Key management service through a secure wrapper"},{"line_number":91,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"da20952f_65131a5d","line":88,"in_reply_to":"da20952f_3f59dd8e","updated":"2015-09-11 14:47:55.000000000","message":"Thanks for the feedback on this, Rob and Joel.  The next patch will address this.","commit_id":"a2fffae02b9898161727d828a30f41daafffdbdc"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"c2c9a257cfdf505d88d3f962a6ce6f03dcce36b0","unresolved":false,"context_lines":[{"line_number":85,"context_line":"      - **option**: \u0027key_size \u003d 512\u0027"},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"        - Using the recommended 512-bit setting, the underlying XTS key"},{"line_number":88,"context_line":"          size is only 256-bit (see NIST_)"},{"line_number":89,"context_line":""},{"line_number":90,"context_line":"-  Interface with the Key management service through a secure wrapper"},{"line_number":91,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"da20952f_3f59dd8e","line":88,"in_reply_to":"da20952f_97d5241d","updated":"2015-09-10 16:19:14.000000000","message":"Agree. I think that wording is better for anyone who isn\u0027t familiar with AES-XTS (e.g., operators who don\u0027t have an extensive background in security).","commit_id":"a2fffae02b9898161727d828a30f41daafffdbdc"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"5f58f0b1bef7af360074f42f62d9344ae1675392","unresolved":false,"context_lines":[{"line_number":65,"context_line":"release, the following ephemeral disk encryption features are supported:"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"-  Creation and usage of encrypted LVM ephemeral disks (Note: At this time"},{"line_number":68,"context_line":"   Nova only supports ephemeral disks in the LVM format)"},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"   -  The compute configuration, *nova.conf*, has the following default"},{"line_number":71,"context_line":"      parameters within the \"[ephemeral_storage_encryption]\" section"}],"source_content_type":"text/x-rst","patch_set":10,"id":"da20952f_dd03d274","line":68,"updated":"2015-09-11 21:32:06.000000000","message":"nit: supports ephemeral disks -\u003e supports encrypting ephemeral disks","commit_id":"49a09bc896e15d4a23e1dcaf1d07678d13ca66b5"},{"author":{"_account_id":6804,"name":"bruce-benjamin","email":"bruce.benjamin@jhuapl.edu","username":"bruce-benjamin"},"change_message_id":"cd4a327914a48286c4cb51c271ca323a9ad1b25b","unresolved":false,"context_lines":[{"line_number":65,"context_line":"release, the following ephemeral disk encryption features are supported:"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"-  Creation and usage of encrypted LVM ephemeral disks (Note: At this time"},{"line_number":68,"context_line":"   Nova only supports ephemeral disks in the LVM format)"},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"   -  The compute configuration, *nova.conf*, has the following default"},{"line_number":71,"context_line":"      parameters within the \"[ephemeral_storage_encryption]\" section"}],"source_content_type":"text/x-rst","patch_set":10,"id":"da20952f_f803440b","line":68,"in_reply_to":"da20952f_dd03d274","updated":"2015-09-11 21:50:12.000000000","message":"Done","commit_id":"49a09bc896e15d4a23e1dcaf1d07678d13ca66b5"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"820a84a399676854b4621cc5163e057c4efd5a1c","unresolved":false,"context_lines":[{"line_number":64,"context_line":"vestigial information could remain after the disk is unmounted. As of the Kilo"},{"line_number":65,"context_line":"release, the following ephemeral disk encryption features are supported:"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"-  Creation and usage of encrypted LVM ephemeral disks (Note: At this time"},{"line_number":68,"context_line":"   Nova only supports encrypting ephemeral disks in the LVM format)"},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"   -  The compute configuration, *nova.conf*, has the following default"}],"source_content_type":"text/x-rst","patch_set":11,"id":"ba15a1d1_7a7c8372","line":67,"updated":"2015-09-14 20:18:00.000000000","message":"lowercase note","commit_id":"e9181451c83ae986e3a3cdca82bdf7f95433b685"},{"author":{"_account_id":6804,"name":"bruce-benjamin","email":"bruce.benjamin@jhuapl.edu","username":"bruce-benjamin"},"change_message_id":"79e17ee7e98e24958d1d550b1d480f1682de4e85","unresolved":false,"context_lines":[{"line_number":64,"context_line":"vestigial information could remain after the disk is unmounted. As of the Kilo"},{"line_number":65,"context_line":"release, the following ephemeral disk encryption features are supported:"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"-  Creation and usage of encrypted LVM ephemeral disks (Note: At this time"},{"line_number":68,"context_line":"   Nova only supports encrypting ephemeral disks in the LVM format)"},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"   -  The compute configuration, *nova.conf*, has the following default"}],"source_content_type":"text/x-rst","patch_set":11,"id":"ba15a1d1_9aedd78d","line":67,"in_reply_to":"ba15a1d1_7a7c8372","updated":"2015-09-14 20:35:09.000000000","message":"Done","commit_id":"e9181451c83ae986e3a3cdca82bdf7f95433b685"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"820a84a399676854b4621cc5163e057c4efd5a1c","unresolved":false,"context_lines":[{"line_number":65,"context_line":"release, the following ephemeral disk encryption features are supported:"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"-  Creation and usage of encrypted LVM ephemeral disks (Note: At this time"},{"line_number":68,"context_line":"   Nova only supports encrypting ephemeral disks in the LVM format)"},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"   -  The compute configuration, *nova.conf*, has the following default"},{"line_number":71,"context_line":"      parameters within the \"[ephemeral_storage_encryption]\" section"}],"source_content_type":"text/x-rst","patch_set":11,"id":"ba15a1d1_fab9732f","line":68,"updated":"2015-09-14 20:18:00.000000000","message":"Nova -\u003e OpenStack Compute service, see https://wiki.openstack.org/wiki/Documentation/Conventions#Service_and_project_names","commit_id":"e9181451c83ae986e3a3cdca82bdf7f95433b685"},{"author":{"_account_id":6804,"name":"bruce-benjamin","email":"bruce.benjamin@jhuapl.edu","username":"bruce-benjamin"},"change_message_id":"79e17ee7e98e24958d1d550b1d480f1682de4e85","unresolved":false,"context_lines":[{"line_number":65,"context_line":"release, the following ephemeral disk encryption features are supported:"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"-  Creation and usage of encrypted LVM ephemeral disks (Note: At this time"},{"line_number":68,"context_line":"   Nova only supports encrypting ephemeral disks in the LVM format)"},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"   -  The compute configuration, *nova.conf*, has the following default"},{"line_number":71,"context_line":"      parameters within the \"[ephemeral_storage_encryption]\" section"}],"source_content_type":"text/x-rst","patch_set":11,"id":"ba15a1d1_5a009f34","line":68,"in_reply_to":"ba15a1d1_fab9732f","updated":"2015-09-14 20:35:09.000000000","message":"Done","commit_id":"e9181451c83ae986e3a3cdca82bdf7f95433b685"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"820a84a399676854b4621cc5163e057c4efd5a1c","unresolved":false,"context_lines":[{"line_number":67,"context_line":"-  Creation and usage of encrypted LVM ephemeral disks (Note: At this time"},{"line_number":68,"context_line":"   Nova only supports encrypting ephemeral disks in the LVM format)"},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"   -  The compute configuration, *nova.conf*, has the following default"},{"line_number":71,"context_line":"      parameters within the \"[ephemeral_storage_encryption]\" section"},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"      - **option**: \u0027cipher \u003d aes-xts-plain64\u0027"}],"source_content_type":"text/x-rst","patch_set":11,"id":"ba15a1d1_da87cf5f","line":70,"updated":"2015-09-14 20:18:00.000000000","message":":file:`nova.conf`","commit_id":"e9181451c83ae986e3a3cdca82bdf7f95433b685"},{"author":{"_account_id":6804,"name":"bruce-benjamin","email":"bruce.benjamin@jhuapl.edu","username":"bruce-benjamin"},"change_message_id":"79e17ee7e98e24958d1d550b1d480f1682de4e85","unresolved":false,"context_lines":[{"line_number":67,"context_line":"-  Creation and usage of encrypted LVM ephemeral disks (Note: At this time"},{"line_number":68,"context_line":"   Nova only supports encrypting ephemeral disks in the LVM format)"},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"   -  The compute configuration, *nova.conf*, has the following default"},{"line_number":71,"context_line":"      parameters within the \"[ephemeral_storage_encryption]\" section"},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"      - **option**: \u0027cipher \u003d aes-xts-plain64\u0027"}],"source_content_type":"text/x-rst","patch_set":11,"id":"ba15a1d1_fafc1340","line":70,"in_reply_to":"ba15a1d1_da87cf5f","updated":"2015-09-14 20:35:09.000000000","message":"Done","commit_id":"e9181451c83ae986e3a3cdca82bdf7f95433b685"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"94249172630c8f63d424b01d4def79a782af18fb","unresolved":false,"context_lines":[{"line_number":64,"context_line":"vestigial information could remain after the disk is unmounted. As of the Kilo"},{"line_number":65,"context_line":"release, the following ephemeral disk encryption features are supported:"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"-  Creation and usage of encrypted LVM ephemeral disks (note: At this time"},{"line_number":68,"context_line":"   OpenStack Compute service only supports encrypting ephemeral disks in the"},{"line_number":69,"context_line":"   LVM format)"},{"line_number":70,"context_line":""}],"source_content_type":"text/x-rst","patch_set":12,"id":"ba15a1d1_f1365fe6","line":67,"updated":"2015-09-15 11:10:51.000000000","message":"perhaps consider tagging this to a version. \"This time\" probably isn\u0027t known to the reader. \"Kilo/Juno/Whatever\" probably makes more sense?","commit_id":"3f2f203291af66f4306c6d49d0fac80bc665931a"},{"author":{"_account_id":6804,"name":"bruce-benjamin","email":"bruce.benjamin@jhuapl.edu","username":"bruce-benjamin"},"change_message_id":"a51821c23bbf7827cecb19203a9afc74a6295538","unresolved":false,"context_lines":[{"line_number":64,"context_line":"vestigial information could remain after the disk is unmounted. As of the Kilo"},{"line_number":65,"context_line":"release, the following ephemeral disk encryption features are supported:"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"-  Creation and usage of encrypted LVM ephemeral disks (note: At this time"},{"line_number":68,"context_line":"   OpenStack Compute service only supports encrypting ephemeral disks in the"},{"line_number":69,"context_line":"   LVM format)"},{"line_number":70,"context_line":""}],"source_content_type":"text/x-rst","patch_set":12,"id":"ba15a1d1_b7b3704c","line":67,"in_reply_to":"ba15a1d1_f1365fe6","updated":"2015-09-17 22:38:07.000000000","message":"Rob, I was trying to convey that what\u0027s described in the text only covers LVM, but future formats might come later. The security guide would need to be updated to include the other formats if that\u0027s the case. If you think the text causes confusion I could do another bug fix.","commit_id":"3f2f203291af66f4306c6d49d0fac80bc665931a"}]}