)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"7d044bc9d1708557eed036584e604d640fbec27d","unresolved":false,"context_lines":[{"line_number":7,"context_line":"Bring Your Own Key Castellan Implementation"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"This purpose of this specification is to draw attention to the"},{"line_number":10,"context_line":"need of BYOK solutions within Openstack Projects using"},{"line_number":11,"context_line":"encryption. It also provides a solution to the path to simple"},{"line_number":12,"context_line":"integration."},{"line_number":13,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"7a5de9d1_b3e6c642","line":10,"range":{"start_line":10,"start_character":30,"end_line":10,"end_character":39},"updated":"2016-02-02 21:00:05.000000000","message":"nit: Openstack -\u003e OpenStack","commit_id":"994e1f8f0c022eeeec7a50c1dacb8b1af6daa944"}],"specs/mikata/byok/byok-castellan.rst":[{"author":{"_account_id":14926,"name":"Jeff Feng","email":"jianhua@us.ibm.com","username":"jhfeng"},"change_message_id":"09f789fdf93d5b3cae13c675a0ec6c715e7c201a","unresolved":false,"context_lines":[{"line_number":10,"context_line":"In order for Openstack to draw in more customers to enterprise security"},{"line_number":11,"context_line":"solutions it must allow the user to bring their own key. The user will"},{"line_number":12,"context_line":"essential be responsible for their own keys. The cloud service will never"},{"line_number":13,"context_line":"see the keys. This adds additional security because in the case that a"},{"line_number":14,"context_line":"cloud provider database is breached, the hacker will not obtain keys"},{"line_number":15,"context_line":"since they are managed by the user."},{"line_number":16,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"9a68dd71_b6f79f8b","line":13,"updated":"2016-01-26 15:59:34.000000000","message":"s/see/manage","commit_id":"356c6e3498de61936ed047a6c2bb424fe34172f9"},{"author":{"_account_id":16046,"name":"Fernando Diaz","email":"diazjf@us.ibm.com","username":"diazjf"},"change_message_id":"39cd59f4efe6283e3b74d98b3d04ac7458c570fd","unresolved":false,"context_lines":[{"line_number":10,"context_line":"In order for Openstack to draw in more customers to enterprise security"},{"line_number":11,"context_line":"solutions it must allow the user to bring their own key. The user will"},{"line_number":12,"context_line":"essential be responsible for their own keys. The cloud service will never"},{"line_number":13,"context_line":"see the keys. This adds additional security because in the case that a"},{"line_number":14,"context_line":"cloud provider database is breached, the hacker will not obtain keys"},{"line_number":15,"context_line":"since they are managed by the user."},{"line_number":16,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a5de9d1_3182d953","line":13,"in_reply_to":"9a68dd71_b6f79f8b","updated":"2016-01-27 17:26:23.000000000","message":"Done","commit_id":"356c6e3498de61936ed047a6c2bb424fe34172f9"},{"author":{"_account_id":14926,"name":"Jeff Feng","email":"jianhua@us.ibm.com","username":"jhfeng"},"change_message_id":"09f789fdf93d5b3cae13c675a0ec6c715e7c201a","unresolved":false,"context_lines":[{"line_number":11,"context_line":"solutions it must allow the user to bring their own key. The user will"},{"line_number":12,"context_line":"essential be responsible for their own keys. The cloud service will never"},{"line_number":13,"context_line":"see the keys. This adds additional security because in the case that a"},{"line_number":14,"context_line":"cloud provider database is breached, the hacker will not obtain keys"},{"line_number":15,"context_line":"since they are managed by the user."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"Providing this feature allows Openstack to draw in customers with policies"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9a68dd71_36940fe7","line":14,"updated":"2016-01-26 15:59:34.000000000","message":"s/keys/keys and key metadata","commit_id":"356c6e3498de61936ed047a6c2bb424fe34172f9"},{"author":{"_account_id":16046,"name":"Fernando Diaz","email":"diazjf@us.ibm.com","username":"diazjf"},"change_message_id":"39cd59f4efe6283e3b74d98b3d04ac7458c570fd","unresolved":false,"context_lines":[{"line_number":11,"context_line":"solutions it must allow the user to bring their own key. The user will"},{"line_number":12,"context_line":"essential be responsible for their own keys. The cloud service will never"},{"line_number":13,"context_line":"see the keys. This adds additional security because in the case that a"},{"line_number":14,"context_line":"cloud provider database is breached, the hacker will not obtain keys"},{"line_number":15,"context_line":"since they are managed by the user."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"Providing this feature allows Openstack to draw in customers with policies"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a5de9d1_91170ded","line":14,"in_reply_to":"9a68dd71_36940fe7","updated":"2016-01-27 17:26:23.000000000","message":"Done","commit_id":"356c6e3498de61936ed047a6c2bb424fe34172f9"},{"author":{"_account_id":14926,"name":"Jeff Feng","email":"jianhua@us.ibm.com","username":"jhfeng"},"change_message_id":"09f789fdf93d5b3cae13c675a0ec6c715e7c201a","unresolved":false,"context_lines":[{"line_number":28,"context_line":"``get_key`` operation to use for either decrypting or encrypting an object."},{"line_number":29,"context_line":"Otherwise it will grab the secret from the appropriate backend, following"},{"line_number":30,"context_line":"Castellan’s standard flow. The reason why Castellan will be used is because"},{"line_number":31,"context_line":"it is or will be used in many Openstack Services. Making changes in Castellan"},{"line_number":32,"context_line":"will avoid making big changes in all the other Projects."},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"This implementation will add the BYOK use case for organization’s with stringent"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9a68dd71_91ee25b3","line":31,"updated":"2016-01-26 15:59:34.000000000","message":"...will be common key management interface used in many...","commit_id":"356c6e3498de61936ed047a6c2bb424fe34172f9"},{"author":{"_account_id":16046,"name":"Fernando Diaz","email":"diazjf@us.ibm.com","username":"diazjf"},"change_message_id":"39cd59f4efe6283e3b74d98b3d04ac7458c570fd","unresolved":false,"context_lines":[{"line_number":28,"context_line":"``get_key`` operation to use for either decrypting or encrypting an object."},{"line_number":29,"context_line":"Otherwise it will grab the secret from the appropriate backend, following"},{"line_number":30,"context_line":"Castellan’s standard flow. The reason why Castellan will be used is because"},{"line_number":31,"context_line":"it is or will be used in many Openstack Services. Making changes in Castellan"},{"line_number":32,"context_line":"will avoid making big changes in all the other Projects."},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"This implementation will add the BYOK use case for organization’s with stringent"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a5de9d1_b1ca494e","line":31,"in_reply_to":"9a68dd71_91ee25b3","updated":"2016-01-27 17:26:23.000000000","message":"Done","commit_id":"356c6e3498de61936ed047a6c2bb424fe34172f9"},{"author":{"_account_id":14926,"name":"Jeff Feng","email":"jianhua@us.ibm.com","username":"jhfeng"},"change_message_id":"09f789fdf93d5b3cae13c675a0ec6c715e7c201a","unresolved":false,"context_lines":[{"line_number":30,"context_line":"Castellan’s standard flow. The reason why Castellan will be used is because"},{"line_number":31,"context_line":"it is or will be used in many Openstack Services. Making changes in Castellan"},{"line_number":32,"context_line":"will avoid making big changes in all the other Projects."},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"This implementation will add the BYOK use case for organization’s with stringent"},{"line_number":35,"context_line":"data access requirements, while maintaining a way for other customer’s to have"},{"line_number":36,"context_line":"the service provider manage their keys."}],"source_content_type":"text/x-rst","patch_set":1,"id":"9a68dd71_6ca95824","line":33,"updated":"2016-01-26 15:59:34.000000000","message":"Need add the proposed idea that each service, when using encryption, should extend their appropriate APIs to add secret/key argument. \n\nAdd a Impact section\n   - API impact in each services","commit_id":"356c6e3498de61936ed047a6c2bb424fe34172f9"},{"author":{"_account_id":16046,"name":"Fernando Diaz","email":"diazjf@us.ibm.com","username":"diazjf"},"change_message_id":"39cd59f4efe6283e3b74d98b3d04ac7458c570fd","unresolved":false,"context_lines":[{"line_number":30,"context_line":"Castellan’s standard flow. The reason why Castellan will be used is because"},{"line_number":31,"context_line":"it is or will be used in many Openstack Services. Making changes in Castellan"},{"line_number":32,"context_line":"will avoid making big changes in all the other Projects."},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"This implementation will add the BYOK use case for organization’s with stringent"},{"line_number":35,"context_line":"data access requirements, while maintaining a way for other customer’s to have"},{"line_number":36,"context_line":"the service provider manage their keys."}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a5de9d1_f16c410a","line":33,"in_reply_to":"9a68dd71_6ca95824","updated":"2016-01-27 17:26:23.000000000","message":"Done","commit_id":"356c6e3498de61936ed047a6c2bb424fe34172f9"},{"author":{"_account_id":8623,"name":"Kaitlin Farr","email":"kaitlin.farr@jhuapl.edu","username":"kaitlin.farr"},"change_message_id":"88010e94114a1104a64d9df6a4c2757686ed0e60","unresolved":false,"context_lines":[{"line_number":54,"context_line":"Below is a list of the services which will have or will eventually integrate"},{"line_number":55,"context_line":"Castellan and can benefit from having Bring Your Own Key functionality avaliable."},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"* Swift - encrypting objects"},{"line_number":58,"context_line":"* Nova Cinder - cinder creates a key, nova retrieves it when mounting"},{"line_number":59,"context_line":"* Nova Glance - glance signs and image, nova verifying the signed image"},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"API Impact"},{"line_number":62,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a5de9d1_6555e7c4","line":59,"range":{"start_line":57,"start_character":0,"end_line":59,"end_character":71},"updated":"2016-01-27 18:30:25.000000000","message":"Have you talked with representatives from these projects?  If so, are there any links to those communications?","commit_id":"1bca4c40461d37d20117f0329f264e2d2dccfd39"},{"author":{"_account_id":16046,"name":"Fernando Diaz","email":"diazjf@us.ibm.com","username":"diazjf"},"change_message_id":"9c4e3dbd727e462be19636202dbe2a9369f5fb4f","unresolved":false,"context_lines":[{"line_number":54,"context_line":"Below is a list of the services which will have or will eventually integrate"},{"line_number":55,"context_line":"Castellan and can benefit from having Bring Your Own Key functionality avaliable."},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"* Swift - encrypting objects"},{"line_number":58,"context_line":"* Nova Cinder - cinder creates a key, nova retrieves it when mounting"},{"line_number":59,"context_line":"* Nova Glance - glance signs and image, nova verifying the signed image"},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"API Impact"},{"line_number":62,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a5de9d1_c0104951","line":59,"range":{"start_line":57,"start_character":0,"end_line":59,"end_character":71},"in_reply_to":"7a5de9d1_6555e7c4","updated":"2016-01-27 18:47:16.000000000","message":"Hey Kaitlin. I just added some members of these projects to review. I will try reaching out to them sometime this week.","commit_id":"1bca4c40461d37d20117f0329f264e2d2dccfd39"},{"author":{"_account_id":6783,"name":"Nathan Reller","email":"nathan.s.reller@gmail.com","username":"rellerreller"},"change_message_id":"b3169173dd227a74047fef2279223c83942912cb","unresolved":false,"context_lines":[{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":"In order for Openstack to draw in more customers to enterprise security"},{"line_number":11,"context_line":"solutions it must allow the user to bring their own key. The user will"},{"line_number":12,"context_line":"essential be responsible for their own keys. The cloud service will never"},{"line_number":13,"context_line":"see nor manage the keys. This adds additional security because in the case"},{"line_number":14,"context_line":"that a cloud provider database is breached, the hacker will not obtain keys"},{"line_number":15,"context_line":"nor key metadata since they are managed by the user."},{"line_number":16,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"7a5de9d1_b32cd199","line":13,"range":{"start_line":12,"start_character":45,"end_line":13,"end_character":24},"updated":"2016-02-01 15:51:36.000000000","message":"The cloud provider must be able to see the keys if it is to provide any encryption or decryption features.","commit_id":"994e1f8f0c022eeeec7a50c1dacb8b1af6daa944"},{"author":{"_account_id":16046,"name":"Fernando Diaz","email":"diazjf@us.ibm.com","username":"diazjf"},"change_message_id":"ca343de62614cafcdba4bca28ae75ac8f03160b8","unresolved":false,"context_lines":[{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":"In order for Openstack to draw in more customers to enterprise security"},{"line_number":11,"context_line":"solutions it must allow the user to bring their own key. The user will"},{"line_number":12,"context_line":"essential be responsible for their own keys. The cloud service will never"},{"line_number":13,"context_line":"see nor manage the keys. This adds additional security because in the case"},{"line_number":14,"context_line":"that a cloud provider database is breached, the hacker will not obtain keys"},{"line_number":15,"context_line":"nor key metadata since they are managed by the user."},{"line_number":16,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a5ae5dd_f037a9fc","line":13,"range":{"start_line":12,"start_character":45,"end_line":13,"end_character":24},"in_reply_to":"7a5de9d1_7edc9518","updated":"2016-02-08 05:05:03.000000000","message":"Done","commit_id":"994e1f8f0c022eeeec7a50c1dacb8b1af6daa944"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"7d044bc9d1708557eed036584e604d640fbec27d","unresolved":false,"context_lines":[{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":"In order for Openstack to draw in more customers to enterprise security"},{"line_number":11,"context_line":"solutions it must allow the user to bring their own key. The user will"},{"line_number":12,"context_line":"essential be responsible for their own keys. The cloud service will never"},{"line_number":13,"context_line":"see nor manage the keys. This adds additional security because in the case"},{"line_number":14,"context_line":"that a cloud provider database is breached, the hacker will not obtain keys"},{"line_number":15,"context_line":"nor key metadata since they are managed by the user."},{"line_number":16,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"7a5de9d1_7edc9518","line":13,"range":{"start_line":12,"start_character":45,"end_line":13,"end_character":24},"in_reply_to":"7a5de9d1_b32cd199","updated":"2016-02-02 21:00:05.000000000","message":"Concur. See is a necessity in most cases; manage is not.","commit_id":"994e1f8f0c022eeeec7a50c1dacb8b1af6daa944"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"7d044bc9d1708557eed036584e604d640fbec27d","unresolved":false,"context_lines":[{"line_number":14,"context_line":"that a cloud provider database is breached, the hacker will not obtain keys"},{"line_number":15,"context_line":"nor key metadata since they are managed by the user."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"Providing this feature allows Openstack to draw in customers with policies"},{"line_number":18,"context_line":"which do not allow the cloud provider to store keys long-term. Users will"},{"line_number":19,"context_line":"have the option to retain keys as well as be able to follow the standard"},{"line_number":20,"context_line":"model of the cloud provider owning the keys as well, varying from secret to"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7a5de9d1_fed085f9","line":17,"range":{"start_line":17,"start_character":30,"end_line":17,"end_character":39},"updated":"2016-02-02 21:00:05.000000000","message":"nit: Openstack -\u003e OpenStack (also appears below)","commit_id":"994e1f8f0c022eeeec7a50c1dacb8b1af6daa944"},{"author":{"_account_id":16046,"name":"Fernando Diaz","email":"diazjf@us.ibm.com","username":"diazjf"},"change_message_id":"ca343de62614cafcdba4bca28ae75ac8f03160b8","unresolved":false,"context_lines":[{"line_number":14,"context_line":"that a cloud provider database is breached, the hacker will not obtain keys"},{"line_number":15,"context_line":"nor key metadata since they are managed by the user."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"Providing this feature allows Openstack to draw in customers with policies"},{"line_number":18,"context_line":"which do not allow the cloud provider to store keys long-term. Users will"},{"line_number":19,"context_line":"have the option to retain keys as well as be able to follow the standard"},{"line_number":20,"context_line":"model of the cloud provider owning the keys as well, varying from secret to"}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a5ae5dd_b03db1de","line":17,"range":{"start_line":17,"start_character":30,"end_line":17,"end_character":39},"in_reply_to":"7a5de9d1_fed085f9","updated":"2016-02-08 05:05:03.000000000","message":"Done","commit_id":"994e1f8f0c022eeeec7a50c1dacb8b1af6daa944"},{"author":{"_account_id":6783,"name":"Nathan Reller","email":"nathan.s.reller@gmail.com","username":"rellerreller"},"change_message_id":"b3169173dd227a74047fef2279223c83942912cb","unresolved":false,"context_lines":[{"line_number":14,"context_line":"that a cloud provider database is breached, the hacker will not obtain keys"},{"line_number":15,"context_line":"nor key metadata since they are managed by the user."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"Providing this feature allows Openstack to draw in customers with policies"},{"line_number":18,"context_line":"which do not allow the cloud provider to store keys long-term. Users will"},{"line_number":19,"context_line":"have the option to retain keys as well as be able to follow the standard"},{"line_number":20,"context_line":"model of the cloud provider owning the keys as well, varying from secret to"},{"line_number":21,"context_line":"secret."}],"source_content_type":"text/x-rst","patch_set":3,"id":"7a5de9d1_b3a131fa","line":18,"range":{"start_line":17,"start_character":0,"end_line":18,"end_character":62},"updated":"2016-02-01 15:51:36.000000000","message":"It would be helpful to list some of the customer and examples you have in mind. Why sorts of laws and restrictions prevent companies from having the cloud manage the keys?","commit_id":"994e1f8f0c022eeeec7a50c1dacb8b1af6daa944"},{"author":{"_account_id":16046,"name":"Fernando Diaz","email":"diazjf@us.ibm.com","username":"diazjf"},"change_message_id":"ca343de62614cafcdba4bca28ae75ac8f03160b8","unresolved":false,"context_lines":[{"line_number":14,"context_line":"that a cloud provider database is breached, the hacker will not obtain keys"},{"line_number":15,"context_line":"nor key metadata since they are managed by the user."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"Providing this feature allows Openstack to draw in customers with policies"},{"line_number":18,"context_line":"which do not allow the cloud provider to store keys long-term. Users will"},{"line_number":19,"context_line":"have the option to retain keys as well as be able to follow the standard"},{"line_number":20,"context_line":"model of the cloud provider owning the keys as well, varying from secret to"},{"line_number":21,"context_line":"secret."}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a5ae5dd_5029dd9c","line":18,"range":{"start_line":17,"start_character":0,"end_line":18,"end_character":62},"in_reply_to":"7a5de9d1_b3a131fa","updated":"2016-02-08 05:05:03.000000000","message":"I will work with Jeff on getting these.","commit_id":"994e1f8f0c022eeeec7a50c1dacb8b1af6daa944"},{"author":{"_account_id":17579,"name":"Elvin Tubillara","email":"edtubill@us.ibm.com","username":"edtubill"},"change_message_id":"5d5559b0f0ecf6ca00415c1e29e95bd6b267aa60","unresolved":false,"context_lines":[{"line_number":25,"context_line":"This proposal aims to allow the passing of a plain-text key through Castellan."},{"line_number":26,"context_line":"If a user key is provided Castellan will then just pass that key during a"},{"line_number":27,"context_line":"``get_key`` operation to use for either decrypting or encrypting an object."},{"line_number":28,"context_line":"Otherwise it will grab the secret from the appropriate backend, following"},{"line_number":29,"context_line":"Castellan’s standard flow. The reason why Castellan will be used is because"},{"line_number":30,"context_line":"it is or will be used in many Openstack Services. Making changes in Castellan"},{"line_number":31,"context_line":"will avoid making big changes in all the other projects, since it is or will be"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7a5de9d1_c457f624","line":28,"updated":"2016-02-02 20:26:50.000000000","message":"In this case would Castellan actually need to be used? I would think instead of passing a key into \"get_key\" you would just skip around it with an if statement.\n\nSo I think if BYOK is used, castellan may be skipped all together unless there is a shared library needed.","commit_id":"994e1f8f0c022eeeec7a50c1dacb8b1af6daa944"},{"author":{"_account_id":16046,"name":"Fernando Diaz","email":"diazjf@us.ibm.com","username":"diazjf"},"change_message_id":"ca343de62614cafcdba4bca28ae75ac8f03160b8","unresolved":false,"context_lines":[{"line_number":25,"context_line":"This proposal aims to allow the passing of a plain-text key through Castellan."},{"line_number":26,"context_line":"If a user key is provided Castellan will then just pass that key during a"},{"line_number":27,"context_line":"``get_key`` operation to use for either decrypting or encrypting an object."},{"line_number":28,"context_line":"Otherwise it will grab the secret from the appropriate backend, following"},{"line_number":29,"context_line":"Castellan’s standard flow. The reason why Castellan will be used is because"},{"line_number":30,"context_line":"it is or will be used in many Openstack Services. Making changes in Castellan"},{"line_number":31,"context_line":"will avoid making big changes in all the other projects, since it is or will be"}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a5ae5dd_8b088429","line":28,"in_reply_to":"7a5de9d1_c457f624","updated":"2016-02-08 05:05:03.000000000","message":"Correct, this spec will be changed","commit_id":"994e1f8f0c022eeeec7a50c1dacb8b1af6daa944"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"7d044bc9d1708557eed036584e604d640fbec27d","unresolved":false,"context_lines":[{"line_number":31,"context_line":"will avoid making big changes in all the other projects, since it is or will be"},{"line_number":32,"context_line":"a common key management interface in those projects."},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"This implementation will add the BYOK use case for organization’s with"},{"line_number":35,"context_line":"stringent data access requirements, while maintaining a way for other"},{"line_number":36,"context_line":"customer’s to have the service provider manage their keys."},{"line_number":37,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"7a5de9d1_ff3e3f28","line":34,"range":{"start_line":34,"start_character":33,"end_line":34,"end_character":37},"updated":"2016-02-02 21:00:05.000000000","message":"nit: Please define acronym on first use (here or line 5).","commit_id":"994e1f8f0c022eeeec7a50c1dacb8b1af6daa944"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"7d044bc9d1708557eed036584e604d640fbec27d","unresolved":false,"context_lines":[{"line_number":31,"context_line":"will avoid making big changes in all the other projects, since it is or will be"},{"line_number":32,"context_line":"a common key management interface in those projects."},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"This implementation will add the BYOK use case for organization’s with"},{"line_number":35,"context_line":"stringent data access requirements, while maintaining a way for other"},{"line_number":36,"context_line":"customer’s to have the service provider manage their keys."},{"line_number":37,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"7a5de9d1_7f11efae","line":34,"range":{"start_line":34,"start_character":63,"end_line":34,"end_character":64},"updated":"2016-02-02 21:00:05.000000000","message":"nit: no apostrophe","commit_id":"994e1f8f0c022eeeec7a50c1dacb8b1af6daa944"},{"author":{"_account_id":16046,"name":"Fernando Diaz","email":"diazjf@us.ibm.com","username":"diazjf"},"change_message_id":"ca343de62614cafcdba4bca28ae75ac8f03160b8","unresolved":false,"context_lines":[{"line_number":31,"context_line":"will avoid making big changes in all the other projects, since it is or will be"},{"line_number":32,"context_line":"a common key management interface in those projects."},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"This implementation will add the BYOK use case for organization’s with"},{"line_number":35,"context_line":"stringent data access requirements, while maintaining a way for other"},{"line_number":36,"context_line":"customer’s to have the service provider manage their keys."},{"line_number":37,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a5ae5dd_9011955f","line":34,"range":{"start_line":34,"start_character":63,"end_line":34,"end_character":64},"in_reply_to":"7a5de9d1_7f11efae","updated":"2016-02-08 05:05:03.000000000","message":"Done","commit_id":"994e1f8f0c022eeeec7a50c1dacb8b1af6daa944"},{"author":{"_account_id":16046,"name":"Fernando Diaz","email":"diazjf@us.ibm.com","username":"diazjf"},"change_message_id":"ca343de62614cafcdba4bca28ae75ac8f03160b8","unresolved":false,"context_lines":[{"line_number":31,"context_line":"will avoid making big changes in all the other projects, since it is or will be"},{"line_number":32,"context_line":"a common key management interface in those projects."},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"This implementation will add the BYOK use case for organization’s with"},{"line_number":35,"context_line":"stringent data access requirements, while maintaining a way for other"},{"line_number":36,"context_line":"customer’s to have the service provider manage their keys."},{"line_number":37,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a5ae5dd_700bb92a","line":34,"range":{"start_line":34,"start_character":33,"end_line":34,"end_character":37},"in_reply_to":"7a5de9d1_ff3e3f28","updated":"2016-02-08 05:05:03.000000000","message":"Done in line 5","commit_id":"994e1f8f0c022eeeec7a50c1dacb8b1af6daa944"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"7d044bc9d1708557eed036584e604d640fbec27d","unresolved":false,"context_lines":[{"line_number":33,"context_line":""},{"line_number":34,"context_line":"This implementation will add the BYOK use case for organization’s with"},{"line_number":35,"context_line":"stringent data access requirements, while maintaining a way for other"},{"line_number":36,"context_line":"customer’s to have the service provider manage their keys."},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"Example 1 (Storing Classified Product Documents):"},{"line_number":39,"context_line":"A Designer may in this case wish to store ‘Classified Product Documents` giving"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7a5de9d1_3f0b777f","line":36,"range":{"start_line":36,"start_character":8,"end_line":36,"end_character":9},"updated":"2016-02-02 21:00:05.000000000","message":"nit: no apostrophe","commit_id":"994e1f8f0c022eeeec7a50c1dacb8b1af6daa944"},{"author":{"_account_id":16046,"name":"Fernando Diaz","email":"diazjf@us.ibm.com","username":"diazjf"},"change_message_id":"ca343de62614cafcdba4bca28ae75ac8f03160b8","unresolved":false,"context_lines":[{"line_number":33,"context_line":""},{"line_number":34,"context_line":"This implementation will add the BYOK use case for organization’s with"},{"line_number":35,"context_line":"stringent data access requirements, while maintaining a way for other"},{"line_number":36,"context_line":"customer’s to have the service provider manage their keys."},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"Example 1 (Storing Classified Product Documents):"},{"line_number":39,"context_line":"A Designer may in this case wish to store ‘Classified Product Documents` giving"}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a5ae5dd_cb02fc09","line":36,"range":{"start_line":36,"start_character":8,"end_line":36,"end_character":9},"in_reply_to":"7a5de9d1_3f0b777f","updated":"2016-02-08 05:05:03.000000000","message":"Done","commit_id":"994e1f8f0c022eeeec7a50c1dacb8b1af6daa944"},{"author":{"_account_id":6783,"name":"Nathan Reller","email":"nathan.s.reller@gmail.com","username":"rellerreller"},"change_message_id":"b3169173dd227a74047fef2279223c83942912cb","unresolved":false,"context_lines":[{"line_number":38,"context_line":"Example 1 (Storing Classified Product Documents):"},{"line_number":39,"context_line":"A Designer may in this case wish to store ‘Classified Product Documents` giving"},{"line_number":40,"context_line":"details on a new product which holds extreme secrecy. The user will go ahead"},{"line_number":41,"context_line":"and use their own key which is stored in the company database. The cloud"},{"line_number":42,"context_line":"provider will have no access to the key, nor will it be stored anywhere on the"},{"line_number":43,"context_line":"cloud. In case of a breach the file will not be able to be decrypted because"},{"line_number":44,"context_line":"the key was not obtained."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"Example 2 (Storing a Non-Important Picture)"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7a5de9d1_334a2127","line":43,"range":{"start_line":41,"start_character":63,"end_line":43,"end_character":5},"updated":"2016-02-01 15:51:36.000000000","message":"I\u0027m not sure how this will be possible unless all of the encryption and decryption occur on the customer site.","commit_id":"994e1f8f0c022eeeec7a50c1dacb8b1af6daa944"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"7d044bc9d1708557eed036584e604d640fbec27d","unresolved":false,"context_lines":[{"line_number":38,"context_line":"Example 1 (Storing Classified Product Documents):"},{"line_number":39,"context_line":"A Designer may in this case wish to store ‘Classified Product Documents` giving"},{"line_number":40,"context_line":"details on a new product which holds extreme secrecy. The user will go ahead"},{"line_number":41,"context_line":"and use their own key which is stored in the company database. The cloud"},{"line_number":42,"context_line":"provider will have no access to the key, nor will it be stored anywhere on the"},{"line_number":43,"context_line":"cloud. In case of a breach the file will not be able to be decrypted because"},{"line_number":44,"context_line":"the key was not obtained."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"Example 2 (Storing a Non-Important Picture)"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7a5de9d1_5f5e7377","line":43,"range":{"start_line":41,"start_character":63,"end_line":43,"end_character":5},"in_reply_to":"7a5de9d1_334a2127","updated":"2016-02-02 21:00:05.000000000","message":"Agree. The key must transit the cloud provider, which I consider to be \"access.\"\n\nOtherwise, the cloud provider is simply storing an encrypted blob and can only return that blob to the customer for decryption by the customer.","commit_id":"994e1f8f0c022eeeec7a50c1dacb8b1af6daa944"},{"author":{"_account_id":16046,"name":"Fernando Diaz","email":"diazjf@us.ibm.com","username":"diazjf"},"change_message_id":"ca343de62614cafcdba4bca28ae75ac8f03160b8","unresolved":false,"context_lines":[{"line_number":38,"context_line":"Example 1 (Storing Classified Product Documents):"},{"line_number":39,"context_line":"A Designer may in this case wish to store ‘Classified Product Documents` giving"},{"line_number":40,"context_line":"details on a new product which holds extreme secrecy. The user will go ahead"},{"line_number":41,"context_line":"and use their own key which is stored in the company database. The cloud"},{"line_number":42,"context_line":"provider will have no access to the key, nor will it be stored anywhere on the"},{"line_number":43,"context_line":"cloud. In case of a breach the file will not be able to be decrypted because"},{"line_number":44,"context_line":"the key was not obtained."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"Example 2 (Storing a Non-Important Picture)"}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a5ae5dd_cb299c8b","line":43,"range":{"start_line":41,"start_character":63,"end_line":43,"end_character":5},"in_reply_to":"7a5de9d1_5f5e7377","updated":"2016-02-08 05:05:03.000000000","message":"Done","commit_id":"994e1f8f0c022eeeec7a50c1dacb8b1af6daa944"},{"author":{"_account_id":6783,"name":"Nathan Reller","email":"nathan.s.reller@gmail.com","username":"rellerreller"},"change_message_id":"b3169173dd227a74047fef2279223c83942912cb","unresolved":false,"context_lines":[{"line_number":58,"context_line":""},{"line_number":59,"context_line":"* Swift - encrypting objects"},{"line_number":60,"context_line":"* Nova Cinder - cinder creates a key, nova retrieves it when mounting"},{"line_number":61,"context_line":"* Nova Glance - glance signs and image, nova verifying the signed image"},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"API Impact"},{"line_number":64,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7a5de9d1_f3fd69b1","line":61,"updated":"2016-02-01 15:51:36.000000000","message":"elmiko integrated into Sahara.","commit_id":"994e1f8f0c022eeeec7a50c1dacb8b1af6daa944"},{"author":{"_account_id":16046,"name":"Fernando Diaz","email":"diazjf@us.ibm.com","username":"diazjf"},"change_message_id":"ca343de62614cafcdba4bca28ae75ac8f03160b8","unresolved":false,"context_lines":[{"line_number":58,"context_line":""},{"line_number":59,"context_line":"* Swift - encrypting objects"},{"line_number":60,"context_line":"* Nova Cinder - cinder creates a key, nova retrieves it when mounting"},{"line_number":61,"context_line":"* Nova Glance - glance signs and image, nova verifying the signed image"},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"API Impact"},{"line_number":64,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a5ae5dd_abf540ed","line":61,"in_reply_to":"7a5de9d1_3f9e1708","updated":"2016-02-08 05:05:03.000000000","message":"Done","commit_id":"994e1f8f0c022eeeec7a50c1dacb8b1af6daa944"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"7d044bc9d1708557eed036584e604d640fbec27d","unresolved":false,"context_lines":[{"line_number":58,"context_line":""},{"line_number":59,"context_line":"* Swift - encrypting objects"},{"line_number":60,"context_line":"* Nova Cinder - cinder creates a key, nova retrieves it when mounting"},{"line_number":61,"context_line":"* Nova Glance - glance signs and image, nova verifying the signed image"},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"API Impact"},{"line_number":64,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7a5de9d1_3f9e1708","line":61,"in_reply_to":"7a5de9d1_f3fd69b1","updated":"2016-02-02 21:00:05.000000000","message":"Please add ephemeral storage encryption in Nova (see http://specs.openstack.org/openstack/nova-specs/specs/juno/approved/lvm-ephemeral-storage-encryption.html).","commit_id":"994e1f8f0c022eeeec7a50c1dacb8b1af6daa944"},{"author":{"_account_id":6783,"name":"Nathan Reller","email":"nathan.s.reller@gmail.com","username":"rellerreller"},"change_message_id":"b3169173dd227a74047fef2279223c83942912cb","unresolved":false,"context_lines":[{"line_number":62,"context_line":""},{"line_number":63,"context_line":"API Impact"},{"line_number":64,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":65,"context_line":"Each Service which uses or will use Castellan should extend their appropriate"},{"line_number":66,"context_line":"APIs. The APIs which use encryption should be extended so that a key can be"},{"line_number":67,"context_line":"passed and used for encryption and decryption."},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"Security Impact"},{"line_number":70,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7a5de9d1_33a2219a","line":67,"range":{"start_line":65,"start_character":0,"end_line":67,"end_character":46},"updated":"2016-02-01 15:51:36.000000000","message":"I would like to see more details on this. How would the user pass the key to the service? How would the service call Castellan to get the key, and how would the service know that this is a key to return instead of just returning the key?","commit_id":"994e1f8f0c022eeeec7a50c1dacb8b1af6daa944"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"7d044bc9d1708557eed036584e604d640fbec27d","unresolved":false,"context_lines":[{"line_number":62,"context_line":""},{"line_number":63,"context_line":"API Impact"},{"line_number":64,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":65,"context_line":"Each Service which uses or will use Castellan should extend their appropriate"},{"line_number":66,"context_line":"APIs. The APIs which use encryption should be extended so that a key can be"},{"line_number":67,"context_line":"passed and used for encryption and decryption."},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"Security Impact"},{"line_number":70,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7a5de9d1_bf576725","line":67,"range":{"start_line":65,"start_character":0,"end_line":67,"end_character":46},"in_reply_to":"7a5de9d1_33a2219a","updated":"2016-02-02 21:00:05.000000000","message":"I agree. Having worked on features that cross multiple project teams in the past, this sentence describes a significant change. Will all the impacted project teams (Swift, Nova, Cinder, Glance, and Sahara are all mentioned above) agree to such changes?\n\nI think that some input from other project teams is required before moving this spec forward. Otherwise, there is a risk that Castellan will support the idea of bring your own key, but the services using the keys will not or may require sweeping changes to the way it is implemented.","commit_id":"994e1f8f0c022eeeec7a50c1dacb8b1af6daa944"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"7d044bc9d1708557eed036584e604d640fbec27d","unresolved":false,"context_lines":[{"line_number":71,"context_line":"With the implementation of `bring your own key` there is an impact to security."},{"line_number":72,"context_line":"The user will be passing a plain-text key for encryption/decryption instead of"},{"line_number":73,"context_line":"providing a secret_ref which obtains the key from a Key Manager. The key will"},{"line_number":74,"context_line":"be short-lived in the service, although some services may cache the key."},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"Implementation"},{"line_number":77,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7a5de9d1_d139f7d9","line":74,"range":{"start_line":74,"start_character":40,"end_line":74,"end_character":71},"updated":"2016-02-02 21:00:05.000000000","message":"Aside: Caching the key suggests that the cloud provider maintains access to it. I think it would be useful to highlight that the bring your own key concept is not a security panacea but requires cooperation (or maybe compliance is the better term) from the cloud provider.","commit_id":"994e1f8f0c022eeeec7a50c1dacb8b1af6daa944"},{"author":{"_account_id":16046,"name":"Fernando Diaz","email":"diazjf@us.ibm.com","username":"diazjf"},"change_message_id":"ca343de62614cafcdba4bca28ae75ac8f03160b8","unresolved":false,"context_lines":[{"line_number":71,"context_line":"With the implementation of `bring your own key` there is an impact to security."},{"line_number":72,"context_line":"The user will be passing a plain-text key for encryption/decryption instead of"},{"line_number":73,"context_line":"providing a secret_ref which obtains the key from a Key Manager. The key will"},{"line_number":74,"context_line":"be short-lived in the service, although some services may cache the key."},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"Implementation"},{"line_number":77,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a5ae5dd_0b1a5417","line":74,"range":{"start_line":74,"start_character":40,"end_line":74,"end_character":71},"in_reply_to":"7a5de9d1_d139f7d9","updated":"2016-02-08 05:05:03.000000000","message":"Done","commit_id":"994e1f8f0c022eeeec7a50c1dacb8b1af6daa944"},{"author":{"_account_id":11904,"name":"Sean McGinnis","email":"sean.mcginnis@gmail.com","username":"SeanM"},"change_message_id":"38a51846a084dc6d0fdae687e6b13be592c78140","unresolved":false,"context_lines":[{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":"In order for OpenStack to draw in more customers to enterprise security"},{"line_number":11,"context_line":"solutions it must allow the user to bring their own key. The user will"},{"line_number":12,"context_line":"essential be responsible for their own keys. The cloud service not manage the"},{"line_number":13,"context_line":"keys. This adds additional security because in the case that a cloud provider"},{"line_number":14,"context_line":"database is breached, the hacker will not obtain keys nor key metadata since"},{"line_number":15,"context_line":"they are managed by the user."}],"source_content_type":"text/x-rst","patch_set":4,"id":"5a5ae5dd_be756464","line":12,"updated":"2016-02-08 16:12:03.000000000","message":"s/service not/service will not/","commit_id":"72de21dc6dece036c960fdee4ebaafd458a28b35"},{"author":{"_account_id":16046,"name":"Fernando Diaz","email":"diazjf@us.ibm.com","username":"diazjf"},"change_message_id":"0825afd463fa66e348785ed0a1ed847a010f4875","unresolved":false,"context_lines":[{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":"In order for OpenStack to draw in more customers to enterprise security"},{"line_number":11,"context_line":"solutions it must allow the user to bring their own key. The user will"},{"line_number":12,"context_line":"essential be responsible for their own keys. The cloud service not manage the"},{"line_number":13,"context_line":"keys. This adds additional security because in the case that a cloud provider"},{"line_number":14,"context_line":"database is breached, the hacker will not obtain keys nor key metadata since"},{"line_number":15,"context_line":"they are managed by the user."}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a57f1b5_2fc4428f","line":12,"in_reply_to":"5a5ae5dd_be756464","updated":"2016-02-11 20:55:09.000000000","message":"Done","commit_id":"72de21dc6dece036c960fdee4ebaafd458a28b35"},{"author":{"_account_id":6783,"name":"Nathan Reller","email":"nathan.s.reller@gmail.com","username":"rellerreller"},"change_message_id":"6a904bae242844be460659770b27c2a569ec564f","unresolved":false,"context_lines":[{"line_number":31,"context_line":"  def get_key(actual_key, key_manager, key_uuid):"},{"line_number":32,"context_line":"  if actual_key:"},{"line_number":33,"context_line":"    return actual_key"},{"line_number":34,"context_line":"  return key_manager.get_key(key_uuid)"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"If a user key is provided then the function will just pass that key for either"},{"line_number":37,"context_line":"decrypting or encrypting an object. Otherwise it will grab the secret from the"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a57f1b5_ccb58e31","line":34,"updated":"2016-02-11 15:07:39.000000000","message":"We are probably going to need some logic that determines that the same key is used. We should raise an error if the key does not match.","commit_id":"72de21dc6dece036c960fdee4ebaafd458a28b35"},{"author":{"_account_id":16046,"name":"Fernando Diaz","email":"diazjf@us.ibm.com","username":"diazjf"},"change_message_id":"0825afd463fa66e348785ed0a1ed847a010f4875","unresolved":false,"context_lines":[{"line_number":31,"context_line":"  def get_key(actual_key, key_manager, key_uuid):"},{"line_number":32,"context_line":"  if actual_key:"},{"line_number":33,"context_line":"    return actual_key"},{"line_number":34,"context_line":"  return key_manager.get_key(key_uuid)"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"If a user key is provided then the function will just pass that key for either"},{"line_number":37,"context_line":"decrypting or encrypting an object. Otherwise it will grab the secret from the"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a57f1b5_8f0776c9","line":34,"in_reply_to":"3a57f1b5_ccb58e31","updated":"2016-02-11 20:55:09.000000000","message":"Thanks for the feedback on this. How would you suggest we determine the key is the same?\n\nMaybe some type of hashing and storing the hash of the key in metadata and then determining if it matches?","commit_id":"72de21dc6dece036c960fdee4ebaafd458a28b35"},{"author":{"_account_id":6783,"name":"Nathan Reller","email":"nathan.s.reller@gmail.com","username":"rellerreller"},"change_message_id":"6a904bae242844be460659770b27c2a569ec564f","unresolved":false,"context_lines":[{"line_number":46,"context_line":"details on a new product which holds extreme secrecy. The user will go ahead"},{"line_number":47,"context_line":"and use their own key which is stored in the company database. The cloud"},{"line_number":48,"context_line":"provider will use the key on user input to encrypt/decrypt the object, but"},{"line_number":49,"context_line":"will not store the key anywhere on the cloud. In case of a breach the file will"},{"line_number":50,"context_line":"not be able to be decrypted because the key was not obtained."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"Example 2 (Storing a Non-Important Picture)"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a57f1b5_ec73aa7e","line":49,"range":{"start_line":49,"start_character":22,"end_line":49,"end_character":23},"updated":"2016-02-11 15:07:39.000000000","message":"I think you need a classifier here for permanent memory. It will be temporarily in memory while in use.","commit_id":"72de21dc6dece036c960fdee4ebaafd458a28b35"},{"author":{"_account_id":16046,"name":"Fernando Diaz","email":"diazjf@us.ibm.com","username":"diazjf"},"change_message_id":"0825afd463fa66e348785ed0a1ed847a010f4875","unresolved":false,"context_lines":[{"line_number":46,"context_line":"details on a new product which holds extreme secrecy. The user will go ahead"},{"line_number":47,"context_line":"and use their own key which is stored in the company database. The cloud"},{"line_number":48,"context_line":"provider will use the key on user input to encrypt/decrypt the object, but"},{"line_number":49,"context_line":"will not store the key anywhere on the cloud. In case of a breach the file will"},{"line_number":50,"context_line":"not be able to be decrypted because the key was not obtained."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"Example 2 (Storing a Non-Important Picture)"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a57f1b5_4f565ecf","line":49,"range":{"start_line":49,"start_character":22,"end_line":49,"end_character":23},"in_reply_to":"3a57f1b5_ec73aa7e","updated":"2016-02-11 20:55:09.000000000","message":"Done","commit_id":"72de21dc6dece036c960fdee4ebaafd458a28b35"},{"author":{"_account_id":6783,"name":"Nathan Reller","email":"nathan.s.reller@gmail.com","username":"rellerreller"},"change_message_id":"6a904bae242844be460659770b27c2a569ec564f","unresolved":false,"context_lines":[{"line_number":61,"context_line":"Below is a list of the services which will have or will eventually integrate"},{"line_number":62,"context_line":"Castellan and can benefit from having Bring Your Own Key functionality"},{"line_number":63,"context_line":"available."},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"* Swift - encrypting objects"},{"line_number":66,"context_line":"* Sahara - encrypt sensitive information in the records for a cluster, job,"},{"line_number":67,"context_line":"or some other record."}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a57f1b5_5f5ffee4","line":64,"updated":"2016-02-11 15:07:39.000000000","message":"Do you think there will be a policy option to disable this per project or will each service have to contain this information?","commit_id":"72de21dc6dece036c960fdee4ebaafd458a28b35"},{"author":{"_account_id":16046,"name":"Fernando Diaz","email":"diazjf@us.ibm.com","username":"diazjf"},"change_message_id":"0825afd463fa66e348785ed0a1ed847a010f4875","unresolved":false,"context_lines":[{"line_number":61,"context_line":"Below is a list of the services which will have or will eventually integrate"},{"line_number":62,"context_line":"Castellan and can benefit from having Bring Your Own Key functionality"},{"line_number":63,"context_line":"available."},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"* Swift - encrypting objects"},{"line_number":66,"context_line":"* Sahara - encrypt sensitive information in the records for a cluster, job,"},{"line_number":67,"context_line":"or some other record."}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a57f1b5_34a9f590","line":64,"in_reply_to":"3a57f1b5_5f5ffee4","updated":"2016-02-11 20:55:09.000000000","message":"I don\u0027t think there should be a policy disabling it per project,but maybe a policy disabling it in general, since some service features(container sync, etc.) can break if it is used.","commit_id":"72de21dc6dece036c960fdee4ebaafd458a28b35"},{"author":{"_account_id":6783,"name":"Nathan Reller","email":"nathan.s.reller@gmail.com","username":"rellerreller"},"change_message_id":"6a904bae242844be460659770b27c2a569ec564f","unresolved":false,"context_lines":[{"line_number":67,"context_line":"or some other record."},{"line_number":68,"context_line":"* Nova - Ephemeral Storage Encryption"},{"line_number":69,"context_line":"* Nova Cinder - cinder creates a key, nova retrieves it when mounting"},{"line_number":70,"context_line":"* Nova Glance - glance signs and image, nova verifying the signed image"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"Alternative"},{"line_number":73,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a57f1b5_0c23a606","line":70,"updated":"2016-02-11 15:07:39.000000000","message":"What about key rotation scenarios? Let\u0027s say a customer stores data using some key. Then after time and usage the customer\u0027s policy indicates that the key should be rotated. How will the user indicate to the service to rotate the key? Will this require new API calls or flags to existing API calls?","commit_id":"72de21dc6dece036c960fdee4ebaafd458a28b35"},{"author":{"_account_id":16046,"name":"Fernando Diaz","email":"diazjf@us.ibm.com","username":"diazjf"},"change_message_id":"0825afd463fa66e348785ed0a1ed847a010f4875","unresolved":false,"context_lines":[{"line_number":67,"context_line":"or some other record."},{"line_number":68,"context_line":"* Nova - Ephemeral Storage Encryption"},{"line_number":69,"context_line":"* Nova Cinder - cinder creates a key, nova retrieves it when mounting"},{"line_number":70,"context_line":"* Nova Glance - glance signs and image, nova verifying the signed image"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"Alternative"},{"line_number":73,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a57f1b5_0fb2a64c","line":70,"in_reply_to":"3a57f1b5_0c23a606","updated":"2016-02-11 20:55:09.000000000","message":"I\u0027m not sure if I should include information on key rotation since its just to get the basics of BYOK in Openstack. Key rotations would probably depend on new API calls which should be part of the different services. Here is an example flow for swift: \n\n1.) When using a key for encryption, it should be hashed and the hash should be stored with the time it was created.\n\n2.) When the object is accessed, the \u0027hash\u0027 will be checked, the created time will be received and checked against a policy.\n\n3.) If it is older than the time in the policy then when a user trying to access the object and if the key is correct, then it will ask for input of a new key before proceeding on downloading the object.\n\nThis is just an example of how the service can use it.","commit_id":"72de21dc6dece036c960fdee4ebaafd458a28b35"},{"author":{"_account_id":6783,"name":"Nathan Reller","email":"nathan.s.reller@gmail.com","username":"rellerreller"},"change_message_id":"6a904bae242844be460659770b27c2a569ec564f","unresolved":false,"context_lines":[{"line_number":85,"context_line":"With the implementation of `bring your own key` there is an impact to security."},{"line_number":86,"context_line":"The user will be passing a plain-text key for encryption/decryption instead of"},{"line_number":87,"context_line":"providing a secret_ref which obtains the key from a Key Manager. The key will"},{"line_number":88,"context_line":"be short-lived in the service, although some services may cache the key. How"},{"line_number":89,"context_line":"secure the BYOK solution is depends on compliance from the cloud provider."},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"Implementation"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a57f1b5_dfc52e8e","line":88,"range":{"start_line":88,"start_character":0,"end_line":88,"end_character":29},"updated":"2016-02-11 15:07:39.000000000","message":"You should mention that it will be passed in the clear between services that may not even be using the key. For instance with creating a Nova instance that is to have its ephemeral disk encrypted then the key will pass from Horizon to Nova controller to Gantt to Nova compute node.","commit_id":"72de21dc6dece036c960fdee4ebaafd458a28b35"},{"author":{"_account_id":16046,"name":"Fernando Diaz","email":"diazjf@us.ibm.com","username":"diazjf"},"change_message_id":"0825afd463fa66e348785ed0a1ed847a010f4875","unresolved":false,"context_lines":[{"line_number":85,"context_line":"With the implementation of `bring your own key` there is an impact to security."},{"line_number":86,"context_line":"The user will be passing a plain-text key for encryption/decryption instead of"},{"line_number":87,"context_line":"providing a secret_ref which obtains the key from a Key Manager. The key will"},{"line_number":88,"context_line":"be short-lived in the service, although some services may cache the key. How"},{"line_number":89,"context_line":"secure the BYOK solution is depends on compliance from the cloud provider."},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"Implementation"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a57f1b5_0fcdc665","line":88,"range":{"start_line":88,"start_character":0,"end_line":88,"end_character":29},"in_reply_to":"3a57f1b5_dfc52e8e","updated":"2016-02-11 20:55:09.000000000","message":"Done","commit_id":"72de21dc6dece036c960fdee4ebaafd458a28b35"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"5ba6844bc338e4d1c6906a9919d17f179acdcdf9","unresolved":false,"context_lines":[{"line_number":2,"context_line":"Bring Your Own Key Implementation"},{"line_number":3,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":4,"context_line":"The purpose of this specification is to provide information to all the"},{"line_number":5,"context_line":"OpenStack projects on the need for Bring Your Own Key(BYOK) implementation as"},{"line_number":6,"context_line":"well as a means on implementation."},{"line_number":7,"context_line":""},{"line_number":8,"context_line":"Problem Description"}],"source_content_type":"text/x-rst","patch_set":5,"id":"bae84128_eb29689c","line":5,"range":{"start_line":5,"start_character":35,"end_line":5,"end_character":59},"updated":"2016-02-24 10:11:58.000000000","message":"Fundamentally there are two BYOK models (with variations that include wrapping etc) I suggest that we be explicit that this is a PUSH model","commit_id":"3be6e770c0f267808897c4c6d2bb85e041ffcab0"},{"author":{"_account_id":14926,"name":"Jeff Feng","email":"jianhua@us.ibm.com","username":"jhfeng"},"change_message_id":"4aadf1842b32d78af8e96134454463d37c2c07b7","unresolved":false,"context_lines":[{"line_number":2,"context_line":"Bring Your Own Key Implementation"},{"line_number":3,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":4,"context_line":"The purpose of this specification is to provide information to all the"},{"line_number":5,"context_line":"OpenStack projects on the need for Bring Your Own Key(BYOK) implementation as"},{"line_number":6,"context_line":"well as a means on implementation."},{"line_number":7,"context_line":""},{"line_number":8,"context_line":"Problem Description"}],"source_content_type":"text/x-rst","patch_set":5,"id":"bae84128_f39dc10a","line":5,"range":{"start_line":5,"start_character":35,"end_line":5,"end_character":59},"in_reply_to":"bae84128_eb29689c","updated":"2016-02-24 16:39:33.000000000","message":"+1. \ncan just copy Rob\u0027s line here.","commit_id":"3be6e770c0f267808897c4c6d2bb85e041ffcab0"},{"author":{"_account_id":16046,"name":"Fernando Diaz","email":"diazjf@us.ibm.com","username":"diazjf"},"change_message_id":"6d21d240dc6c26420a1ba6b3c65337a7951792e6","unresolved":false,"context_lines":[{"line_number":2,"context_line":"Bring Your Own Key Implementation"},{"line_number":3,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":4,"context_line":"The purpose of this specification is to provide information to all the"},{"line_number":5,"context_line":"OpenStack projects on the need for Bring Your Own Key(BYOK) implementation as"},{"line_number":6,"context_line":"well as a means on implementation."},{"line_number":7,"context_line":""},{"line_number":8,"context_line":"Problem Description"}],"source_content_type":"text/x-rst","patch_set":5,"id":"bae84128_1e5da8ec","line":5,"in_reply_to":"bae84128_f39dc10a","updated":"2016-02-25 06:42:50.000000000","message":"Done","commit_id":"3be6e770c0f267808897c4c6d2bb85e041ffcab0"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"5ba6844bc338e4d1c6906a9919d17f179acdcdf9","unresolved":false,"context_lines":[{"line_number":10,"context_line":"In order for OpenStack to draw in more customers to enterprise security"},{"line_number":11,"context_line":"solutions it must allow the user to bring their own key. The user will"},{"line_number":12,"context_line":"essentially be responsible for their own keys. The cloud service will not"},{"line_number":13,"context_line":"manage the keys. This adds additional security because in the case that a"},{"line_number":14,"context_line":"cloud provider database is breached, the hacker will not obtain keys nor key"},{"line_number":15,"context_line":"metadata since they are managed by the user."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"Providing this feature allows OpenStack to draw in customers with policies"},{"line_number":18,"context_line":"which do not allow the cloud provider to store keys long-term[1][2]. Users"}],"source_content_type":"text/x-rst","patch_set":5,"id":"bae84128_8b9edc04","line":15,"range":{"start_line":13,"start_character":17,"end_line":15,"end_character":44},"updated":"2016-02-24 10:11:58.000000000","message":"Suggested verbiage (or some combination thereof)\n\nIn some usage models, this will increase assurance that keys have not been compromised as they should only be available to a cloud provider during client-initiated operations. In the event that a cloud provider is compromised, only those keys used for \"in flight\" operations may be compromised. Even an attacker with complete system access will not be able to retrieve keys used for previous operations.","commit_id":"3be6e770c0f267808897c4c6d2bb85e041ffcab0"},{"author":{"_account_id":16046,"name":"Fernando Diaz","email":"diazjf@us.ibm.com","username":"diazjf"},"change_message_id":"6d21d240dc6c26420a1ba6b3c65337a7951792e6","unresolved":false,"context_lines":[{"line_number":12,"context_line":"essentially be responsible for their own keys. The cloud service will not"},{"line_number":13,"context_line":"manage the keys. This adds additional security because in the case that a"},{"line_number":14,"context_line":"cloud provider database is breached, the hacker will not obtain keys nor key"},{"line_number":15,"context_line":"metadata since they are managed by the user."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"Providing this feature allows OpenStack to draw in customers with policies"},{"line_number":18,"context_line":"which do not allow the cloud provider to store keys long-term[1][2]. Users"}],"source_content_type":"text/x-rst","patch_set":5,"id":"bae84128_3eb4eccf","line":15,"in_reply_to":"bae84128_8b9edc04","updated":"2016-02-25 06:42:50.000000000","message":"Done","commit_id":"3be6e770c0f267808897c4c6d2bb85e041ffcab0"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"5ba6844bc338e4d1c6906a9919d17f179acdcdf9","unresolved":false,"context_lines":[{"line_number":18,"context_line":"which do not allow the cloud provider to store keys long-term[1][2]. Users"},{"line_number":19,"context_line":"will have the option to retain keys as well as be able to follow the standard"},{"line_number":20,"context_line":"model of the cloud provider owning the keys as well, varying from secret to"},{"line_number":21,"context_line":"secret."},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"Proposed Change"},{"line_number":24,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":5,"id":"bae84128_e6e19d2b","line":21,"updated":"2016-02-24 10:11:58.000000000","message":"More Suggested content\n\nIt\u0027s worth noting that Google, Azure and AWS already support BYOK and have good write-ups on its use [4][5][6] - it\u0027s clear that this is a desirable feature for those cloud platforms and  would be at-least as useful for OpenStack.\n\nAs OpenStack is a composable set of services, it\u0027s arguably more valuable to implement BYOK functionality here than in existing cloud products - it allows cloud providers to chose to perform encryption in relatively low-cost models, without\nusing any particular key management service - this enables opportunities for individual workloads to manage their own encryption requirements.","commit_id":"3be6e770c0f267808897c4c6d2bb85e041ffcab0"},{"author":{"_account_id":16046,"name":"Fernando Diaz","email":"diazjf@us.ibm.com","username":"diazjf"},"change_message_id":"6d21d240dc6c26420a1ba6b3c65337a7951792e6","unresolved":false,"context_lines":[{"line_number":18,"context_line":"which do not allow the cloud provider to store keys long-term[1][2]. Users"},{"line_number":19,"context_line":"will have the option to retain keys as well as be able to follow the standard"},{"line_number":20,"context_line":"model of the cloud provider owning the keys as well, varying from secret to"},{"line_number":21,"context_line":"secret."},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"Proposed Change"},{"line_number":24,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":5,"id":"bae84128_9e3ed827","line":21,"in_reply_to":"bae84128_e6e19d2b","updated":"2016-02-25 06:42:50.000000000","message":"Done","commit_id":"3be6e770c0f267808897c4c6d2bb85e041ffcab0"},{"author":{"_account_id":14926,"name":"Jeff Feng","email":"jianhua@us.ibm.com","username":"jhfeng"},"change_message_id":"4aadf1842b32d78af8e96134454463d37c2c07b7","unresolved":false,"context_lines":[{"line_number":31,"context_line":"  def get_key(actual_key, key_manager, key_uuid):"},{"line_number":32,"context_line":"  if actual_key:"},{"line_number":33,"context_line":"    return actual_key"},{"line_number":34,"context_line":"  return key_manager.get_key(key_uuid)"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"If a user key is provided then the function will just pass that key for either"},{"line_number":37,"context_line":"decrypting or encrypting an object. Otherwise it will grab the secret from the"}],"source_content_type":"text/x-rst","patch_set":5,"id":"bae84128_3116014c","line":34,"updated":"2016-02-24 16:39:33.000000000","message":"this sample code is mixing PUSH and PULL model.\n\nWe\u0027re suggesting that BYOK PUSH is preferred. PULL mode could be used also. This will conflict with PUSH-only statement at the beginning.","commit_id":"3be6e770c0f267808897c4c6d2bb85e041ffcab0"},{"author":{"_account_id":16046,"name":"Fernando Diaz","email":"diazjf@us.ibm.com","username":"diazjf"},"change_message_id":"6d21d240dc6c26420a1ba6b3c65337a7951792e6","unresolved":false,"context_lines":[{"line_number":31,"context_line":"  def get_key(actual_key, key_manager, key_uuid):"},{"line_number":32,"context_line":"  if actual_key:"},{"line_number":33,"context_line":"    return actual_key"},{"line_number":34,"context_line":"  return key_manager.get_key(key_uuid)"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"If a user key is provided then the function will just pass that key for either"},{"line_number":37,"context_line":"decrypting or encrypting an object. Otherwise it will grab the secret from the"}],"source_content_type":"text/x-rst","patch_set":5,"id":"bae84128_3e134c0f","line":34,"in_reply_to":"bae84128_3116014c","updated":"2016-02-25 06:42:50.000000000","message":"Hey Jeff, I should make the parameters optional. This function just implies that a user can either pass a key through the api, if not it will use whichever key_manager(Barbican, KMIP) is tied to Castellan using the key\u0027s uuid.\n\nSomething like https://github.com/openstack/nova/blob/244e2537be227aa3ff2021428b4213b6e1736995/nova/signature_utils.py#L295 happens if a key is not passed","commit_id":"3be6e770c0f267808897c4c6d2bb85e041ffcab0"},{"author":{"_account_id":6783,"name":"Nathan Reller","email":"nathan.s.reller@gmail.com","username":"rellerreller"},"change_message_id":"dff536bb9c8ff4884d21f7f568391808653fc87c","unresolved":false,"context_lines":[{"line_number":68,"context_line":"* Sahara - encrypt sensitive information in records for a cluster, job, etc."},{"line_number":69,"context_line":"* Nova - Ephemeral Storage Encryption"},{"line_number":70,"context_line":"* Nova Cinder - cinder creates a key, nova retrieves it when mounting"},{"line_number":71,"context_line":"* Nova Glance - glance signs and image, nova verifying the signed image"},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"Alternative"},{"line_number":74,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":5,"id":"3a57f1b5_9ee0df97","line":71,"updated":"2016-02-12 14:32:21.000000000","message":"I still think we should have a sentence or two on key rotation. I say that because the other services that support BYOK will likely have to support this as well. I want to try and give them a complete picture of what all might be involved. I\u0027m not saying we have to have a solution here, but we should state it as a concern and possibly list some solutions. Those could be additional flags or logic like you had in the previous revision. I\u0027m not sure, but I would like feedback from others.","commit_id":"3be6e770c0f267808897c4c6d2bb85e041ffcab0"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"5ba6844bc338e4d1c6906a9919d17f179acdcdf9","unresolved":false,"context_lines":[{"line_number":68,"context_line":"* Sahara - encrypt sensitive information in records for a cluster, job, etc."},{"line_number":69,"context_line":"* Nova - Ephemeral Storage Encryption"},{"line_number":70,"context_line":"* Nova Cinder - cinder creates a key, nova retrieves it when mounting"},{"line_number":71,"context_line":"* Nova Glance - glance signs and image, nova verifying the signed image"},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"Alternative"},{"line_number":74,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":5,"id":"bae84128_06f121cd","line":71,"in_reply_to":"3a57f1b5_9ee0df97","updated":"2016-02-24 10:11:58.000000000","message":"In its simplest form, key rotation in BYOK (PUSH) is a client-side problem (should be achievable using standard API calls for replicating an artifact with different key material) - however I completely agree that there should be some discussion here. I\u0027m not sure how it would look for all cases.","commit_id":"3be6e770c0f267808897c4c6d2bb85e041ffcab0"},{"author":{"_account_id":16046,"name":"Fernando Diaz","email":"diazjf@us.ibm.com","username":"diazjf"},"change_message_id":"6d21d240dc6c26420a1ba6b3c65337a7951792e6","unresolved":false,"context_lines":[{"line_number":68,"context_line":"* Sahara - encrypt sensitive information in records for a cluster, job, etc."},{"line_number":69,"context_line":"* Nova - Ephemeral Storage Encryption"},{"line_number":70,"context_line":"* Nova Cinder - cinder creates a key, nova retrieves it when mounting"},{"line_number":71,"context_line":"* Nova Glance - glance signs and image, nova verifying the signed image"},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"Alternative"},{"line_number":74,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":5,"id":"bae84128_3c51950f","line":71,"in_reply_to":"bae84128_06f121cd","updated":"2016-02-25 06:42:50.000000000","message":"Done","commit_id":"3be6e770c0f267808897c4c6d2bb85e041ffcab0"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"5ba6844bc338e4d1c6906a9919d17f179acdcdf9","unresolved":false,"context_lines":[{"line_number":69,"context_line":"* Nova - Ephemeral Storage Encryption"},{"line_number":70,"context_line":"* Nova Cinder - cinder creates a key, nova retrieves it when mounting"},{"line_number":71,"context_line":"* Nova Glance - glance signs and image, nova verifying the signed image"},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"Alternative"},{"line_number":74,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":75,"context_line":"An alternative to BYOK would be to implement the pull model, where the service"}],"source_content_type":"text/x-rst","patch_set":5,"id":"bae84128_e6435dad","line":72,"updated":"2016-02-24 10:11:58.000000000","message":"One thing we should discuss is how (if) key ID\u0027s should exist. it may be beneficial in a BYOK model to maintain some KeyID for the material that was provided by a client.\n\nThis could be an optional value provided by the client and stored in metadata or it could be derived from the key that\u0027s provided in a more automated way.\n\nThe value here is that for very little effort on the part of an OpenStack service, users are provided with a handle on their key management. Users wouldn\u0027t need to maintain object-\u003ekey mappings, a simple key database with unique ID\u0027s is all that would be required.","commit_id":"3be6e770c0f267808897c4c6d2bb85e041ffcab0"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"cc5356b36db971f8de0a436aaf34c88d224496af","unresolved":false,"context_lines":[{"line_number":69,"context_line":"* Nova - Ephemeral Storage Encryption"},{"line_number":70,"context_line":"* Nova Cinder - cinder creates a key, nova retrieves it when mounting"},{"line_number":71,"context_line":"* Nova Glance - glance signs and image, nova verifying the signed image"},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"Alternative"},{"line_number":74,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":75,"context_line":"An alternative to BYOK would be to implement the pull model, where the service"}],"source_content_type":"text/x-rst","patch_set":5,"id":"bae84128_ade3a604","line":72,"in_reply_to":"bae84128_3ca515b5","updated":"2016-02-25 13:58:52.000000000","message":"I guess I was thinking of a case where the client is using their own on-prem key manager (possibly an HSM), so they pull out key \u002733\u0027 and use it for some swift object. If that object metadata included the keyID then perhaps the client doesn\u0027t need to maintain any local tracking of keys, when they want to do something with that object they check the metadata, get the keyID and pull the key from their HSM/Vault/Thing.","commit_id":"3be6e770c0f267808897c4c6d2bb85e041ffcab0"},{"author":{"_account_id":16046,"name":"Fernando Diaz","email":"diazjf@us.ibm.com","username":"diazjf"},"change_message_id":"6d21d240dc6c26420a1ba6b3c65337a7951792e6","unresolved":false,"context_lines":[{"line_number":69,"context_line":"* Nova - Ephemeral Storage Encryption"},{"line_number":70,"context_line":"* Nova Cinder - cinder creates a key, nova retrieves it when mounting"},{"line_number":71,"context_line":"* Nova Glance - glance signs and image, nova verifying the signed image"},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"Alternative"},{"line_number":74,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":75,"context_line":"An alternative to BYOK would be to implement the pull model, where the service"}],"source_content_type":"text/x-rst","patch_set":5,"id":"bae84128_3ca515b5","line":72,"in_reply_to":"bae84128_e6435dad","updated":"2016-02-25 06:42:50.000000000","message":"I may not be understanding this properly. Wouldn\u0027t the user then need to maintain a key_id -\u003e key mapping since keys won\u0027t be stored on the Cloud? I guess if multiple objects use the same key then the data-set would be a lot smaller than object -\u003e key..\n\nThis sounds like it would be beneficial to knowing if the proper key is being used before a key is used for decryption, etc.\n\nI\u0027m curious as to how we would associate a key to a key_id if the key will not be stored. I think it should be derived from the key itself.","commit_id":"3be6e770c0f267808897c4c6d2bb85e041ffcab0"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"5ba6844bc338e4d1c6906a9919d17f179acdcdf9","unresolved":false,"context_lines":[{"line_number":79,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":80,"context_line":"Each Service which uses or will use Castellan should extend their appropriate"},{"line_number":81,"context_line":"APIs. The APIs which use encryption should be extended so that a key can be"},{"line_number":82,"context_line":"passed and used for encryption and decryption."},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"Security Impact"},{"line_number":85,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":5,"id":"bae84128_a6ae752b","line":82,"updated":"2016-02-24 10:11:58.000000000","message":"At some point soon we need to discuss the format for this","commit_id":"3be6e770c0f267808897c4c6d2bb85e041ffcab0"},{"author":{"_account_id":16046,"name":"Fernando Diaz","email":"diazjf@us.ibm.com","username":"diazjf"},"change_message_id":"6d21d240dc6c26420a1ba6b3c65337a7951792e6","unresolved":false,"context_lines":[{"line_number":79,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":80,"context_line":"Each Service which uses or will use Castellan should extend their appropriate"},{"line_number":81,"context_line":"APIs. The APIs which use encryption should be extended so that a key can be"},{"line_number":82,"context_line":"passed and used for encryption and decryption."},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"Security Impact"},{"line_number":85,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":5,"id":"bae84128_be1c7cc2","line":82,"in_reply_to":"bae84128_a6ae752b","updated":"2016-02-25 06:42:50.000000000","message":"Done","commit_id":"3be6e770c0f267808897c4c6d2bb85e041ffcab0"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"5ba6844bc338e4d1c6906a9919d17f179acdcdf9","unresolved":false,"context_lines":[{"line_number":88,"context_line":"providing a secret_ref which obtains the key from a Key Manager. The key will"},{"line_number":89,"context_line":"be short-lived in the service, but can be passed in the clear between services"},{"line_number":90,"context_line":"that may not be using the key. Also note that some services may cache the key."},{"line_number":91,"context_line":"How secure the BYOK solution is depends on compliance from the cloud provider."},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"Implementation"},{"line_number":94,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":5,"id":"bae84128_c68c59dc","line":91,"updated":"2016-02-24 10:11:58.000000000","message":"In some ways BYOK is less secure than a more \u0027standard\u0027 Castellan/Barbican model - key material is directly exposed to more services. However the exposure _should_ be ephemeral, allowing you to make point-in-time security assertions that are different from a more standard model. As with many things in OpenStack, it\u0027s about choice and will vary between deployments.","commit_id":"3be6e770c0f267808897c4c6d2bb85e041ffcab0"},{"author":{"_account_id":16046,"name":"Fernando Diaz","email":"diazjf@us.ibm.com","username":"diazjf"},"change_message_id":"6d21d240dc6c26420a1ba6b3c65337a7951792e6","unresolved":false,"context_lines":[{"line_number":88,"context_line":"providing a secret_ref which obtains the key from a Key Manager. The key will"},{"line_number":89,"context_line":"be short-lived in the service, but can be passed in the clear between services"},{"line_number":90,"context_line":"that may not be using the key. Also note that some services may cache the key."},{"line_number":91,"context_line":"How secure the BYOK solution is depends on compliance from the cloud provider."},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"Implementation"},{"line_number":94,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":5,"id":"bae84128_9e0b782b","line":91,"in_reply_to":"bae84128_c68c59dc","updated":"2016-02-25 06:42:50.000000000","message":"Done","commit_id":"3be6e770c0f267808897c4c6d2bb85e041ffcab0"},{"author":{"_account_id":14926,"name":"Jeff Feng","email":"jianhua@us.ibm.com","username":"jhfeng"},"change_message_id":"4aadf1842b32d78af8e96134454463d37c2c07b7","unresolved":false,"context_lines":[{"line_number":110,"context_line":""},{"line_number":111,"context_line":"Work Items"},{"line_number":112,"context_line":"----------"},{"line_number":113,"context_line":""},{"line_number":114,"context_line":"- Integration of BYOK in services"},{"line_number":115,"context_line":"- Tests in services"},{"line_number":116,"context_line":"- Documentation on Usage"}],"source_content_type":"text/x-rst","patch_set":5,"id":"bae84128_3329e9e6","line":113,"updated":"2016-02-24 16:39:33.000000000","message":"agreement of PUSH model","commit_id":"3be6e770c0f267808897c4c6d2bb85e041ffcab0"},{"author":{"_account_id":16046,"name":"Fernando Diaz","email":"diazjf@us.ibm.com","username":"diazjf"},"change_message_id":"6d21d240dc6c26420a1ba6b3c65337a7951792e6","unresolved":false,"context_lines":[{"line_number":110,"context_line":""},{"line_number":111,"context_line":"Work Items"},{"line_number":112,"context_line":"----------"},{"line_number":113,"context_line":""},{"line_number":114,"context_line":"- Integration of BYOK in services"},{"line_number":115,"context_line":"- Tests in services"},{"line_number":116,"context_line":"- Documentation on Usage"}],"source_content_type":"text/x-rst","patch_set":5,"id":"bae84128_5eaa9086","line":113,"in_reply_to":"bae84128_3329e9e6","updated":"2016-02-25 06:42:50.000000000","message":"Done","commit_id":"3be6e770c0f267808897c4c6d2bb85e041ffcab0"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"5ba6844bc338e4d1c6906a9919d17f179acdcdf9","unresolved":false,"context_lines":[{"line_number":111,"context_line":"Work Items"},{"line_number":112,"context_line":"----------"},{"line_number":113,"context_line":""},{"line_number":114,"context_line":"- Integration of BYOK in services"},{"line_number":115,"context_line":"- Tests in services"},{"line_number":116,"context_line":"- Documentation on Usage"},{"line_number":117,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"bae84128_26c265e9","line":114,"updated":"2016-02-24 10:11:58.000000000","message":"agreement of what the API extension should look like","commit_id":"3be6e770c0f267808897c4c6d2bb85e041ffcab0"},{"author":{"_account_id":16046,"name":"Fernando Diaz","email":"diazjf@us.ibm.com","username":"diazjf"},"change_message_id":"6d21d240dc6c26420a1ba6b3c65337a7951792e6","unresolved":false,"context_lines":[{"line_number":111,"context_line":"Work Items"},{"line_number":112,"context_line":"----------"},{"line_number":113,"context_line":""},{"line_number":114,"context_line":"- Integration of BYOK in services"},{"line_number":115,"context_line":"- Tests in services"},{"line_number":116,"context_line":"- Documentation on Usage"},{"line_number":117,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"bae84128_fea444ba","line":114,"in_reply_to":"bae84128_26c265e9","updated":"2016-02-25 06:42:50.000000000","message":"Done","commit_id":"3be6e770c0f267808897c4c6d2bb85e041ffcab0"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"5ba6844bc338e4d1c6906a9919d17f179acdcdf9","unresolved":false,"context_lines":[{"line_number":123,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":124,"context_line":"[1] http://csrc.nist.gov/publications/nistpubs/800-57/SP800-57-Part2.pdf"},{"line_number":125,"context_line":"[2] http://www.europeanpaymentscouncil.eu/index.cfm/knowledge-bank/epc-documents/guidelines-on-algorithms-usage-and-key-management/epc342-08-guidelines-on-algorithms-usage-and-key-management-v40/"},{"line_number":126,"context_line":"[3] https://etherpad.OpenStack.org/p/cEA79A5fG1"}],"source_content_type":"text/x-rst","patch_set":5,"id":"bae84128_86409108","line":126,"updated":"2016-02-24 10:11:58.000000000","message":"[4] http://googlecloudplatform.blogspot.co.uk/2015/07/Bring-Your-Own-Encryption-Keys-to-Google-Cloud-Platform.html\n[5] https://technet.microsoft.com/en-gb/library/dn440580.aspx\n[6] https://aws.amazon.com/blogs/aws/s3-encryption-with-your-keys/","commit_id":"3be6e770c0f267808897c4c6d2bb85e041ffcab0"},{"author":{"_account_id":16046,"name":"Fernando Diaz","email":"diazjf@us.ibm.com","username":"diazjf"},"change_message_id":"6d21d240dc6c26420a1ba6b3c65337a7951792e6","unresolved":false,"context_lines":[{"line_number":123,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":124,"context_line":"[1] http://csrc.nist.gov/publications/nistpubs/800-57/SP800-57-Part2.pdf"},{"line_number":125,"context_line":"[2] http://www.europeanpaymentscouncil.eu/index.cfm/knowledge-bank/epc-documents/guidelines-on-algorithms-usage-and-key-management/epc342-08-guidelines-on-algorithms-usage-and-key-management-v40/"},{"line_number":126,"context_line":"[3] https://etherpad.OpenStack.org/p/cEA79A5fG1"}],"source_content_type":"text/x-rst","patch_set":5,"id":"bae84128_3e106ca8","line":126,"in_reply_to":"bae84128_86409108","updated":"2016-02-25 06:42:50.000000000","message":"Done","commit_id":"3be6e770c0f267808897c4c6d2bb85e041ffcab0"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"cfb6f4cd12a2a5f89c7356db4e94fdd8bbae0296","unresolved":false,"context_lines":[{"line_number":4,"context_line":"The purpose of this specification is to provide information to all the"},{"line_number":5,"context_line":"OpenStack projects on the need for Bring Your Own Key(BYOK) implementation as"},{"line_number":6,"context_line":"well as a means on implementation. This specification will focus on BYOK"},{"line_number":7,"context_line":"implementation using the PUSH model."},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Problem Description"},{"line_number":10,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9aed3d3a_cbf2786f","line":7,"range":{"start_line":7,"start_character":25,"end_line":7,"end_character":35},"updated":"2016-02-25 19:54:41.000000000","message":"Please define what is meant by \u0027PUSH\u0027 model. (To some extent a definition can be inferred from later sections, but it would be clearest to define this model formally at the beginning.)","commit_id":"357ffb01f6207abe84396050f588e757dd1f1d2a"},{"author":{"_account_id":16046,"name":"Fernando Diaz","email":"diazjf@us.ibm.com","username":"diazjf"},"change_message_id":"2cbb6cb5b0276b922d6ec1d7f389a4fe543b3f3b","unresolved":false,"context_lines":[{"line_number":4,"context_line":"The purpose of this specification is to provide information to all the"},{"line_number":5,"context_line":"OpenStack projects on the need for Bring Your Own Key(BYOK) implementation as"},{"line_number":6,"context_line":"well as a means on implementation. This specification will focus on BYOK"},{"line_number":7,"context_line":"implementation using the PUSH model."},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Problem Description"},{"line_number":10,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9aed3d3a_1a588d89","line":7,"in_reply_to":"9aed3d3a_cbf2786f","updated":"2016-02-29 16:21:05.000000000","message":"Done","commit_id":"357ffb01f6207abe84396050f588e757dd1f1d2a"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"cfb6f4cd12a2a5f89c7356db4e94fdd8bbae0296","unresolved":false,"context_lines":[{"line_number":100,"context_line":"Alternative"},{"line_number":101,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":102,"context_line":"An alternative to BYOK would be to implement the pull model, where the service"},{"line_number":103,"context_line":"requests the key which is stored on premise."},{"line_number":104,"context_line":""},{"line_number":105,"context_line":"API Impact"},{"line_number":106,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9aed3d3a_5eb0e48b","line":103,"range":{"start_line":103,"start_character":33,"end_line":103,"end_character":43},"updated":"2016-02-25 19:54:41.000000000","message":"stored on premise -\u003e retrieved from the customer on demand","commit_id":"357ffb01f6207abe84396050f588e757dd1f1d2a"},{"author":{"_account_id":16046,"name":"Fernando Diaz","email":"diazjf@us.ibm.com","username":"diazjf"},"change_message_id":"2cbb6cb5b0276b922d6ec1d7f389a4fe543b3f3b","unresolved":false,"context_lines":[{"line_number":100,"context_line":"Alternative"},{"line_number":101,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":102,"context_line":"An alternative to BYOK would be to implement the pull model, where the service"},{"line_number":103,"context_line":"requests the key which is stored on premise."},{"line_number":104,"context_line":""},{"line_number":105,"context_line":"API Impact"},{"line_number":106,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9aed3d3a_7a7c39b5","line":103,"in_reply_to":"9aed3d3a_5eb0e48b","updated":"2016-02-29 16:21:05.000000000","message":"Done","commit_id":"357ffb01f6207abe84396050f588e757dd1f1d2a"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"cfb6f4cd12a2a5f89c7356db4e94fdd8bbae0296","unresolved":false,"context_lines":[{"line_number":112,"context_line":"Security Impact"},{"line_number":113,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":114,"context_line":"With the implementation of `bring your own key` there is an impact to security."},{"line_number":115,"context_line":"The user will be passing a plain-text key for encryption/decryption instead of"},{"line_number":116,"context_line":"providing a secret_ref which obtains the key from a Key Manager. The key may be"},{"line_number":117,"context_line":"directly exposed to more services than the standard Castellan/Barbican model."},{"line_number":118,"context_line":"However the exposure should be ephemeral, allowing you to make point-in-time"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9aed3d3a_1e3bfcec","line":115,"range":{"start_line":115,"start_character":17,"end_line":115,"end_character":41},"updated":"2016-02-25 19:54:41.000000000","message":"Wouldn\u0027t it be better to require key wrapping so the key can only be accessed by the service(s) that actually use it?","commit_id":"357ffb01f6207abe84396050f588e757dd1f1d2a"},{"author":{"_account_id":16046,"name":"Fernando Diaz","email":"diazjf@us.ibm.com","username":"diazjf"},"change_message_id":"2cbb6cb5b0276b922d6ec1d7f389a4fe543b3f3b","unresolved":false,"context_lines":[{"line_number":112,"context_line":"Security Impact"},{"line_number":113,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":114,"context_line":"With the implementation of `bring your own key` there is an impact to security."},{"line_number":115,"context_line":"The user will be passing a plain-text key for encryption/decryption instead of"},{"line_number":116,"context_line":"providing a secret_ref which obtains the key from a Key Manager. The key may be"},{"line_number":117,"context_line":"directly exposed to more services than the standard Castellan/Barbican model."},{"line_number":118,"context_line":"However the exposure should be ephemeral, allowing you to make point-in-time"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9aed3d3a_a5ab4674","line":115,"in_reply_to":"9aed3d3a_1e3bfcec","updated":"2016-02-29 16:21:05.000000000","message":"The user can choose whether to wrap the key(store it in Barbican, KMIP, etc.) or pass it directly. When passing to one service that service may need to interact with others.\n\nAs Nathan Suggested in Patch 4: When creating a Nova instance that is to have its ephemeral disk encrypted then the key will pass from Horizon to Nova controller to Gantt to Nova compute node.","commit_id":"357ffb01f6207abe84396050f588e757dd1f1d2a"},{"author":{"_account_id":6783,"name":"Nathan Reller","email":"nathan.s.reller@gmail.com","username":"rellerreller"},"change_message_id":"44261a4882f1e8a9f04261f25cdea6f08f2c417e","unresolved":false,"context_lines":[{"line_number":121,"context_line":"directly exposed to more services than the standard Castellan/Barbican model."},{"line_number":122,"context_line":"However the exposure should be ephemeral, allowing you to make point-in-time"},{"line_number":123,"context_line":"security assertions that are different from a more standard model. Also note"},{"line_number":124,"context_line":"that some services may cache the key. How secure the BYOK solution is depends"},{"line_number":125,"context_line":"on compliance from the cloud provider."},{"line_number":126,"context_line":""},{"line_number":127,"context_line":"Implementation"},{"line_number":128,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":7,"id":"7af24918_effe5e04","line":125,"range":{"start_line":124,"start_character":38,"end_line":125,"end_character":38},"updated":"2016-03-01 14:05:19.000000000","message":"Should also note that this may not work with certain specifications. In particular you mention NIST SP 800-57. Part 1 Section 6.1 states:\n\n\"When a symmetric or private key is available outside a cryptographic module, confidentiality protection shall be provided either by encryption (e.g., key wrapping) at an appropriate security strength (see [SP800-152]), by the use of separate key components (see Section 6.2.1.3) or by controlling access to the key via physical means (e.g. storing the keying material in a safe with limited access).\"\n\nI\u0027m not sure if we can make that claim.\n\nPCI DSS Section 3.5.1 “Restrict access to cryptographic keys to the fewest number of custodians necessary.”\n\nI\u0027m not sure if this design allows us to make that claim as well unless the team managing the Horizon and controller boxes is the same as that managing computer nodes.","commit_id":"c210c8fbe860e680fabb55c1daab3872e888fe36"},{"author":{"_account_id":12000,"name":"Ian Cordasco","email":"sigmavirus24@gmail.com","username":"sigmavirus24"},"change_message_id":"3b94c95c85875e0e25db58e0749fab71247f5ce1","unresolved":false,"context_lines":[{"line_number":45,"context_line":""},{"line_number":46,"context_line":".. code-block python::"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"  def get_key(actual_key\u003dNone, key_manager\u003dNone, key_uuid\u003dNone):"},{"line_number":49,"context_line":"  if actual_key:"},{"line_number":50,"context_line":"    return actual_key"},{"line_number":51,"context_line":"  return key_manager.get_key(key_uuid)"}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a18252c_b1ac5936","line":48,"updated":"2016-04-13 21:59:06.000000000","message":"Nit: Shouldn\u0027t the following be indented another 4 spaces?","commit_id":"82d350c602d87c237225fc4fce119cb8830156a2"},{"author":{"_account_id":8623,"name":"Kaitlin Farr","email":"kaitlin.farr@jhuapl.edu","username":"kaitlin.farr"},"change_message_id":"8506d520f0904c2f8b58c0888ee0d080b361d1d3","unresolved":false,"context_lines":[{"line_number":103,"context_line":""},{"line_number":104,"context_line":"Alternative"},{"line_number":105,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":106,"context_line":"An alternative to BYOK would be to implement the PULL model, where the service"},{"line_number":107,"context_line":"requests the key which is retrieved from the customer on demand."},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"API Impact"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3afc51ec_edac51a2","line":106,"updated":"2016-03-14 16:52:18.000000000","message":"Has anyone written up the pros and cons on PUSH vs PULL?  It would be beneficial to document in this spec why we would choose one over the other.","commit_id":"82d350c602d87c237225fc4fce119cb8830156a2"},{"author":{"_account_id":1207,"name":"Duncan Thomas","email":"duncan.thomas@gmail.com","username":"duncan-thomas"},"change_message_id":"ccbd047a597a6fb0b47f9f25a38f9f335a3f7608","unresolved":false,"context_lines":[{"line_number":111,"context_line":"Each Service which uses or will use Castellan should extend their appropriate"},{"line_number":112,"context_line":"APIs. The APIs which use encryption should be extended so that a key can be"},{"line_number":113,"context_line":"passed and used for encryption and decryption. This will need to be further"},{"line_number":114,"context_line":"discussed."},{"line_number":115,"context_line":""},{"line_number":116,"context_line":"Security Impact"},{"line_number":117,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":8,"id":"da0c15f0_ffb06e45","line":114,"range":{"start_line":114,"start_character":0,"end_line":114,"end_character":10},"updated":"2016-03-28 13:01:46.000000000","message":"This could be done at a middleware, pushing the keys into the context and letting Castellan handle things entirely without change to the existing service code, I think.\n\nPutting this in the service API code for numerous services is rather more extensive and intrusive a change.","commit_id":"82d350c602d87c237225fc4fce119cb8830156a2"}]}