)]}'
{"doc/source/index.rst":[{"author":{"_account_id":6968,"name":"Christian Schwede","email":"cschwede@nvidia.com","username":"cschwede"},"change_message_id":"dc46317751b16273e3c6bc97a6bfbb2bc4020fc5","unresolved":false,"context_lines":[{"line_number":59,"context_line":"    overview_erasure_code"},{"line_number":60,"context_line":"    overview_backing_store"},{"line_number":61,"context_line":"    ring_background"},{"line_number":62,"context_line":"    overview_encryption"},{"line_number":63,"context_line":"    associated_projects"},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"Developer Documentation"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7aa08908_e2a98391","line":62,"updated":"2016-06-14 12:06:04.000000000","message":"nit: I probably would move this up a bit, IMO this is a great feature and of major interest. Probably just after overview_erasure_code","commit_id":"e37bca1b505c8523ae097229d9615cf3f7168c20"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"e0ba09415bd4ffecb6ec5c358ee16b00c72c607c","unresolved":false,"context_lines":[{"line_number":59,"context_line":"    overview_erasure_code"},{"line_number":60,"context_line":"    overview_backing_store"},{"line_number":61,"context_line":"    ring_background"},{"line_number":62,"context_line":"    overview_encryption"},{"line_number":63,"context_line":"    associated_projects"},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"Developer Documentation"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7aa08908_ecdbe37b","line":62,"in_reply_to":"7aa08908_e2a98391","updated":"2016-06-15 19:01:02.000000000","message":"Done","commit_id":"e37bca1b505c8523ae097229d9615cf3f7168c20"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"d40eff72ff042ca083b256f3a166acc5285c1285","unresolved":false,"context_lines":[{"line_number":133,"context_line":"    db"},{"line_number":134,"context_line":"    object"},{"line_number":135,"context_line":"    misc"},{"line_number":136,"context_line":"    middleware"},{"line_number":137,"context_line":""},{"line_number":138,"context_line":""},{"line_number":139,"context_line":"Indices and tables"}],"source_content_type":"text/x-rst","patch_set":10,"id":"3aaa91ec_e880fe8d","line":136,"range":{"start_line":136,"start_character":4,"end_line":136,"end_character":14},"updated":"2016-06-27 19:06:27.000000000","message":"Should encrypter, decrypter, and keymaster show up in the middleware source docs? They don\u0027t seem to be there currently. Might be better on the previous patch (which introduced them).","commit_id":"2e9007613c609de7a918f2c7a96060876485eaad"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"4e5cb9a3be89849d8d915d406fb090fdd10a062b","unresolved":false,"context_lines":[{"line_number":133,"context_line":"    db"},{"line_number":134,"context_line":"    object"},{"line_number":135,"context_line":"    misc"},{"line_number":136,"context_line":"    middleware"},{"line_number":137,"context_line":""},{"line_number":138,"context_line":""},{"line_number":139,"context_line":"Indices and tables"}],"source_content_type":"text/x-rst","patch_set":10,"id":"3aaa91ec_45fe1eaf","line":136,"range":{"start_line":136,"start_character":4,"end_line":136,"end_character":14},"in_reply_to":"3aaa91ec_e880fe8d","updated":"2016-06-28 17:00:33.000000000","message":"Done in patch 328208","commit_id":"2e9007613c609de7a918f2c7a96060876485eaad"}],"doc/source/overview_container_sync.rst":[{"author":{"_account_id":9576,"name":"Thai Tran","email":"tqtran@us.ibm.com","username":"tqtran"},"change_message_id":"1b715fb27f30299f428ae55d194d286d26d80b0c","unresolved":false,"context_lines":[{"line_number":19,"context_line":"    in different containers."},{"line_number":20,"context_line":""},{"line_number":21,"context_line":".. note::"},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"    If you are using encryption middleware in the cluster which is the source"},{"line_number":24,"context_line":"    of objects being synced then you should follow the instructions to"},{"line_number":25,"context_line":"    configure :ref:`container_sync_client_config` to be compatible with encryption."}],"source_content_type":"text/x-rst","patch_set":3,"id":"7aa08908_bf2e9189","line":22,"updated":"2016-06-14 20:53:06.000000000","message":"Optional. use of commas could help readability.\nIf you are....in the cluster, which...., then you should....","commit_id":"e37bca1b505c8523ae097229d9615cf3f7168c20"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"e0ba09415bd4ffecb6ec5c358ee16b00c72c607c","unresolved":false,"context_lines":[{"line_number":19,"context_line":"    in different containers."},{"line_number":20,"context_line":""},{"line_number":21,"context_line":".. note::"},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"    If you are using encryption middleware in the cluster which is the source"},{"line_number":24,"context_line":"    of objects being synced then you should follow the instructions to"},{"line_number":25,"context_line":"    configure :ref:`container_sync_client_config` to be compatible with encryption."}],"source_content_type":"text/x-rst","patch_set":3,"id":"7aa08908_ccf427d1","line":22,"in_reply_to":"7aa08908_bf2e9189","updated":"2016-06-15 19:01:02.000000000","message":"Done","commit_id":"e37bca1b505c8523ae097229d9615cf3f7168c20"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"5aedd33b38d847b1aa2ca8482aae7d18a31281b2","unresolved":false,"context_lines":[{"line_number":19,"context_line":"    in different containers."},{"line_number":20,"context_line":""},{"line_number":21,"context_line":".. note::"},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"    If you are using encryption middleware in the cluster which is the source"},{"line_number":24,"context_line":"    of objects being synced then you should follow the instructions to"},{"line_number":25,"context_line":"    configure :ref:`container_sync_client_config` to be compatible with encryption."}],"source_content_type":"text/x-rst","patch_set":3,"id":"7aa08908_863cc9c0","line":22,"in_reply_to":"7aa08908_bf2e9189","updated":"2016-06-15 14:45:14.000000000","message":"I think a comma between \"cluster\" and \"which\" would be incorrect. It might be that I should s/which/that/","commit_id":"e37bca1b505c8523ae097229d9615cf3f7168c20"}],"doc/source/overview_encryption.rst":[{"author":{"_account_id":4608,"name":"Kota Tsuyuzaki","email":"bloodeagle40234@gmail.com","username":"tsuyuzaki-kota"},"change_message_id":"e6542dd24a4be4be3a066c95b8c7030cb485c073","unresolved":false,"context_lines":[{"line_number":16,"context_line":""},{"line_number":17,"context_line":"* Object content i.e. the content of an object PUT request\u0027s body"},{"line_number":18,"context_line":"* The entity tag (ETag) of the object"},{"line_number":19,"context_line":"* All custom user metadata values i.e. metadata sent using X-Object-Meta-"},{"line_number":20,"context_line":"  prefixed headers with PUT or POST requests"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"Any data not included in the list above are not encrypted, including:"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7aa08908_93a2defa","line":19,"updated":"2016-06-13 07:24:49.000000000","message":"nits) \"All *object* custom user metadata\"\n\nWe may be able to find it means *object* in following explanation but at my first reading, I\u0027m feeling it looks conflict with L25. Now I know custom metadata for object is only encrypted and no conflict is there though.","commit_id":"c5cb86b66acdb6f9b66a53aba60c95144db9a9dd"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"9cc0bca3d241b6817676a09e18ac7295de6d4c0e","unresolved":false,"context_lines":[{"line_number":16,"context_line":""},{"line_number":17,"context_line":"* Object content i.e. the content of an object PUT request\u0027s body"},{"line_number":18,"context_line":"* The entity tag (ETag) of the object"},{"line_number":19,"context_line":"* All custom user metadata values i.e. metadata sent using X-Object-Meta-"},{"line_number":20,"context_line":"  prefixed headers with PUT or POST requests"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"Any data not included in the list above are not encrypted, including:"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7aa08908_e274129d","line":19,"in_reply_to":"7aa08908_93a2defa","updated":"2016-06-13 16:52:23.000000000","message":"Done","commit_id":"c5cb86b66acdb6f9b66a53aba60c95144db9a9dd"},{"author":{"_account_id":4608,"name":"Kota Tsuyuzaki","email":"bloodeagle40234@gmail.com","username":"tsuyuzaki-kota"},"change_message_id":"e6542dd24a4be4be3a066c95b8c7030cb485c073","unresolved":false,"context_lines":[{"line_number":23,"context_line":""},{"line_number":24,"context_line":"* Account, container and object names"},{"line_number":25,"context_line":"* Account and container custom user metadata"},{"line_number":26,"context_line":"* Custom user metadata names"},{"line_number":27,"context_line":"* Object Content-Type values"},{"line_number":28,"context_line":"* Object size"},{"line_number":29,"context_line":"* System metadata"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7aa08908_93c77e97","line":26,"updated":"2016-06-13 07:24:49.000000000","message":"All of custom metadata names (including object)?\n\nIt seems true though.","commit_id":"c5cb86b66acdb6f9b66a53aba60c95144db9a9dd"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"9cc0bca3d241b6817676a09e18ac7295de6d4c0e","unresolved":false,"context_lines":[{"line_number":23,"context_line":""},{"line_number":24,"context_line":"* Account, container and object names"},{"line_number":25,"context_line":"* Account and container custom user metadata"},{"line_number":26,"context_line":"* Custom user metadata names"},{"line_number":27,"context_line":"* Object Content-Type values"},{"line_number":28,"context_line":"* Object size"},{"line_number":29,"context_line":"* System metadata"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7aa08908_c2791695","line":26,"in_reply_to":"7aa08908_93c77e97","updated":"2016-06-13 16:52:23.000000000","message":"Done","commit_id":"c5cb86b66acdb6f9b66a53aba60c95144db9a9dd"},{"author":{"_account_id":4608,"name":"Kota Tsuyuzaki","email":"bloodeagle40234@gmail.com","username":"tsuyuzaki-kota"},"change_message_id":"e6542dd24a4be4be3a066c95b8c7030cb485c073","unresolved":false,"context_lines":[{"line_number":113,"context_line":"   one is not already in use) based on the sample file"},{"line_number":114,"context_line":"   `internal-client.conf-sample`. For example, copy"},{"line_number":115,"context_line":"   `internal-client.conf-sample` to `/etc/swift/container-sync-client.conf`."},{"line_number":116,"context_line":"#. Modify this file include to include the encryption middlewares in the"},{"line_number":117,"context_line":"   pipeline in the same way as described above for the proxy server."},{"line_number":118,"context_line":"#. Modify the container-sync section of all container server config files to"},{"line_number":119,"context_line":"   point to this internal client config file using the"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7aa08908_13ef0eea","line":116,"range":{"start_line":116,"start_character":19,"end_line":116,"end_character":38},"updated":"2016-06-13 07:24:49.000000000","message":"nits) \"include\" is repeated. probably \"s/Modify this file include to include/Modify this file to include/\"","commit_id":"c5cb86b66acdb6f9b66a53aba60c95144db9a9dd"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"9cc0bca3d241b6817676a09e18ac7295de6d4c0e","unresolved":false,"context_lines":[{"line_number":113,"context_line":"   one is not already in use) based on the sample file"},{"line_number":114,"context_line":"   `internal-client.conf-sample`. For example, copy"},{"line_number":115,"context_line":"   `internal-client.conf-sample` to `/etc/swift/container-sync-client.conf`."},{"line_number":116,"context_line":"#. Modify this file include to include the encryption middlewares in the"},{"line_number":117,"context_line":"   pipeline in the same way as described above for the proxy server."},{"line_number":118,"context_line":"#. Modify the container-sync section of all container server config files to"},{"line_number":119,"context_line":"   point to this internal client config file using the"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7aa08908_027e7e69","line":116,"range":{"start_line":116,"start_character":19,"end_line":116,"end_character":38},"in_reply_to":"7aa08908_13ef0eea","updated":"2016-06-13 16:52:23.000000000","message":"Done","commit_id":"c5cb86b66acdb6f9b66a53aba60c95144db9a9dd"},{"author":{"_account_id":4608,"name":"Kota Tsuyuzaki","email":"bloodeagle40234@gmail.com","username":"tsuyuzaki-kota"},"change_message_id":"e6542dd24a4be4be3a066c95b8c7030cb485c073","unresolved":false,"context_lines":[{"line_number":119,"context_line":"   point to this internal client config file using the"},{"line_number":120,"context_line":"   ``internal_client_conf_path`` option. For example::"},{"line_number":121,"context_line":""},{"line_number":122,"context_line":"     internal_client_conf_path \u003d /etc/swift/container-sync-client.conf"},{"line_number":123,"context_line":""},{"line_number":124,"context_line":"--------------------------"},{"line_number":125,"context_line":"Performance Considerations"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7aa08908_33696afa","line":122,"updated":"2016-06-13 07:24:49.000000000","message":"Just a question:\n\n- what\u0027s happen if we forget to set the container-sync option with current implementation? \n\n\nI am assuming the sync fails with noting synced because if the sync done without de-crypt/re-encrypt, it makes objects which is not decryptable. I\u0027m not sure, is it true?","commit_id":"c5cb86b66acdb6f9b66a53aba60c95144db9a9dd"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"9cc0bca3d241b6817676a09e18ac7295de6d4c0e","unresolved":false,"context_lines":[{"line_number":119,"context_line":"   point to this internal client config file using the"},{"line_number":120,"context_line":"   ``internal_client_conf_path`` option. For example::"},{"line_number":121,"context_line":""},{"line_number":122,"context_line":"     internal_client_conf_path \u003d /etc/swift/container-sync-client.conf"},{"line_number":123,"context_line":""},{"line_number":124,"context_line":"--------------------------"},{"line_number":125,"context_line":"Performance Considerations"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7aa08908_627dc21b","line":122,"in_reply_to":"7aa08908_33696afa","updated":"2016-06-13 16:52:23.000000000","message":"Encrypted object data will be sync\u0027d to the destination container. If the encryption middlewares are not in the internal client pipeline then we have no way of knowing that the objects are encrypted in order to deliberately fail container sync.\n\nI\u0027ll add a note in the container sync doc that points to this doc as another heads-up.","commit_id":"c5cb86b66acdb6f9b66a53aba60c95144db9a9dd"},{"author":{"_account_id":4608,"name":"Kota Tsuyuzaki","email":"bloodeagle40234@gmail.com","username":"tsuyuzaki-kota"},"change_message_id":"e6542dd24a4be4be3a066c95b8c7030cb485c073","unresolved":false,"context_lines":[{"line_number":137,"context_line":"Plaintext data is encrypted to a ciphertext using the AES cipher with 256-bit"},{"line_number":138,"context_line":"keys. The cipher is used in counter mode so that any byte or range of bytes in"},{"line_number":139,"context_line":"the ciphertext may be decrypted independently of any other bytes in the"},{"line_number":140,"context_line":"ciphertext. This enables very simple handling of ranged GETs."},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"In general an item of plaintext data ``p`` is transformed to a ciphertext"},{"line_number":143,"context_line":"``c``::"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7aa08908_1b8e0479","line":140,"range":{"start_line":140,"start_character":11,"end_line":140,"end_character":60},"updated":"2016-06-13 07:24:49.000000000","message":"If we don\u0027t touch about range-GET in detail here, it might be better to place the description down to later section because at my first reading, I was expecting we are diving into the deep mechanism of encryption for both w/ and w/o ranges but it was false. So my recommendation is just say like \"it uses counter mode\" and we could have more details in the later section like as \"cipher with range\".","commit_id":"c5cb86b66acdb6f9b66a53aba60c95144db9a9dd"},{"author":{"_account_id":4608,"name":"Kota Tsuyuzaki","email":"bloodeagle40234@gmail.com","username":"tsuyuzaki-kota"},"change_message_id":"e6542dd24a4be4be3a066c95b8c7030cb485c073","unresolved":false,"context_lines":[{"line_number":137,"context_line":"Plaintext data is encrypted to a ciphertext using the AES cipher with 256-bit"},{"line_number":138,"context_line":"keys. The cipher is used in counter mode so that any byte or range of bytes in"},{"line_number":139,"context_line":"the ciphertext may be decrypted independently of any other bytes in the"},{"line_number":140,"context_line":"ciphertext. This enables very simple handling of ranged GETs."},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"In general an item of plaintext data ``p`` is transformed to a ciphertext"},{"line_number":143,"context_line":"``c``::"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7aa08908_c5113954","line":140,"updated":"2016-06-13 07:24:49.000000000","message":"Probably we need a description of the encryption library. Looking at the feature/crypt branch, it seems we need cryptography library[1], right? So I think it would be better to add the link to there if it\u0027s external module like we did in Erasure Code docs[2].\n\n1: https://pypi.python.org/pypi/cryptography\n\n2: http://docs.openstack.org/developer/swift/overview_erasure_code.html#pyeclib-external-erasure-code-library","commit_id":"c5cb86b66acdb6f9b66a53aba60c95144db9a9dd"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"9cc0bca3d241b6817676a09e18ac7295de6d4c0e","unresolved":false,"context_lines":[{"line_number":137,"context_line":"Plaintext data is encrypted to a ciphertext using the AES cipher with 256-bit"},{"line_number":138,"context_line":"keys. The cipher is used in counter mode so that any byte or range of bytes in"},{"line_number":139,"context_line":"the ciphertext may be decrypted independently of any other bytes in the"},{"line_number":140,"context_line":"ciphertext. This enables very simple handling of ranged GETs."},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"In general an item of plaintext data ``p`` is transformed to a ciphertext"},{"line_number":143,"context_line":"``c``::"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7aa08908_366adced","line":140,"range":{"start_line":140,"start_character":11,"end_line":140,"end_character":60},"in_reply_to":"7aa08908_1b8e0479","updated":"2016-06-13 16:52:23.000000000","message":"This is the only place in the doc that discusses the choice of cipher and mode. We don\u0027t go on to discuss ranged vs non-ranged GETs (because this is just an overview). So at the moment I\u0027d prefer to leave this here if that\u0027s OK. I will add definition of \"CTR\" abbreviation.","commit_id":"c5cb86b66acdb6f9b66a53aba60c95144db9a9dd"},{"author":{"_account_id":4608,"name":"Kota Tsuyuzaki","email":"bloodeagle40234@gmail.com","username":"tsuyuzaki-kota"},"change_message_id":"ce9b82d8d5f1cc96b95d8efe2d30d8587ffb241a","unresolved":false,"context_lines":[{"line_number":137,"context_line":"Plaintext data is encrypted to a ciphertext using the AES cipher with 256-bit"},{"line_number":138,"context_line":"keys. The cipher is used in counter mode so that any byte or range of bytes in"},{"line_number":139,"context_line":"the ciphertext may be decrypted independently of any other bytes in the"},{"line_number":140,"context_line":"ciphertext. This enables very simple handling of ranged GETs."},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"In general an item of plaintext data ``p`` is transformed to a ciphertext"},{"line_number":143,"context_line":"``c``::"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7aa08908_bfe5e3dc","line":140,"range":{"start_line":140,"start_character":11,"end_line":140,"end_character":60},"in_reply_to":"7aa08908_366adced","updated":"2016-06-14 09:13:16.000000000","message":"Yeah, that\u0027s ok. Thanks.","commit_id":"c5cb86b66acdb6f9b66a53aba60c95144db9a9dd"},{"author":{"_account_id":4608,"name":"Kota Tsuyuzaki","email":"bloodeagle40234@gmail.com","username":"tsuyuzaki-kota"},"change_message_id":"e6542dd24a4be4be3a066c95b8c7030cb485c073","unresolved":false,"context_lines":[{"line_number":139,"context_line":"the ciphertext may be decrypted independently of any other bytes in the"},{"line_number":140,"context_line":"ciphertext. This enables very simple handling of ranged GETs."},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"In general an item of plaintext data ``p`` is transformed to a ciphertext"},{"line_number":143,"context_line":"``c``::"},{"line_number":144,"context_line":""},{"line_number":145,"context_line":"  ciphertext \u003d E(plaintext, k, iv)"},{"line_number":146,"context_line":""},{"line_number":147,"context_line":"where ``E`` is the encryption function, ``k`` is an encryption key and ``iv``"},{"line_number":148,"context_line":"is a unique initialization vector (IV) chosen for each encryption operation."}],"source_content_type":"text/x-rst","patch_set":1,"id":"7aa08908_489ba018","line":145,"range":{"start_line":142,"start_character":0,"end_line":145,"end_character":34},"updated":"2016-06-13 07:24:49.000000000","message":"nits) if we defined plaintext as \"p\" and cipher text as \"c\", the formula should be\n\n c \u003d E(p, k, iv)\n\nOr, the description should be like as \"an item of plain text data ``plaintext``...\"\n\nOtherwise, readers may attempt to find the \"p\" in the following formula which never appeared.","commit_id":"c5cb86b66acdb6f9b66a53aba60c95144db9a9dd"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"9cc0bca3d241b6817676a09e18ac7295de6d4c0e","unresolved":false,"context_lines":[{"line_number":139,"context_line":"the ciphertext may be decrypted independently of any other bytes in the"},{"line_number":140,"context_line":"ciphertext. This enables very simple handling of ranged GETs."},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"In general an item of plaintext data ``p`` is transformed to a ciphertext"},{"line_number":143,"context_line":"``c``::"},{"line_number":144,"context_line":""},{"line_number":145,"context_line":"  ciphertext \u003d E(plaintext, k, iv)"},{"line_number":146,"context_line":""},{"line_number":147,"context_line":"where ``E`` is the encryption function, ``k`` is an encryption key and ``iv``"},{"line_number":148,"context_line":"is a unique initialization vector (IV) chosen for each encryption operation."}],"source_content_type":"text/x-rst","patch_set":1,"id":"7aa08908_6bf91d80","line":145,"range":{"start_line":142,"start_character":0,"end_line":145,"end_character":34},"in_reply_to":"7aa08908_489ba018","updated":"2016-06-13 16:52:23.000000000","message":"Done","commit_id":"c5cb86b66acdb6f9b66a53aba60c95144db9a9dd"},{"author":{"_account_id":4608,"name":"Kota Tsuyuzaki","email":"bloodeagle40234@gmail.com","username":"tsuyuzaki-kota"},"change_message_id":"e6542dd24a4be4be3a066c95b8c7030cb485c073","unresolved":false,"context_lines":[{"line_number":157,"context_line":"the IV and the cipher algorithm used for the encryption::"},{"line_number":158,"context_line":""},{"line_number":159,"context_line":"  crypto_metadata \u003d {\"iv\": \u003c16 byte value\u003e,"},{"line_number":160,"context_line":"                     \"cipher\": \"AES_CTR_256\"}"},{"line_number":161,"context_line":""},{"line_number":162,"context_line":"Key management"},{"line_number":163,"context_line":"--------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7aa08908_9ba2f4fa","line":160,"range":{"start_line":160,"start_character":36,"end_line":160,"end_character":39},"updated":"2016-06-13 07:24:49.000000000","message":"Ah yeah, \"CTR\" means counter mode described in above.","commit_id":"c5cb86b66acdb6f9b66a53aba60c95144db9a9dd"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"9cc0bca3d241b6817676a09e18ac7295de6d4c0e","unresolved":false,"context_lines":[{"line_number":157,"context_line":"the IV and the cipher algorithm used for the encryption::"},{"line_number":158,"context_line":""},{"line_number":159,"context_line":"  crypto_metadata \u003d {\"iv\": \u003c16 byte value\u003e,"},{"line_number":160,"context_line":"                     \"cipher\": \"AES_CTR_256\"}"},{"line_number":161,"context_line":""},{"line_number":162,"context_line":"Key management"},{"line_number":163,"context_line":"--------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7aa08908_cb301159","line":160,"range":{"start_line":160,"start_character":36,"end_line":160,"end_character":39},"in_reply_to":"7aa08908_9ba2f4fa","updated":"2016-06-13 16:52:23.000000000","message":"Done","commit_id":"c5cb86b66acdb6f9b66a53aba60c95144db9a9dd"},{"author":{"_account_id":4608,"name":"Kota Tsuyuzaki","email":"bloodeagle40234@gmail.com","username":"tsuyuzaki-kota"},"change_message_id":"e6542dd24a4be4be3a066c95b8c7030cb485c073","unresolved":false,"context_lines":[{"line_number":180,"context_line":""},{"line_number":181,"context_line":"The encrypter uses the object key to `wrap` other randomly generated keys that"},{"line_number":182,"context_line":"are used to encrypt object data. A random key is `wrapped` by encrypting it"},{"line_number":183,"context_line":"using the object key provided by the keymaster. This makes it safe to then"},{"line_number":184,"context_line":"store the wrapped key alongside object data and metadata."},{"line_number":185,"context_line":""},{"line_number":186,"context_line":"This process of `key wrapping` is performed to enable more efficient re-keying"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7aa08908_3b0b00d8","line":183,"range":{"start_line":183,"start_character":69,"end_line":183,"end_character":74},"updated":"2016-06-13 07:24:49.000000000","message":"nits) not sure but... do we need \u0027then\u0027 here?","commit_id":"c5cb86b66acdb6f9b66a53aba60c95144db9a9dd"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"9cc0bca3d241b6817676a09e18ac7295de6d4c0e","unresolved":false,"context_lines":[{"line_number":180,"context_line":""},{"line_number":181,"context_line":"The encrypter uses the object key to `wrap` other randomly generated keys that"},{"line_number":182,"context_line":"are used to encrypt object data. A random key is `wrapped` by encrypting it"},{"line_number":183,"context_line":"using the object key provided by the keymaster. This makes it safe to then"},{"line_number":184,"context_line":"store the wrapped key alongside object data and metadata."},{"line_number":185,"context_line":""},{"line_number":186,"context_line":"This process of `key wrapping` is performed to enable more efficient re-keying"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7aa08908_0b37b94d","line":183,"range":{"start_line":183,"start_character":69,"end_line":183,"end_character":74},"in_reply_to":"7aa08908_3b0b00d8","updated":"2016-06-13 16:52:23.000000000","message":"Done","commit_id":"c5cb86b66acdb6f9b66a53aba60c95144db9a9dd"},{"author":{"_account_id":4608,"name":"Kota Tsuyuzaki","email":"bloodeagle40234@gmail.com","username":"tsuyuzaki-kota"},"change_message_id":"e6542dd24a4be4be3a066c95b8c7030cb485c073","unresolved":false,"context_lines":[{"line_number":183,"context_line":"using the object key provided by the keymaster. This makes it safe to then"},{"line_number":184,"context_line":"store the wrapped key alongside object data and metadata."},{"line_number":185,"context_line":""},{"line_number":186,"context_line":"This process of `key wrapping` is performed to enable more efficient re-keying"},{"line_number":187,"context_line":"events when the object key may need to be replaced and consequently any data"},{"line_number":188,"context_line":"encrypted using that key must be re-encrypted. Key wrapping minimizes the"},{"line_number":189,"context_line":"amount of data encrypted using those keys to just other randomly chosen keys"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7aa08908_db0d9c3f","line":186,"range":{"start_line":186,"start_character":69,"end_line":186,"end_character":78},"updated":"2016-06-13 07:24:49.000000000","message":"Just a question, what kind of key for this re-keying operation? (root_secret? random generated body key?)\n\nThe wrapper seems to protect the random body key and it could be able *to keep current random body key with a new root secret* easier than re-encrypt whole things *with new random generated keys* but i\u0027m not sure if what I thought is correct or not. If re-keying is defined as replacing whole contents with new random keys, the wrapper affect nothing anymore though... Probably I\u0027m missing something.","commit_id":"c5cb86b66acdb6f9b66a53aba60c95144db9a9dd"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"9cc0bca3d241b6817676a09e18ac7295de6d4c0e","unresolved":false,"context_lines":[{"line_number":183,"context_line":"using the object key provided by the keymaster. This makes it safe to then"},{"line_number":184,"context_line":"store the wrapped key alongside object data and metadata."},{"line_number":185,"context_line":""},{"line_number":186,"context_line":"This process of `key wrapping` is performed to enable more efficient re-keying"},{"line_number":187,"context_line":"events when the object key may need to be replaced and consequently any data"},{"line_number":188,"context_line":"encrypted using that key must be re-encrypted. Key wrapping minimizes the"},{"line_number":189,"context_line":"amount of data encrypted using those keys to just other randomly chosen keys"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7aa08908_ebeead89","line":186,"range":{"start_line":186,"start_character":69,"end_line":186,"end_character":78},"in_reply_to":"7aa08908_db0d9c3f","updated":"2016-06-13 16:52:23.000000000","message":"root secret and/or \"the object key may need to be replaced\".\n\nIt is NOT anticipated that the body key would be replaced - the idea is that the randomly chosen body key is never changed, but managed or derived keys may need to be changed.","commit_id":"c5cb86b66acdb6f9b66a53aba60c95144db9a9dd"},{"author":{"_account_id":4608,"name":"Kota Tsuyuzaki","email":"bloodeagle40234@gmail.com","username":"tsuyuzaki-kota"},"change_message_id":"ce9b82d8d5f1cc96b95d8efe2d30d8587ffb241a","unresolved":false,"context_lines":[{"line_number":183,"context_line":"using the object key provided by the keymaster. This makes it safe to then"},{"line_number":184,"context_line":"store the wrapped key alongside object data and metadata."},{"line_number":185,"context_line":""},{"line_number":186,"context_line":"This process of `key wrapping` is performed to enable more efficient re-keying"},{"line_number":187,"context_line":"events when the object key may need to be replaced and consequently any data"},{"line_number":188,"context_line":"encrypted using that key must be re-encrypted. Key wrapping minimizes the"},{"line_number":189,"context_line":"amount of data encrypted using those keys to just other randomly chosen keys"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7aa08908_3fa9f324","line":186,"range":{"start_line":186,"start_character":69,"end_line":186,"end_character":78},"in_reply_to":"7aa08908_ebeead89","updated":"2016-06-14 09:13:16.000000000","message":"Make sense. We don\u0027t have to re-encrypt the object unless we want to replace the body key. If we want to \"re-keying\" for the object key or/and root_secret, what we need is just pop the current key and replace with the new wrapped key into the object metadata. That would be the current \"re-keying\" scenario.","commit_id":"c5cb86b66acdb6f9b66a53aba60c95144db9a9dd"},{"author":{"_account_id":4608,"name":"Kota Tsuyuzaki","email":"bloodeagle40234@gmail.com","username":"tsuyuzaki-kota"},"change_message_id":"e6542dd24a4be4be3a066c95b8c7030cb485c073","unresolved":false,"context_lines":[{"line_number":261,"context_line":"provided container key, and an IV that is derived from the object\u0027s path, and"},{"line_number":262,"context_line":"saved as an item of system metadata::"},{"line_number":263,"context_line":""},{"line_number":264,"context_line":"  X-Object-Sysmeta-Crypto-Etag: E(md5(plaintext), container_key, F(path))"},{"line_number":265,"context_line":""},{"line_number":266,"context_line":"The encrypter stores the associated crypto metadata in a system metadata"},{"line_number":267,"context_line":"header::"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7aa08908_1e8ef278","line":264,"range":{"start_line":264,"start_character":65,"end_line":264,"end_character":71},"updated":"2016-06-13 07:24:49.000000000","message":"What does \"F\" function mean?\n\nIt looks the first place to be in and no description for it.\n\nthe \"path\" seems \"object path\" though...","commit_id":"c5cb86b66acdb6f9b66a53aba60c95144db9a9dd"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"9cc0bca3d241b6817676a09e18ac7295de6d4c0e","unresolved":false,"context_lines":[{"line_number":261,"context_line":"provided container key, and an IV that is derived from the object\u0027s path, and"},{"line_number":262,"context_line":"saved as an item of system metadata::"},{"line_number":263,"context_line":""},{"line_number":264,"context_line":"  X-Object-Sysmeta-Crypto-Etag: E(md5(plaintext), container_key, F(path))"},{"line_number":265,"context_line":""},{"line_number":266,"context_line":"The encrypter stores the associated crypto metadata in a system metadata"},{"line_number":267,"context_line":"header::"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7aa08908_0bb85974","line":264,"range":{"start_line":264,"start_character":65,"end_line":264,"end_character":71},"in_reply_to":"7aa08908_1e8ef278","updated":"2016-06-13 16:52:23.000000000","message":"Done","commit_id":"c5cb86b66acdb6f9b66a53aba60c95144db9a9dd"},{"author":{"_account_id":4608,"name":"Kota Tsuyuzaki","email":"bloodeagle40234@gmail.com","username":"tsuyuzaki-kota"},"change_message_id":"e6542dd24a4be4be3a066c95b8c7030cb485c073","unresolved":false,"context_lines":[{"line_number":271,"context_line":""},{"line_number":272,"context_line":"The reason for using the container key for this encryption is that the"},{"line_number":273,"context_line":"encrypted ETag must also be included in the object update to the container"},{"line_number":274,"context_line":"server, and will be included in container listings. The decrypter must be able"},{"line_number":275,"context_line":"to decrypt the ETags in container listings using only the container key (since"},{"line_number":276,"context_line":"object keys may not be available when handling a container request) so the"},{"line_number":277,"context_line":"ETags must therefore be encrypted using the container key."}],"source_content_type":"text/x-rst","patch_set":1,"id":"7aa08908_5e2cfa01","line":274,"range":{"start_line":274,"start_character":8,"end_line":274,"end_character":50},"updated":"2016-06-13 07:24:49.000000000","message":"So this means any of container listing operations will take the overhead to decrypt for each etag, right? I don\u0027t know the decrypt performance but that sounds to affect the listing performance. Is that a thing to note for operators?","commit_id":"c5cb86b66acdb6f9b66a53aba60c95144db9a9dd"},{"author":{"_account_id":4608,"name":"Kota Tsuyuzaki","email":"bloodeagle40234@gmail.com","username":"tsuyuzaki-kota"},"change_message_id":"ce9b82d8d5f1cc96b95d8efe2d30d8587ffb241a","unresolved":false,"context_lines":[{"line_number":271,"context_line":""},{"line_number":272,"context_line":"The reason for using the container key for this encryption is that the"},{"line_number":273,"context_line":"encrypted ETag must also be included in the object update to the container"},{"line_number":274,"context_line":"server, and will be included in container listings. The decrypter must be able"},{"line_number":275,"context_line":"to decrypt the ETags in container listings using only the container key (since"},{"line_number":276,"context_line":"object keys may not be available when handling a container request) so the"},{"line_number":277,"context_line":"ETags must therefore be encrypted using the container key."}],"source_content_type":"text/x-rst","patch_set":1,"id":"7aa08908_1f523735","line":274,"range":{"start_line":274,"start_character":8,"end_line":274,"end_character":50},"in_reply_to":"7aa08908_361dbc62","updated":"2016-06-14 09:13:16.000000000","message":"Gotcha, thanks.","commit_id":"c5cb86b66acdb6f9b66a53aba60c95144db9a9dd"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"9cc0bca3d241b6817676a09e18ac7295de6d4c0e","unresolved":false,"context_lines":[{"line_number":271,"context_line":""},{"line_number":272,"context_line":"The reason for using the container key for this encryption is that the"},{"line_number":273,"context_line":"encrypted ETag must also be included in the object update to the container"},{"line_number":274,"context_line":"server, and will be included in container listings. The decrypter must be able"},{"line_number":275,"context_line":"to decrypt the ETags in container listings using only the container key (since"},{"line_number":276,"context_line":"object keys may not be available when handling a container request) so the"},{"line_number":277,"context_line":"ETags must therefore be encrypted using the container key."}],"source_content_type":"text/x-rst","patch_set":1,"id":"7aa08908_361dbc62","line":274,"range":{"start_line":274,"start_character":8,"end_line":274,"end_character":50},"in_reply_to":"7aa08908_5e2cfa01","updated":"2016-06-13 16:52:23.000000000","message":"Yes.\n\nWe should add some note in the performance considerations section when we have some more data (in progress).","commit_id":"c5cb86b66acdb6f9b66a53aba60c95144db9a9dd"},{"author":{"_account_id":4608,"name":"Kota Tsuyuzaki","email":"bloodeagle40234@gmail.com","username":"tsuyuzaki-kota"},"change_message_id":"e6542dd24a4be4be3a066c95b8c7030cb485c073","unresolved":false,"context_lines":[{"line_number":310,"context_line":"#. Fetch container and object keys from the keymaster via its callback"},{"line_number":311,"context_line":"#. Decrypt the ``X-Object-Sysmeta-Crypto-Etag`` value using the container"},{"line_number":312,"context_line":"   key and the IV found in the ``X-Object-Sysmeta-Crypto-Meta-Etag`` header"},{"line_number":313,"context_line":"#. Decrypt metadata headers using the object key"},{"line_number":314,"context_line":"#. Decrypt the wrapped body key found in ``X-Object-Sysmeta-Crypto-Meta``"},{"line_number":315,"context_line":"#. Decrypt the body using the body key"},{"line_number":316,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"7aa08908_dedc6ae6","line":313,"updated":"2016-06-13 07:24:49.000000000","message":"nits) header values, strictly.","commit_id":"c5cb86b66acdb6f9b66a53aba60c95144db9a9dd"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"9cc0bca3d241b6817676a09e18ac7295de6d4c0e","unresolved":false,"context_lines":[{"line_number":310,"context_line":"#. Fetch container and object keys from the keymaster via its callback"},{"line_number":311,"context_line":"#. Decrypt the ``X-Object-Sysmeta-Crypto-Etag`` value using the container"},{"line_number":312,"context_line":"   key and the IV found in the ``X-Object-Sysmeta-Crypto-Meta-Etag`` header"},{"line_number":313,"context_line":"#. Decrypt metadata headers using the object key"},{"line_number":314,"context_line":"#. Decrypt the wrapped body key found in ``X-Object-Sysmeta-Crypto-Meta``"},{"line_number":315,"context_line":"#. Decrypt the body using the body key"},{"line_number":316,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"7aa08908_962e308a","line":313,"in_reply_to":"7aa08908_dedc6ae6","updated":"2016-06-13 16:52:23.000000000","message":"Done","commit_id":"c5cb86b66acdb6f9b66a53aba60c95144db9a9dd"},{"author":{"_account_id":4608,"name":"Kota Tsuyuzaki","email":"bloodeagle40234@gmail.com","username":"tsuyuzaki-kota"},"change_message_id":"e6542dd24a4be4be3a066c95b8c7030cb485c073","unresolved":false,"context_lines":[{"line_number":322,"context_line":"#. Decrypt the response body ETag entries using the container key"},{"line_number":323,"context_line":""},{"line_number":324,"context_line":""},{"line_number":325,"context_line":"Impact on other Swift services"},{"line_number":326,"context_line":"------------------------------"},{"line_number":327,"context_line":""},{"line_number":328,"context_line":"`Container Sync` uses an internal client to GET objects that are to be sync\u0027d."}],"source_content_type":"text/x-rst","patch_set":1,"id":"7aa08908_fea4c64b","line":325,"updated":"2016-06-13 07:24:49.000000000","message":"Great section. This is the answer I am wondering around line 122 in this docs.","commit_id":"c5cb86b66acdb6f9b66a53aba60c95144db9a9dd"},{"author":{"_account_id":4608,"name":"Kota Tsuyuzaki","email":"bloodeagle40234@gmail.com","username":"tsuyuzaki-kota"},"change_message_id":"e6542dd24a4be4be3a066c95b8c7030cb485c073","unresolved":false,"context_lines":[{"line_number":363,"context_line":"not cause the object data and metadata to pass through the encryption"},{"line_number":364,"context_line":"middlewares in the proxy pipeline and be re-encrypted."},{"line_number":365,"context_line":""},{"line_number":366,"context_line":"The keymaster does persist the path that was used to derive keys as an item of"},{"line_number":367,"context_line":"system metadata name ``X-Object-Sysmeta-Crypto-Id``. This metadata has been"},{"line_number":368,"context_line":"included in anticipation of future scenarios when it may be necessary to"},{"line_number":369,"context_line":"decrypt an object that has been relocated without re-encrypting, in which case"},{"line_number":370,"context_line":"the value of ``X-Object-Sysmeta-Crypto-Id`` could be used to derive the keys"},{"line_number":371,"context_line":"that were used for encryption. However, this alone is not sufficient to handle"},{"line_number":372,"context_line":"conditional requests and to decrypt container listings where objects have been"},{"line_number":373,"context_line":"relocated, and further work will be required to solve those issues."}],"source_content_type":"text/x-rst","patch_set":1,"id":"7aa08908_39e5c837","line":373,"range":{"start_line":366,"start_character":0,"end_line":373,"end_character":67},"updated":"2016-06-13 07:24:49.000000000","message":"Has X-Object-Sysmeta-Crypto-Id existed in the proposed crypt-review patch chain?\n\nMy \u0027egrep Crypt-Id * -R\u0027 shows that only test/unit/common/middleware/test_keymaster.py has and it\u0027s in the fake response. Is this patch the last of chain, isn\u0027t it?","commit_id":"c5cb86b66acdb6f9b66a53aba60c95144db9a9dd"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"9cc0bca3d241b6817676a09e18ac7295de6d4c0e","unresolved":false,"context_lines":[{"line_number":363,"context_line":"not cause the object data and metadata to pass through the encryption"},{"line_number":364,"context_line":"middlewares in the proxy pipeline and be re-encrypted."},{"line_number":365,"context_line":""},{"line_number":366,"context_line":"The keymaster does persist the path that was used to derive keys as an item of"},{"line_number":367,"context_line":"system metadata name ``X-Object-Sysmeta-Crypto-Id``. This metadata has been"},{"line_number":368,"context_line":"included in anticipation of future scenarios when it may be necessary to"},{"line_number":369,"context_line":"decrypt an object that has been relocated without re-encrypting, in which case"},{"line_number":370,"context_line":"the value of ``X-Object-Sysmeta-Crypto-Id`` could be used to derive the keys"},{"line_number":371,"context_line":"that were used for encryption. However, this alone is not sufficient to handle"},{"line_number":372,"context_line":"conditional requests and to decrypt container listings where objects have been"},{"line_number":373,"context_line":"relocated, and further work will be required to solve those issues."}],"source_content_type":"text/x-rst","patch_set":1,"id":"7aa08908_16a7e00b","line":373,"range":{"start_line":366,"start_character":0,"end_line":373,"end_character":67},"in_reply_to":"7aa08908_39e5c837","updated":"2016-06-13 16:52:23.000000000","message":"Done. Oops, this header got removed from the implementation. Good catch. The metadata was included in crypto-metadata. I will update this paragraph.","commit_id":"c5cb86b66acdb6f9b66a53aba60c95144db9a9dd"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"a54daa658e10bc44b948eac5c17f226dc935496b","unresolved":false,"context_lines":[{"line_number":22,"context_line":"Any data not included in the list above are not encrypted, including:"},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"* Account, container and object names"},{"line_number":25,"context_line":"* Account and container custom user metadata values"},{"line_number":26,"context_line":"* All custom user metadata names"},{"line_number":27,"context_line":"* Object Content-Type values"},{"line_number":28,"context_line":"* Object size"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7aa08908_7c005b36","line":25,"range":{"start_line":25,"start_character":0,"end_line":25,"end_character":51},"updated":"2016-06-15 13:44:12.000000000","message":"Is there any particular reason why these are not encrypted?","commit_id":"e37bca1b505c8523ae097229d9615cf3f7168c20"},{"author":{"_account_id":12279,"name":"Janie Richling","email":"jrichli@us.ibm.com","username":"jrichli"},"change_message_id":"4f9e98e3b5e74b05e490e9d24f064bfa2c8a8ff9","unresolved":false,"context_lines":[{"line_number":22,"context_line":"Any data not included in the list above are not encrypted, including:"},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"* Account, container and object names"},{"line_number":25,"context_line":"* Account and container custom user metadata values"},{"line_number":26,"context_line":"* All custom user metadata names"},{"line_number":27,"context_line":"* Object Content-Type values"},{"line_number":28,"context_line":"* Object size"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7aa08908_37854107","line":25,"range":{"start_line":25,"start_character":0,"end_line":25,"end_character":51},"in_reply_to":"7aa08908_7c005b36","updated":"2016-06-15 15:38:22.000000000","message":"It was decided at the Austin hackathon 2015 that we needed to reduce some scope because there were more challenges to adding encryption than had been expected.  Many were still wanting this feature as soon as possible.  The account and container metadata was a good place to cut since it was something that could be added later and was separable.  One of the challenges was tempURL and CORS because they use the user meta namespace, and thus cannot be encrypted.  I am certain we can find a solution to that, but it is just an example of how dealing with those would increase scope. There would have been more tests to write, more special cases encountered, more cases to review, etc.  We can tackle these in the next iteration.","commit_id":"e37bca1b505c8523ae097229d9615cf3f7168c20"},{"author":{"_account_id":14766,"name":"Kazuhiro MIYAHARA","email":"miyahara.kazuhiro@lab.ntt.co.jp","username":"miyahara"},"change_message_id":"66c423d4cb7a3741d11a675267b4539b052b509a","unresolved":false,"context_lines":[{"line_number":60,"context_line":""},{"line_number":61,"context_line":"    The ``encryption_root_secret`` option holds the master secret key used for"},{"line_number":62,"context_line":"    encryption.  The security of all encrypted data critically depends on this"},{"line_number":63,"context_line":"    key, therefore it should be set to a high-entropy value. For example, a"},{"line_number":64,"context_line":"    suitable ``encryption_root_secret`` may be obtained by base-64 encoding a"},{"line_number":65,"context_line":"    32 byte (or longer) value generated by a cryptographically secure random"},{"line_number":66,"context_line":"    number generator."},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"    The ``encryption_root_secret`` value is necessary to recover any encrypted"},{"line_number":69,"context_line":"    data from the storage system, and therefore, it must be guarded against"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7aa08908_e322f0a2","line":66,"range":{"start_line":63,"start_character":61,"end_line":66,"end_character":21},"updated":"2016-06-15 09:29:36.000000000","message":"Because I didn\u0027t know that the length of base-64 encoded 32 byte value is 44, I couldn\u0027t tell whether the minimum length of ``encryption_root_secret`` is 44 or 32.\nIMO, if the fact that we can get 44 length base-64 string by encoding 32 byte value is included in this overview document, it will help readers to understand ``encryption_root_secret``.","commit_id":"e37bca1b505c8523ae097229d9615cf3f7168c20"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"e0ba09415bd4ffecb6ec5c358ee16b00c72c607c","unresolved":false,"context_lines":[{"line_number":60,"context_line":""},{"line_number":61,"context_line":"    The ``encryption_root_secret`` option holds the master secret key used for"},{"line_number":62,"context_line":"    encryption.  The security of all encrypted data critically depends on this"},{"line_number":63,"context_line":"    key, therefore it should be set to a high-entropy value. For example, a"},{"line_number":64,"context_line":"    suitable ``encryption_root_secret`` may be obtained by base-64 encoding a"},{"line_number":65,"context_line":"    32 byte (or longer) value generated by a cryptographically secure random"},{"line_number":66,"context_line":"    number generator."},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"    The ``encryption_root_secret`` value is necessary to recover any encrypted"},{"line_number":69,"context_line":"    data from the storage system, and therefore, it must be guarded against"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7aa08908_ec000338","line":66,"range":{"start_line":63,"start_character":61,"end_line":66,"end_character":21},"in_reply_to":"7aa08908_e322f0a2","updated":"2016-06-15 19:01:02.000000000","message":"Done","commit_id":"e37bca1b505c8523ae097229d9615cf3f7168c20"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"721100185366afeaa89a54a177ee5e3baff796b3","unresolved":false,"context_lines":[{"line_number":125,"context_line":"Performance Considerations"},{"line_number":126,"context_line":"--------------------------"},{"line_number":127,"context_line":""},{"line_number":128,"context_line":"TODO"},{"line_number":129,"context_line":""},{"line_number":130,"context_line":"--------------"},{"line_number":131,"context_line":"Implementation"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7aa08908_a2a67fbe","line":128,"updated":"2016-06-14 22:05:58.000000000","message":"A couple other questions, whose answers may help in answering Christian\u0027s question:\n\n- What sort of content do we want here to consider it \"done\"? \"Your cluster will be X% slower\"? Hardware recommendations? Or just a slightly better version of \"This will make things slower. Upgrade the CPUs on your proxies.\"?\n\n- What needs to happen before we can put something useful here? Define some test environment(s) and run before/after benchmarks, probably? Anything else?","commit_id":"e37bca1b505c8523ae097229d9615cf3f7168c20"},{"author":{"_account_id":6968,"name":"Christian Schwede","email":"cschwede@nvidia.com","username":"cschwede"},"change_message_id":"dc46317751b16273e3c6bc97a6bfbb2bc4020fc5","unresolved":false,"context_lines":[{"line_number":125,"context_line":"Performance Considerations"},{"line_number":126,"context_line":"--------------------------"},{"line_number":127,"context_line":""},{"line_number":128,"context_line":"TODO"},{"line_number":129,"context_line":""},{"line_number":130,"context_line":"--------------"},{"line_number":131,"context_line":"Implementation"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7aa08908_42b85711","line":128,"updated":"2016-06-14 12:06:04.000000000","message":"nit: Will this be done before merging to master? If not, I would simply remove this for now","commit_id":"e37bca1b505c8523ae097229d9615cf3f7168c20"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"e0ba09415bd4ffecb6ec5c358ee16b00c72c607c","unresolved":false,"context_lines":[{"line_number":125,"context_line":"Performance Considerations"},{"line_number":126,"context_line":"--------------------------"},{"line_number":127,"context_line":""},{"line_number":128,"context_line":"TODO"},{"line_number":129,"context_line":""},{"line_number":130,"context_line":"--------------"},{"line_number":131,"context_line":"Implementation"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7aa08908_ec0ac326","line":128,"in_reply_to":"7aa08908_a2a67fbe","updated":"2016-06-15 19:01:02.000000000","message":"I\u0027m going to remove the section until as Tim points out we have (a) formulated what information is useful and then (b) collected that information. IIRC, the EC feature was merged before performance studies were published, and even when they have been published it can be hard to condense into guidlines that are appropriate for a doc.","commit_id":"e37bca1b505c8523ae097229d9615cf3f7168c20"},{"author":{"_account_id":6968,"name":"Christian Schwede","email":"cschwede@nvidia.com","username":"cschwede"},"change_message_id":"dc46317751b16273e3c6bc97a6bfbb2bc4020fc5","unresolved":false,"context_lines":[{"line_number":357,"context_line":""},{"line_number":358,"context_line":"Developers should be aware that encryption middlewares rely on the path of an"},{"line_number":359,"context_line":"object remaining unchanged. The keymaster derives keys for containers and"},{"line_number":360,"context_line":"objects based on their paths. The encrypter also uses the object path to derive"},{"line_number":361,"context_line":"an IV for encrypting the ETag. As explained above, this choice of IV is"},{"line_number":362,"context_line":"made to enable conditional request ETag values to be encrypted in an"},{"line_number":363,"context_line":"identical fashion prior to matching with the object ETag."}],"source_content_type":"text/x-rst","patch_set":3,"id":"7aa08908_5c1ded71","line":360,"updated":"2016-06-14 12:06:04.000000000","message":"Maybe make this a little bit more clear, for example like this:\n\n The included keymaster middleware derives keys for containers and objects based on their paths and the encryption_root_secret.\n\nI know it\u0027s mentioned earlier, but just to avoid confusion. IIUC a custom keymaster could implement a completely different way as well.","commit_id":"e37bca1b505c8523ae097229d9615cf3f7168c20"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"e0ba09415bd4ffecb6ec5c358ee16b00c72c607c","unresolved":false,"context_lines":[{"line_number":357,"context_line":""},{"line_number":358,"context_line":"Developers should be aware that encryption middlewares rely on the path of an"},{"line_number":359,"context_line":"object remaining unchanged. The keymaster derives keys for containers and"},{"line_number":360,"context_line":"objects based on their paths. The encrypter also uses the object path to derive"},{"line_number":361,"context_line":"an IV for encrypting the ETag. As explained above, this choice of IV is"},{"line_number":362,"context_line":"made to enable conditional request ETag values to be encrypted in an"},{"line_number":363,"context_line":"identical fashion prior to matching with the object ETag."}],"source_content_type":"text/x-rst","patch_set":3,"id":"7aa08908_4c98371c","line":360,"in_reply_to":"7aa08908_5c1ded71","updated":"2016-06-15 19:01:02.000000000","message":"Done","commit_id":"e37bca1b505c8523ae097229d9615cf3f7168c20"},{"author":{"_account_id":14766,"name":"Kazuhiro MIYAHARA","email":"miyahara.kazuhiro@lab.ntt.co.jp","username":"miyahara"},"change_message_id":"18a3f282e504cb84d09e94343bc13954d09fe5ab","unresolved":false,"context_lines":[{"line_number":79,"context_line":""},{"line_number":80,"context_line":"    openssl rand -base64 32"},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"Once deployed, the encrypter will by default encrypt object data and metadata"},{"line_number":83,"context_line":"when PUT and POST requests are made to the proxy server and the decrypter will"},{"line_number":84,"context_line":"decrypt object data and metadata when handling GET and HEAD requests."},{"line_number":85,"context_line":""},{"line_number":86,"context_line":"Objects that existed in the cluster prior to the encryption middlewares being"},{"line_number":87,"context_line":"deployed are still readable with GET and HEAD requests. The content of those"}],"source_content_type":"text/x-rst","patch_set":5,"id":"7aa08908_a1a4f607","line":84,"range":{"start_line":82,"start_character":0,"end_line":84,"end_character":69},"updated":"2016-06-17 02:28:10.000000000","message":"IMO, behavior of the encrypter and the decrypter when handling COPY requests had better be explained in this place, because some users may not know that a COPY request consists of a GET request and a PUT request.","commit_id":"375f71ae7a912f577131cb7fe0a868752f0dfec7"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"5a9372fbd32ab173935a05007a23bdb1a0a9c364","unresolved":false,"context_lines":[{"line_number":79,"context_line":""},{"line_number":80,"context_line":"    openssl rand -base64 32"},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"Once deployed, the encrypter will by default encrypt object data and metadata"},{"line_number":83,"context_line":"when PUT and POST requests are made to the proxy server and the decrypter will"},{"line_number":84,"context_line":"decrypt object data and metadata when handling GET and HEAD requests."},{"line_number":85,"context_line":""},{"line_number":86,"context_line":"Objects that existed in the cluster prior to the encryption middlewares being"},{"line_number":87,"context_line":"deployed are still readable with GET and HEAD requests. The content of those"}],"source_content_type":"text/x-rst","patch_set":5,"id":"7aa08908_44827253","line":84,"range":{"start_line":82,"start_character":0,"end_line":84,"end_character":69},"in_reply_to":"7aa08908_a1a4f607","updated":"2016-06-17 13:10:55.000000000","message":"Done, good suggestion.","commit_id":"375f71ae7a912f577131cb7fe0a868752f0dfec7"},{"author":{"_account_id":9625,"name":"Thiago da Silva","email":"thiagodasilva@gmail.com","username":"thiago"},"change_message_id":"5e390891a9b013c75f1fc3dc6595939afe92edb2","unresolved":false,"context_lines":[{"line_number":98,"context_line":"objects will remain encrypted but new data written with PUT, POST or COPY"},{"line_number":99,"context_line":"requests will not be encrypted. The encryption middlewares should remain in the"},{"line_number":100,"context_line":"pipeline even when encryption of new objects is not required. The encrypter"},{"line_number":101,"context_line":"middleware is needed to handle conditional GET requests that may be for"},{"line_number":102,"context_line":"previously encrypted objects. The decrypter middleware is needed to handle all"},{"line_number":103,"context_line":"GET requests that are for encrypted objects. The keymaster is needed to provide"},{"line_number":104,"context_line":"keys for those requests."}],"source_content_type":"text/x-rst","patch_set":5,"id":"7aa08908_bf3d3fdf","line":101,"updated":"2016-06-16 20:35:56.000000000","message":"remove \"that may be\" ???","commit_id":"375f71ae7a912f577131cb7fe0a868752f0dfec7"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"5a9372fbd32ab173935a05007a23bdb1a0a9c364","unresolved":false,"context_lines":[{"line_number":98,"context_line":"objects will remain encrypted but new data written with PUT, POST or COPY"},{"line_number":99,"context_line":"requests will not be encrypted. The encryption middlewares should remain in the"},{"line_number":100,"context_line":"pipeline even when encryption of new objects is not required. The encrypter"},{"line_number":101,"context_line":"middleware is needed to handle conditional GET requests that may be for"},{"line_number":102,"context_line":"previously encrypted objects. The decrypter middleware is needed to handle all"},{"line_number":103,"context_line":"GET requests that are for encrypted objects. The keymaster is needed to provide"},{"line_number":104,"context_line":"keys for those requests."}],"source_content_type":"text/x-rst","patch_set":5,"id":"7aa08908_24ee4622","line":101,"in_reply_to":"7aa08908_a156b603","updated":"2016-06-17 13:10:55.000000000","message":"+1 Janie\u0027s answer but I can see that the sentence could be improved. The request is always for an object; the object may have been previously encrypted.","commit_id":"375f71ae7a912f577131cb7fe0a868752f0dfec7"},{"author":{"_account_id":12279,"name":"Janie Richling","email":"jrichli@us.ibm.com","username":"jrichli"},"change_message_id":"543d289e896a8f99b49d4f540a6f135fff75e535","unresolved":false,"context_lines":[{"line_number":98,"context_line":"objects will remain encrypted but new data written with PUT, POST or COPY"},{"line_number":99,"context_line":"requests will not be encrypted. The encryption middlewares should remain in the"},{"line_number":100,"context_line":"pipeline even when encryption of new objects is not required. The encrypter"},{"line_number":101,"context_line":"middleware is needed to handle conditional GET requests that may be for"},{"line_number":102,"context_line":"previously encrypted objects. The decrypter middleware is needed to handle all"},{"line_number":103,"context_line":"GET requests that are for encrypted objects. The keymaster is needed to provide"},{"line_number":104,"context_line":"keys for those requests."}],"source_content_type":"text/x-rst","patch_set":5,"id":"7aa08908_a156b603","line":101,"in_reply_to":"7aa08908_bf3d3fdf","updated":"2016-06-17 02:09:29.000000000","message":"I think it is expressed that way because the conditional GET might be for an unencrypted object as well.","commit_id":"375f71ae7a912f577131cb7fe0a868752f0dfec7"},{"author":{"_account_id":14766,"name":"Kazuhiro MIYAHARA","email":"miyahara.kazuhiro@lab.ntt.co.jp","username":"miyahara"},"change_message_id":"18a3f282e504cb84d09e94343bc13954d09fe5ab","unresolved":false,"context_lines":[{"line_number":133,"context_line":"#. Upgrade all object servers"},{"line_number":134,"context_line":"#. Upgrade all proxy servers"},{"line_number":135,"context_line":"#. Add all encryption middlewares to every proxy server\u0027s middleware pipeline"},{"line_number":136,"context_line":"   with the encrypter ``disable_encryption`` option set to ``False`` and the"},{"line_number":137,"context_line":"   keymaster ``encryption_root_secret`` value set as described above."},{"line_number":138,"context_line":"#. Finally, change the encrypter ``disable_encryption`` option to ``True``"},{"line_number":139,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"7aa08908_61dcce18","line":136,"range":{"start_line":136,"start_character":59,"end_line":136,"end_character":68},"updated":"2016-06-17 02:28:10.000000000","message":"It seems that ``disable_encryption`` boolean values are incorrect. IMO, ``True`` is correct in this sentence.","commit_id":"375f71ae7a912f577131cb7fe0a868752f0dfec7"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"5a9372fbd32ab173935a05007a23bdb1a0a9c364","unresolved":false,"context_lines":[{"line_number":133,"context_line":"#. Upgrade all object servers"},{"line_number":134,"context_line":"#. Upgrade all proxy servers"},{"line_number":135,"context_line":"#. Add all encryption middlewares to every proxy server\u0027s middleware pipeline"},{"line_number":136,"context_line":"   with the encrypter ``disable_encryption`` option set to ``False`` and the"},{"line_number":137,"context_line":"   keymaster ``encryption_root_secret`` value set as described above."},{"line_number":138,"context_line":"#. Finally, change the encrypter ``disable_encryption`` option to ``True``"},{"line_number":139,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"7aa08908_e4655eaf","line":136,"range":{"start_line":136,"start_character":59,"end_line":136,"end_character":68},"in_reply_to":"7aa08908_61dcce18","updated":"2016-06-17 13:10:55.000000000","message":"Done","commit_id":"375f71ae7a912f577131cb7fe0a868752f0dfec7"},{"author":{"_account_id":14766,"name":"Kazuhiro MIYAHARA","email":"miyahara.kazuhiro@lab.ntt.co.jp","username":"miyahara"},"change_message_id":"18a3f282e504cb84d09e94343bc13954d09fe5ab","unresolved":false,"context_lines":[{"line_number":135,"context_line":"#. Add all encryption middlewares to every proxy server\u0027s middleware pipeline"},{"line_number":136,"context_line":"   with the encrypter ``disable_encryption`` option set to ``False`` and the"},{"line_number":137,"context_line":"   keymaster ``encryption_root_secret`` value set as described above."},{"line_number":138,"context_line":"#. Finally, change the encrypter ``disable_encryption`` option to ``True``"},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"--------------"},{"line_number":141,"context_line":"Implementation"}],"source_content_type":"text/x-rst","patch_set":5,"id":"7aa08908_e1f71e8a","line":138,"range":{"start_line":138,"start_character":66,"end_line":138,"end_character":72},"updated":"2016-06-17 02:28:10.000000000","message":"IMO, ``False`` is correct in this sentence.","commit_id":"375f71ae7a912f577131cb7fe0a868752f0dfec7"},{"author":{"_account_id":9625,"name":"Thiago da Silva","email":"thiagodasilva@gmail.com","username":"thiago"},"change_message_id":"5e390891a9b013c75f1fc3dc6595939afe92edb2","unresolved":false,"context_lines":[{"line_number":135,"context_line":"#. Add all encryption middlewares to every proxy server\u0027s middleware pipeline"},{"line_number":136,"context_line":"   with the encrypter ``disable_encryption`` option set to ``False`` and the"},{"line_number":137,"context_line":"   keymaster ``encryption_root_secret`` value set as described above."},{"line_number":138,"context_line":"#. Finally, change the encrypter ``disable_encryption`` option to ``True``"},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"--------------"},{"line_number":141,"context_line":"Implementation"}],"source_content_type":"text/x-rst","patch_set":5,"id":"7aa08908_91595738","line":138,"updated":"2016-06-16 20:35:56.000000000","message":"this last step seems contradictory, why disable if the intent was to deploy encryption?","commit_id":"375f71ae7a912f577131cb7fe0a868752f0dfec7"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"5a9372fbd32ab173935a05007a23bdb1a0a9c364","unresolved":false,"context_lines":[{"line_number":135,"context_line":"#. Add all encryption middlewares to every proxy server\u0027s middleware pipeline"},{"line_number":136,"context_line":"   with the encrypter ``disable_encryption`` option set to ``False`` and the"},{"line_number":137,"context_line":"   keymaster ``encryption_root_secret`` value set as described above."},{"line_number":138,"context_line":"#. Finally, change the encrypter ``disable_encryption`` option to ``True``"},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"--------------"},{"line_number":141,"context_line":"Implementation"}],"source_content_type":"text/x-rst","patch_set":5,"id":"7aa08908_64104e01","line":138,"in_reply_to":"7aa08908_91595738","updated":"2016-06-17 13:10:55.000000000","message":"Done","commit_id":"375f71ae7a912f577131cb7fe0a868752f0dfec7"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"5a9372fbd32ab173935a05007a23bdb1a0a9c364","unresolved":false,"context_lines":[{"line_number":135,"context_line":"#. Add all encryption middlewares to every proxy server\u0027s middleware pipeline"},{"line_number":136,"context_line":"   with the encrypter ``disable_encryption`` option set to ``False`` and the"},{"line_number":137,"context_line":"   keymaster ``encryption_root_secret`` value set as described above."},{"line_number":138,"context_line":"#. Finally, change the encrypter ``disable_encryption`` option to ``True``"},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"--------------"},{"line_number":141,"context_line":"Implementation"}],"source_content_type":"text/x-rst","patch_set":5,"id":"7aa08908_6427ae63","line":138,"range":{"start_line":138,"start_character":66,"end_line":138,"end_character":72},"in_reply_to":"7aa08908_e1f71e8a","updated":"2016-06-17 13:10:55.000000000","message":"Sorry! I have mistakenly inverted the logic.","commit_id":"375f71ae7a912f577131cb7fe0a868752f0dfec7"},{"author":{"_account_id":11330,"name":"Christian Cachin","email":"cca@zurich.ibm.com","username":"cca88"},"change_message_id":"4db2a15c3ba1de1404c8e9a8ef7bc0f19a8d6534","unresolved":false,"context_lines":[{"line_number":157,"context_line":"  ciphertext \u003d E(plaintext, k, iv)"},{"line_number":158,"context_line":""},{"line_number":159,"context_line":"where ``E`` is the encryption function, ``k`` is an encryption key and ``iv``"},{"line_number":160,"context_line":"is a unique initialization vector (IV) chosen for each encryption operation."},{"line_number":161,"context_line":"The IV is stored as metadata of the encrypted item so that it is available for"},{"line_number":162,"context_line":"decryption::"},{"line_number":163,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"7aa08908_c7aafd19","line":160,"range":{"start_line":160,"start_character":39,"end_line":160,"end_character":75},"updated":"2016-06-16 21:35:00.000000000","message":"\"encryption operation\" may not be accurate, can we say: \"encryption context\"  and add:\n\"For example, the object body is one encryption context with a randomly chosen IV.\"","commit_id":"375f71ae7a912f577131cb7fe0a868752f0dfec7"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"5a9372fbd32ab173935a05007a23bdb1a0a9c364","unresolved":false,"context_lines":[{"line_number":157,"context_line":"  ciphertext \u003d E(plaintext, k, iv)"},{"line_number":158,"context_line":""},{"line_number":159,"context_line":"where ``E`` is the encryption function, ``k`` is an encryption key and ``iv``"},{"line_number":160,"context_line":"is a unique initialization vector (IV) chosen for each encryption operation."},{"line_number":161,"context_line":"The IV is stored as metadata of the encrypted item so that it is available for"},{"line_number":162,"context_line":"decryption::"},{"line_number":163,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"7aa08908_0446aabf","line":160,"range":{"start_line":160,"start_character":39,"end_line":160,"end_character":75},"in_reply_to":"7aa08908_c7aafd19","updated":"2016-06-17 13:10:55.000000000","message":"Done","commit_id":"375f71ae7a912f577131cb7fe0a868752f0dfec7"},{"author":{"_account_id":11330,"name":"Christian Cachin","email":"cca@zurich.ibm.com","username":"cca88"},"change_message_id":"4db2a15c3ba1de1404c8e9a8ef7bc0f19a8d6534","unresolved":false,"context_lines":[{"line_number":164,"context_line":"  plaintext \u003d D(ciphertext, k, iv)"},{"line_number":165,"context_line":""},{"line_number":166,"context_line":"where ``D`` is the decryption function."},{"line_number":167,"context_line":""},{"line_number":168,"context_line":"In general any encrypted item has accompanying crypto-metadata that describes"},{"line_number":169,"context_line":"the IV and the cipher algorithm used for the encryption::"},{"line_number":170,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"7aa08908_6a879012","line":167,"updated":"2016-06-16 21:35:00.000000000","message":"Do we want to be more explicit? Then let\u0027s add:\n\nThe implementation of CTR mode follows NIST SP800-38A, and the full IV passed to the encryption or decryption function serves as the initial counter block.","commit_id":"375f71ae7a912f577131cb7fe0a868752f0dfec7"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"5a9372fbd32ab173935a05007a23bdb1a0a9c364","unresolved":false,"context_lines":[{"line_number":164,"context_line":"  plaintext \u003d D(ciphertext, k, iv)"},{"line_number":165,"context_line":""},{"line_number":166,"context_line":"where ``D`` is the decryption function."},{"line_number":167,"context_line":""},{"line_number":168,"context_line":"In general any encrypted item has accompanying crypto-metadata that describes"},{"line_number":169,"context_line":"the IV and the cipher algorithm used for the encryption::"},{"line_number":170,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"7aa08908_870e1c3b","line":167,"in_reply_to":"7aa08908_6a879012","updated":"2016-06-17 13:10:55.000000000","message":"Done, linked to http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf","commit_id":"375f71ae7a912f577131cb7fe0a868752f0dfec7"},{"author":{"_account_id":14766,"name":"Kazuhiro MIYAHARA","email":"miyahara.kazuhiro@lab.ntt.co.jp","username":"miyahara"},"change_message_id":"7e192d4101d02c62e132d63e74101dbbf6344fb9","unresolved":false,"context_lines":[{"line_number":175,"context_line":"--------------"},{"line_number":176,"context_line":""},{"line_number":177,"context_line":"A keymaster middleware is responsible for providing the keys required for each"},{"line_number":178,"context_line":"encryption and decryption operation. The keymaster middleware should provide"},{"line_number":179,"context_line":"different keys for each object and container. These are made available to the"},{"line_number":180,"context_line":"encrypter and decrypter via a callback function that the keymaster installs in"},{"line_number":181,"context_line":"the WSGI request environ."},{"line_number":182,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"7aa08908_8ca49108","line":179,"range":{"start_line":178,"start_character":37,"end_line":179,"end_character":45},"updated":"2016-06-17 02:51:46.000000000","message":"Which does it mean that \"each container and each object has different key\" or \"each object key depends on the object name and the container name\"?","commit_id":"375f71ae7a912f577131cb7fe0a868752f0dfec7"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"5a9372fbd32ab173935a05007a23bdb1a0a9c364","unresolved":false,"context_lines":[{"line_number":175,"context_line":"--------------"},{"line_number":176,"context_line":""},{"line_number":177,"context_line":"A keymaster middleware is responsible for providing the keys required for each"},{"line_number":178,"context_line":"encryption and decryption operation. The keymaster middleware should provide"},{"line_number":179,"context_line":"different keys for each object and container. These are made available to the"},{"line_number":180,"context_line":"encrypter and decrypter via a callback function that the keymaster installs in"},{"line_number":181,"context_line":"the WSGI request environ."},{"line_number":182,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"7aa08908_d26d8433","line":179,"range":{"start_line":178,"start_character":37,"end_line":179,"end_character":45},"in_reply_to":"7aa08908_334cd575","updated":"2016-06-17 13:10:55.000000000","message":"Done","commit_id":"375f71ae7a912f577131cb7fe0a868752f0dfec7"},{"author":{"_account_id":14766,"name":"Kazuhiro MIYAHARA","email":"miyahara.kazuhiro@lab.ntt.co.jp","username":"miyahara"},"change_message_id":"a731334dd72d40319284b54d593baad9a24ba5c3","unresolved":false,"context_lines":[{"line_number":175,"context_line":"--------------"},{"line_number":176,"context_line":""},{"line_number":177,"context_line":"A keymaster middleware is responsible for providing the keys required for each"},{"line_number":178,"context_line":"encryption and decryption operation. The keymaster middleware should provide"},{"line_number":179,"context_line":"different keys for each object and container. These are made available to the"},{"line_number":180,"context_line":"encrypter and decrypter via a callback function that the keymaster installs in"},{"line_number":181,"context_line":"the WSGI request environ."},{"line_number":182,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"7aa08908_334cd575","line":179,"range":{"start_line":178,"start_character":37,"end_line":179,"end_character":45},"in_reply_to":"7aa08908_470442c5","updated":"2016-06-17 08:45:07.000000000","message":"Janie, thank you for your answer. Because I didn\u0027t know that there are two types of key (i.e., object key and container key), I\u0027m confused by the sentence \"for each object and container\". IMO, the fact that there are two key types should be explained before the sentence.","commit_id":"375f71ae7a912f577131cb7fe0a868752f0dfec7"},{"author":{"_account_id":12279,"name":"Janie Richling","email":"jrichli@us.ibm.com","username":"jrichli"},"change_message_id":"e2b6d1a0dc4c4e454424bf301b6737bd326737a2","unresolved":false,"context_lines":[{"line_number":175,"context_line":"--------------"},{"line_number":176,"context_line":""},{"line_number":177,"context_line":"A keymaster middleware is responsible for providing the keys required for each"},{"line_number":178,"context_line":"encryption and decryption operation. The keymaster middleware should provide"},{"line_number":179,"context_line":"different keys for each object and container. These are made available to the"},{"line_number":180,"context_line":"encrypter and decrypter via a callback function that the keymaster installs in"},{"line_number":181,"context_line":"the WSGI request environ."},{"line_number":182,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"7aa08908_470442c5","line":179,"range":{"start_line":178,"start_character":37,"end_line":179,"end_character":45},"in_reply_to":"7aa08908_8ca49108","updated":"2016-06-17 03:34:40.000000000","message":"It is suggested that for any keymaster implmentation, every object has a different key, and that every container has a different key.  It doesn\u0027t make a difference cryptographically if that is based upon the path.  However, the keymaster that we are proposing in particular has the keys derived from the item\u0027s path.","commit_id":"375f71ae7a912f577131cb7fe0a868752f0dfec7"},{"author":{"_account_id":14766,"name":"Kazuhiro MIYAHARA","email":"miyahara.kazuhiro@lab.ntt.co.jp","username":"miyahara"},"change_message_id":"a731334dd72d40319284b54d593baad9a24ba5c3","unresolved":false,"context_lines":[{"line_number":251,"context_line":"The body_key is wrapped using the object key provided by the keymaster and a"},{"line_number":252,"context_line":"randomly chosen IV::"},{"line_number":253,"context_line":""},{"line_number":254,"context_line":"  wrapped_body_key \u003d E(body_key, object_key, body_key_iv)"},{"line_number":255,"context_line":""},{"line_number":256,"context_line":"The encrypter stores the associated crypto-metadata in a system metadata"},{"line_number":257,"context_line":"header::"}],"source_content_type":"text/x-rst","patch_set":5,"id":"7aa08908_641fb15b","line":254,"range":{"start_line":254,"start_character":45,"end_line":254,"end_character":56},"updated":"2016-06-17 08:45:07.000000000","message":"typo of body_iv?","commit_id":"375f71ae7a912f577131cb7fe0a868752f0dfec7"},{"author":{"_account_id":14766,"name":"Kazuhiro MIYAHARA","email":"miyahara.kazuhiro@lab.ntt.co.jp","username":"miyahara"},"change_message_id":"89a38dce9ba2e02ed76b75924f3c76753cebaa9d","unresolved":false,"context_lines":[{"line_number":251,"context_line":"The body_key is wrapped using the object key provided by the keymaster and a"},{"line_number":252,"context_line":"randomly chosen IV::"},{"line_number":253,"context_line":""},{"line_number":254,"context_line":"  wrapped_body_key \u003d E(body_key, object_key, body_key_iv)"},{"line_number":255,"context_line":""},{"line_number":256,"context_line":"The encrypter stores the associated crypto-metadata in a system metadata"},{"line_number":257,"context_line":"header::"}],"source_content_type":"text/x-rst","patch_set":5,"id":"7aa08908_a4e6b913","line":254,"range":{"start_line":254,"start_character":45,"end_line":254,"end_character":56},"in_reply_to":"7aa08908_641fb15b","updated":"2016-06-17 08:51:25.000000000","message":"I\u0027m sorry for my misunderstanding.\n\u0027body_key_iv\u0027 is different IV from \u0027body_key\u0027.","commit_id":"375f71ae7a912f577131cb7fe0a868752f0dfec7"},{"author":{"_account_id":14766,"name":"Kazuhiro MIYAHARA","email":"miyahara.kazuhiro@lab.ntt.co.jp","username":"miyahara"},"change_message_id":"a731334dd72d40319284b54d593baad9a24ba5c3","unresolved":false,"context_lines":[{"line_number":260,"context_line":"      {\"iv\": body_iv,"},{"line_number":261,"context_line":"       \"cipher\": \"AES_CTR_256\","},{"line_number":262,"context_line":"       \"body_key\": {\"key\": wrapped_body_key,"},{"line_number":263,"context_line":"                    \"iv\": body_key_iv}}"},{"line_number":264,"context_line":""},{"line_number":265,"context_line":"Note that in this case there is an extra item of crypto-metadata which stores"},{"line_number":266,"context_line":"the wrapped body key and its IV."}],"source_content_type":"text/x-rst","patch_set":5,"id":"7aa08908_a43999da","line":263,"range":{"start_line":263,"start_character":26,"end_line":263,"end_character":37},"updated":"2016-06-17 08:45:07.000000000","message":"typo of body_iv?","commit_id":"375f71ae7a912f577131cb7fe0a868752f0dfec7"},{"author":{"_account_id":14766,"name":"Kazuhiro MIYAHARA","email":"miyahara.kazuhiro@lab.ntt.co.jp","username":"miyahara"},"change_message_id":"89a38dce9ba2e02ed76b75924f3c76753cebaa9d","unresolved":false,"context_lines":[{"line_number":260,"context_line":"      {\"iv\": body_iv,"},{"line_number":261,"context_line":"       \"cipher\": \"AES_CTR_256\","},{"line_number":262,"context_line":"       \"body_key\": {\"key\": wrapped_body_key,"},{"line_number":263,"context_line":"                    \"iv\": body_key_iv}}"},{"line_number":264,"context_line":""},{"line_number":265,"context_line":"Note that in this case there is an extra item of crypto-metadata which stores"},{"line_number":266,"context_line":"the wrapped body key and its IV."}],"source_content_type":"text/x-rst","patch_set":5,"id":"7aa08908_44b6f5f9","line":263,"range":{"start_line":263,"start_character":26,"end_line":263,"end_character":37},"in_reply_to":"7aa08908_a43999da","updated":"2016-06-17 08:51:25.000000000","message":"This is the same as above.","commit_id":"375f71ae7a912f577131cb7fe0a868752f0dfec7"},{"author":{"_account_id":11330,"name":"Christian Cachin","email":"cca@zurich.ibm.com","username":"cca88"},"change_message_id":"f696719320a67f011418ac4f932ae079a9e806f2","unresolved":false,"context_lines":[{"line_number":30,"context_line":""},{"line_number":31,"context_line":".. note::"},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"    This feature is intended to provide `privacy` of data that is at rest i.e."},{"line_number":34,"context_line":"    to protect user data from being read by an attacker that gains access to"},{"line_number":35,"context_line":"    disks."},{"line_number":36,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"7aa08908_3dec82ba","line":33,"range":{"start_line":33,"start_character":40,"end_line":33,"end_character":48},"updated":"2016-06-17 19:13:31.000000000","message":"\u003d\u003e confidentiality\nis the standard term in here.","commit_id":"2da245e018b688f8b191ed47d3321a43cfbfeb51"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"26fcd9ceddfa92e9b91cff0be77c0e7220f0305a","unresolved":false,"context_lines":[{"line_number":30,"context_line":""},{"line_number":31,"context_line":".. note::"},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"    This feature is intended to provide `privacy` of data that is at rest i.e."},{"line_number":34,"context_line":"    to protect user data from being read by an attacker that gains access to"},{"line_number":35,"context_line":"    disks."},{"line_number":36,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"3aaa91ec_b3f2f76d","line":33,"range":{"start_line":33,"start_character":40,"end_line":33,"end_character":48},"in_reply_to":"7aa08908_3dec82ba","updated":"2016-06-21 18:49:28.000000000","message":"Done","commit_id":"2da245e018b688f8b191ed47d3321a43cfbfeb51"},{"author":{"_account_id":11330,"name":"Christian Cachin","email":"cca@zurich.ibm.com","username":"cca88"},"change_message_id":"f696719320a67f011418ac4f932ae079a9e806f2","unresolved":false,"context_lines":[{"line_number":32,"context_line":""},{"line_number":33,"context_line":"    This feature is intended to provide `privacy` of data that is at rest i.e."},{"line_number":34,"context_line":"    to protect user data from being read by an attacker that gains access to"},{"line_number":35,"context_line":"    disks."},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"    This feature is not intended to prevent undetectable `modification`"},{"line_number":38,"context_line":"    of user data at rest on disk."}],"source_content_type":"text/x-rst","patch_set":6,"id":"7aa08908_7d656a43","line":35,"range":{"start_line":35,"start_character":9,"end_line":35,"end_character":10},"updated":"2016-06-17 19:13:31.000000000","message":"... where object data is stored.","commit_id":"2da245e018b688f8b191ed47d3321a43cfbfeb51"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"26fcd9ceddfa92e9b91cff0be77c0e7220f0305a","unresolved":false,"context_lines":[{"line_number":32,"context_line":""},{"line_number":33,"context_line":"    This feature is intended to provide `privacy` of data that is at rest i.e."},{"line_number":34,"context_line":"    to protect user data from being read by an attacker that gains access to"},{"line_number":35,"context_line":"    disks."},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"    This feature is not intended to prevent undetectable `modification`"},{"line_number":38,"context_line":"    of user data at rest on disk."}],"source_content_type":"text/x-rst","patch_set":6,"id":"3aaa91ec_338607ba","line":35,"range":{"start_line":35,"start_character":9,"end_line":35,"end_character":10},"in_reply_to":"7aa08908_7d656a43","updated":"2016-06-21 18:49:28.000000000","message":"Done","commit_id":"2da245e018b688f8b191ed47d3321a43cfbfeb51"},{"author":{"_account_id":11330,"name":"Christian Cachin","email":"cca@zurich.ibm.com","username":"cca88"},"change_message_id":"f696719320a67f011418ac4f932ae079a9e806f2","unresolved":false,"context_lines":[{"line_number":40,"context_line":"    This feature is not intended to protect against an attacker that gains"},{"line_number":41,"context_line":"    access to Swift\u0027s internal network connections, or gains access to key"},{"line_number":42,"context_line":"    material or is able to modify the Swift code running on Swift nodes."},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"------------------------"},{"line_number":45,"context_line":"Deployment and operation"},{"line_number":46,"context_line":"------------------------"}],"source_content_type":"text/x-rst","patch_set":6,"id":"7aa08908_d8058c10","line":43,"updated":"2016-06-17 19:13:31.000000000","message":"It\u0027s good to add thes paragraphs for the context.\n\nA subtle point: The design also protects against an attacker that reads the memory of object servers or the traffic to/from them. But there it stops, as an attacker that controls the object server is not covered. Using of CTR mode fails badly in this case (worse than with other modes).\n\nIs this too refined for that context here? If not I could extend that text.","commit_id":"2da245e018b688f8b191ed47d3321a43cfbfeb51"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"26fcd9ceddfa92e9b91cff0be77c0e7220f0305a","unresolved":false,"context_lines":[{"line_number":40,"context_line":"    This feature is not intended to protect against an attacker that gains"},{"line_number":41,"context_line":"    access to Swift\u0027s internal network connections, or gains access to key"},{"line_number":42,"context_line":"    material or is able to modify the Swift code running on Swift nodes."},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"------------------------"},{"line_number":45,"context_line":"Deployment and operation"},{"line_number":46,"context_line":"------------------------"}],"source_content_type":"text/x-rst","patch_set":6,"id":"3aaa91ec_964b6959","line":43,"in_reply_to":"7aa08908_d8058c10","updated":"2016-06-21 18:49:28.000000000","message":"Agree. We have mentioned in presenting the work that a side-effect of encrypting at the proxy is that encrypted data is sent across the backend network. However we have not promoted this as a benefit because it is not a design goal.\n\nIf you feel some text should be included I am open to that, but otherwise I would choose to leave it as an undocumented extra benefit.","commit_id":"2da245e018b688f8b191ed47d3321a43cfbfeb51"},{"author":{"_account_id":14766,"name":"Kazuhiro MIYAHARA","email":"miyahara.kazuhiro@lab.ntt.co.jp","username":"miyahara"},"change_message_id":"305ae9851d7841d18fcb1f32839e737cfd63aca3","unresolved":false,"context_lines":[{"line_number":148,"context_line":""},{"line_number":149,"context_line":"#. Upgrade all object servers"},{"line_number":150,"context_line":"#. Upgrade all proxy servers"},{"line_number":151,"context_line":"#. Add all encryption middlewares to every proxy server\u0027s middleware pipeline"},{"line_number":152,"context_line":"   with the encrypter ``disable_encryption`` option set to ``False`` and the"},{"line_number":153,"context_line":"   keymaster ``encryption_root_secret`` value set as described above."},{"line_number":154,"context_line":"#. Finally, change the encrypter ``disable_encryption`` option to ``True``"},{"line_number":155,"context_line":""},{"line_number":156,"context_line":"--------------"},{"line_number":157,"context_line":"Implementation"}],"source_content_type":"text/x-rst","patch_set":6,"id":"5a9d85d2_8a469abd","line":154,"range":{"start_line":151,"start_character":2,"end_line":154,"end_character":74},"updated":"2016-06-20 02:54:47.000000000","message":"The ``disable_encryption`` incorrect boolean values remain.","commit_id":"2da245e018b688f8b191ed47d3321a43cfbfeb51"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"26fcd9ceddfa92e9b91cff0be77c0e7220f0305a","unresolved":false,"context_lines":[{"line_number":148,"context_line":""},{"line_number":149,"context_line":"#. Upgrade all object servers"},{"line_number":150,"context_line":"#. Upgrade all proxy servers"},{"line_number":151,"context_line":"#. Add all encryption middlewares to every proxy server\u0027s middleware pipeline"},{"line_number":152,"context_line":"   with the encrypter ``disable_encryption`` option set to ``False`` and the"},{"line_number":153,"context_line":"   keymaster ``encryption_root_secret`` value set as described above."},{"line_number":154,"context_line":"#. Finally, change the encrypter ``disable_encryption`` option to ``True``"},{"line_number":155,"context_line":""},{"line_number":156,"context_line":"--------------"},{"line_number":157,"context_line":"Implementation"}],"source_content_type":"text/x-rst","patch_set":6,"id":"3aaa91ec_d69a11c5","line":154,"range":{"start_line":151,"start_character":2,"end_line":154,"end_character":74},"in_reply_to":"5a9d85d2_8a469abd","updated":"2016-06-21 18:49:28.000000000","message":"Sorry. Must have missed the change.\n\nThanks for double-checking!","commit_id":"2da245e018b688f8b191ed47d3321a43cfbfeb51"},{"author":{"_account_id":14766,"name":"Kazuhiro MIYAHARA","email":"miyahara.kazuhiro@lab.ntt.co.jp","username":"miyahara"},"change_message_id":"305ae9851d7841d18fcb1f32839e737cfd63aca3","unresolved":false,"context_lines":[{"line_number":269,"context_line":"Encryption of an object body is performed using a randomly chosen body key"},{"line_number":270,"context_line":"and a randomly chosen IV::"},{"line_number":271,"context_line":""},{"line_number":272,"context_line":"  body_ciphertext \u003d E(body_plaintext, body_key, body_iv)"},{"line_number":273,"context_line":""},{"line_number":274,"context_line":"The body_key is wrapped using the object key provided by the keymaster and a"},{"line_number":275,"context_line":"randomly chosen IV::"}],"source_content_type":"text/x-rst","patch_set":6,"id":"5a9d85d2_453785e3","line":272,"range":{"start_line":272,"start_character":1,"end_line":272,"end_character":56},"updated":"2016-06-20 02:54:47.000000000","message":"Why encrypter encrypt object body by wrapping body_key?\nAre there any bad case if body_ciphertext is E(body_plaintext, object_key, body_iv) ?","commit_id":"2da245e018b688f8b191ed47d3321a43cfbfeb51"},{"author":{"_account_id":11330,"name":"Christian Cachin","email":"cca@zurich.ibm.com","username":"cca88"},"change_message_id":"de63a412420506acb97ffff38bb798bfe7c46bf4","unresolved":false,"context_lines":[{"line_number":269,"context_line":"Encryption of an object body is performed using a randomly chosen body key"},{"line_number":270,"context_line":"and a randomly chosen IV::"},{"line_number":271,"context_line":""},{"line_number":272,"context_line":"  body_ciphertext \u003d E(body_plaintext, body_key, body_iv)"},{"line_number":273,"context_line":""},{"line_number":274,"context_line":"The body_key is wrapped using the object key provided by the keymaster and a"},{"line_number":275,"context_line":"randomly chosen IV::"}],"source_content_type":"text/x-rst","patch_set":6,"id":"5a9d85d2_9e489b5d","line":272,"range":{"start_line":272,"start_character":1,"end_line":272,"end_character":56},"in_reply_to":"5a9d85d2_453785e3","updated":"2016-06-20 06:48:12.000000000","message":"Not directly, but this serves modularity. The object_key encrypts (wraps) the body_key and the body_key is chosen fresh on every PUT. The object_key is used to encrypt other values (metadata headers). The object key stays constant when multiple PUTs for the same object occur. Choosing a fresh body_key reduces the dependencies of the encryption between the different versions of the same object. Reasoning about their security therefore becomes simpler.","commit_id":"2da245e018b688f8b191ed47d3321a43cfbfeb51"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"26fcd9ceddfa92e9b91cff0be77c0e7220f0305a","unresolved":false,"context_lines":[{"line_number":269,"context_line":"Encryption of an object body is performed using a randomly chosen body key"},{"line_number":270,"context_line":"and a randomly chosen IV::"},{"line_number":271,"context_line":""},{"line_number":272,"context_line":"  body_ciphertext \u003d E(body_plaintext, body_key, body_iv)"},{"line_number":273,"context_line":""},{"line_number":274,"context_line":"The body_key is wrapped using the object key provided by the keymaster and a"},{"line_number":275,"context_line":"randomly chosen IV::"}],"source_content_type":"text/x-rst","patch_set":6,"id":"3aaa91ec_f6874dd5","line":272,"range":{"start_line":272,"start_character":1,"end_line":272,"end_character":56},"in_reply_to":"5a9d85d2_65dc0ee5","updated":"2016-06-21 18:49:28.000000000","message":"Thanks Christian for the explanation. See also the note at line 221. The body_key wrapping has been implemented as a \"future-proofing\" feature as it will enable much more efficient re-keying of object data.","commit_id":"2da245e018b688f8b191ed47d3321a43cfbfeb51"},{"author":{"_account_id":14766,"name":"Kazuhiro MIYAHARA","email":"miyahara.kazuhiro@lab.ntt.co.jp","username":"miyahara"},"change_message_id":"badf984bf33bf976e411e42a6e978a42ccb0919f","unresolved":false,"context_lines":[{"line_number":269,"context_line":"Encryption of an object body is performed using a randomly chosen body key"},{"line_number":270,"context_line":"and a randomly chosen IV::"},{"line_number":271,"context_line":""},{"line_number":272,"context_line":"  body_ciphertext \u003d E(body_plaintext, body_key, body_iv)"},{"line_number":273,"context_line":""},{"line_number":274,"context_line":"The body_key is wrapped using the object key provided by the keymaster and a"},{"line_number":275,"context_line":"randomly chosen IV::"}],"source_content_type":"text/x-rst","patch_set":6,"id":"5a9d85d2_b5f132d0","line":272,"range":{"start_line":272,"start_character":1,"end_line":272,"end_character":56},"in_reply_to":"5a9d85d2_9e489b5d","updated":"2016-06-20 09:49:18.000000000","message":"Christian, thank you for your answer. But it doesn\u0027t make sense to me.\nI don\u0027t think that \"the wrapping key method\" reduces the dependencies of the encryption between the different versions of the same object, because decryption requirements for an unauthorized party in \"the key wrapping method\" is equivalent to \"the NOT wrapping key method\".\nIn my understanding, decryption requirements for an unauthorized party in each method are gaining the following two things.\n  1. Physical access to the disk\n  2. Object key\nIn \"the wrapping key method\", because an object on disk has body_key_iv and wrapped_body_key in its NOT ENCRYPTED metadata, an unauthorized party with the object_key and physical access can decrypt the body_key. Then, the party can decrypt the body.\nIn \"the NOT wrapping key method\", an unauthorized party with the object_key and physical access can decrypt the body directly.\nTherefore, I think the security of \"the wrapping key method\" is the same as \"the NOT wrapping key method\".\n\nNOTE:\n  \"the wrapping key method\" means as follows:\n    body_ciphertext \u003d E(body_plaintext, body_key, body_iv)\n    wrapped_body_key \u003d E(body_key, object_key, body_key_iv)\n\n  \"the NOT wrapping key method\" means as follows:\n    body_ciphertext \u003d E(body_plaintext, object_key, body_iv)","commit_id":"2da245e018b688f8b191ed47d3321a43cfbfeb51"},{"author":{"_account_id":11330,"name":"Christian Cachin","email":"cca@zurich.ibm.com","username":"cca88"},"change_message_id":"ecf1ad6c6756bd7999650dbcce6bb05396bcafb2","unresolved":false,"context_lines":[{"line_number":269,"context_line":"Encryption of an object body is performed using a randomly chosen body key"},{"line_number":270,"context_line":"and a randomly chosen IV::"},{"line_number":271,"context_line":""},{"line_number":272,"context_line":"  body_ciphertext \u003d E(body_plaintext, body_key, body_iv)"},{"line_number":273,"context_line":""},{"line_number":274,"context_line":"The body_key is wrapped using the object key provided by the keymaster and a"},{"line_number":275,"context_line":"randomly chosen IV::"}],"source_content_type":"text/x-rst","patch_set":6,"id":"5a9d85d2_f303cd0b","line":272,"range":{"start_line":272,"start_character":1,"end_line":272,"end_character":56},"in_reply_to":"5a9d85d2_b5f132d0","updated":"2016-06-20 12:04:36.000000000","message":"This is true *if* you consider only the static situation as you describe. But as a future expansion path one would like to have the ability to rotate keys and delete keys, as described in the design specification (https://specs.openstack.org/openstack/swift-specs/specs/in_progress/at_rest_encryption.html). This means that a keymaster would provide a different \u0027object_key\u0027 and would have the ability to trigger a re-key operation on the object. If \u0027body\u0027 is encrypted with \u0027object_key\u0027 this would require to re-encrypt the complete object, this is not feasible. But if \u0027body\u0027 is encrypted with \u0027body_key\u0027 and that itself is wrapped with \u0027object_key\u0027 stored in metadata, then this is possible easily.","commit_id":"2da245e018b688f8b191ed47d3321a43cfbfeb51"},{"author":{"_account_id":14766,"name":"Kazuhiro MIYAHARA","email":"miyahara.kazuhiro@lab.ntt.co.jp","username":"miyahara"},"change_message_id":"a01186575892a4e4978e1d4a393d12243f0216c9","unresolved":false,"context_lines":[{"line_number":269,"context_line":"Encryption of an object body is performed using a randomly chosen body key"},{"line_number":270,"context_line":"and a randomly chosen IV::"},{"line_number":271,"context_line":""},{"line_number":272,"context_line":"  body_ciphertext \u003d E(body_plaintext, body_key, body_iv)"},{"line_number":273,"context_line":""},{"line_number":274,"context_line":"The body_key is wrapped using the object key provided by the keymaster and a"},{"line_number":275,"context_line":"randomly chosen IV::"}],"source_content_type":"text/x-rst","patch_set":6,"id":"5a9d85d2_65dc0ee5","line":272,"range":{"start_line":272,"start_character":1,"end_line":272,"end_character":56},"in_reply_to":"5a9d85d2_f303cd0b","updated":"2016-06-21 01:51:54.000000000","message":"Thank you for your detailed explanation. I get it. That is great idea.","commit_id":"2da245e018b688f8b191ed47d3321a43cfbfeb51"},{"author":{"_account_id":14766,"name":"Kazuhiro MIYAHARA","email":"miyahara.kazuhiro@lab.ntt.co.jp","username":"miyahara"},"change_message_id":"305ae9851d7841d18fcb1f32839e737cfd63aca3","unresolved":false,"context_lines":[{"line_number":297,"context_line":""},{"line_number":298,"context_line":"  X-Object-Sysmeta-Crypto-Etag: E(md5(plaintext), container_key, F(path))"},{"line_number":299,"context_line":""},{"line_number":300,"context_line":"where ``F`` is a function that derives an IV deterministically from the object"},{"line_number":301,"context_line":"path, ``path``."},{"line_number":302,"context_line":""},{"line_number":303,"context_line":"The encrypter stores the associated crypto-metadata in a system metadata"},{"line_number":304,"context_line":"header::"}],"source_content_type":"text/x-rst","patch_set":6,"id":"5a9d85d2_85732d4d","line":301,"range":{"start_line":300,"start_character":0,"end_line":301,"end_character":15},"updated":"2016-06-20 02:54:47.000000000","message":"In my understanding, encryption function ``E`` and decryption function ``D`` is decided by \"cipher\" metadata (e.g. \"AES_CTR_256\").\nBut the algorithm of the IV determination function ``F`` is not explained.\nDoes Swift operators decide ``F``?","commit_id":"2da245e018b688f8b191ed47d3321a43cfbfeb51"},{"author":{"_account_id":14766,"name":"Kazuhiro MIYAHARA","email":"miyahara.kazuhiro@lab.ntt.co.jp","username":"miyahara"},"change_message_id":"badf984bf33bf976e411e42a6e978a42ccb0919f","unresolved":false,"context_lines":[{"line_number":297,"context_line":""},{"line_number":298,"context_line":"  X-Object-Sysmeta-Crypto-Etag: E(md5(plaintext), container_key, F(path))"},{"line_number":299,"context_line":""},{"line_number":300,"context_line":"where ``F`` is a function that derives an IV deterministically from the object"},{"line_number":301,"context_line":"path, ``path``."},{"line_number":302,"context_line":""},{"line_number":303,"context_line":"The encrypter stores the associated crypto-metadata in a system metadata"},{"line_number":304,"context_line":"header::"}],"source_content_type":"text/x-rst","patch_set":6,"id":"5a9d85d2_843faa24","line":301,"range":{"start_line":300,"start_character":0,"end_line":301,"end_character":15},"in_reply_to":"5a9d85d2_5e6593df","updated":"2016-06-20 09:49:18.000000000","message":"Christian, thank you for your answer. I understand.","commit_id":"2da245e018b688f8b191ed47d3321a43cfbfeb51"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"26fcd9ceddfa92e9b91cff0be77c0e7220f0305a","unresolved":false,"context_lines":[{"line_number":297,"context_line":""},{"line_number":298,"context_line":"  X-Object-Sysmeta-Crypto-Etag: E(md5(plaintext), container_key, F(path))"},{"line_number":299,"context_line":""},{"line_number":300,"context_line":"where ``F`` is a function that derives an IV deterministically from the object"},{"line_number":301,"context_line":"path, ``path``."},{"line_number":302,"context_line":""},{"line_number":303,"context_line":"The encrypter stores the associated crypto-metadata in a system metadata"},{"line_number":304,"context_line":"header::"}],"source_content_type":"text/x-rst","patch_set":6,"id":"3aaa91ec_f6710de2","line":301,"range":{"start_line":300,"start_character":0,"end_line":301,"end_character":15},"in_reply_to":"5a9d85d2_843faa24","updated":"2016-06-21 18:49:28.000000000","message":"+1 Christian\u0027s answer. I used the notation \u0027F\u0027 to simplify the overview explanation here in the docs. The code implements the function F in swift/common/middleware/crypto_utils.py._get_derived_iv()","commit_id":"2da245e018b688f8b191ed47d3321a43cfbfeb51"},{"author":{"_account_id":11330,"name":"Christian Cachin","email":"cca@zurich.ibm.com","username":"cca88"},"change_message_id":"de63a412420506acb97ffff38bb798bfe7c46bf4","unresolved":false,"context_lines":[{"line_number":297,"context_line":""},{"line_number":298,"context_line":"  X-Object-Sysmeta-Crypto-Etag: E(md5(plaintext), container_key, F(path))"},{"line_number":299,"context_line":""},{"line_number":300,"context_line":"where ``F`` is a function that derives an IV deterministically from the object"},{"line_number":301,"context_line":"path, ``path``."},{"line_number":302,"context_line":""},{"line_number":303,"context_line":"The encrypter stores the associated crypto-metadata in a system metadata"},{"line_number":304,"context_line":"header::"}],"source_content_type":"text/x-rst","patch_set":6,"id":"5a9d85d2_5e6593df","line":301,"range":{"start_line":300,"start_character":0,"end_line":301,"end_character":15},"in_reply_to":"5a9d85d2_85732d4d","updated":"2016-06-20 06:48:12.000000000","message":"No, F is provided in the code. All that a user has to know is stated here: it derives a unique IV deterministically from the object path, so that two objects with different paths will always have different IVs.","commit_id":"2da245e018b688f8b191ed47d3321a43cfbfeb51"},{"author":{"_account_id":330,"name":"John Dickinson","email":"me@not.mn","username":"notmyname"},"change_message_id":"1f4300f3727baf109b32cfa03d603b29b9430908","unresolved":false,"context_lines":[{"line_number":5,"context_line":"Swift supports the optional encryption of object data at rest on storage nodes."},{"line_number":6,"context_line":"The encryption of object data is intended to mitigate the risk of users\u0027 data"},{"line_number":7,"context_line":"being read if an unauthorised party were to gain physical access to a disk."},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Encryption of data at rest is implemented by a set of three middleware modules"},{"line_number":10,"context_line":"that may be included in the proxy server WSGI pipeline. The feature is internal"},{"line_number":11,"context_line":"to a Swift cluster and not exposed through the API. Clients are unaware that"}],"source_content_type":"text/x-rst","patch_set":10,"id":"3aaa91ec_0aed7a8e","line":8,"updated":"2016-06-27 20:48:11.000000000","message":"I\u0027d love to insert soemthing here like the following (in a \"note\" box):\n\nThe best way to store encrypted data in a Swift cluster is to encrypt the data before sending it to the cluster. Encrypting on the client side is the only way to ensure that the data is fully encrypted for the data\u0027s entire lifecycle.\n\nSwift\u0027s data-at-rest encryption accepts plaintext data from the client, encrypts it in the cluster, and stores the encrypted data. This protects data from inadvertently being exposed if a data drive leaves the Swift cluster. If a user must ensure that the plaintext data is always encrypted during transit and storage, we strongly recommend encrypting the data before sending it to the Swift cluster.","commit_id":"2e9007613c609de7a918f2c7a96060876485eaad"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"830046a9facfa9bb12aa708f94e91b6ad43be94e","unresolved":false,"context_lines":[{"line_number":26,"context_line":"* All custom user metadata names"},{"line_number":27,"context_line":"* Object Content-Type values"},{"line_number":28,"context_line":"* Object size"},{"line_number":29,"context_line":"* System metadata"},{"line_number":30,"context_line":""},{"line_number":31,"context_line":".. note::"},{"line_number":32,"context_line":""}],"source_content_type":"text/x-rst","patch_set":10,"id":"3aaa91ec_1ff2d39a","line":29,"updated":"2016-06-27 23:25:28.000000000","message":"Maybe also worth calling out Content-Disposition, Content-Encoding, and any other standard HTTP headers (Cache-Control, Content-Language, Expires, Pragma, ...) that may have been configured via allowed_headers.\n\nI don\u0027t think it\u0027s a problem that these aren\u0027t encrypted, though, and I think that Content-Type would be higher value than any of those.","commit_id":"2e9007613c609de7a918f2c7a96060876485eaad"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"4e5cb9a3be89849d8d915d406fb090fdd10a062b","unresolved":false,"context_lines":[{"line_number":26,"context_line":"* All custom user metadata names"},{"line_number":27,"context_line":"* Object Content-Type values"},{"line_number":28,"context_line":"* Object size"},{"line_number":29,"context_line":"* System metadata"},{"line_number":30,"context_line":""},{"line_number":31,"context_line":".. note::"},{"line_number":32,"context_line":""}],"source_content_type":"text/x-rst","patch_set":10,"id":"3aaa91ec_bf2a71e5","line":29,"in_reply_to":"3aaa91ec_1ff2d39a","updated":"2016-06-28 17:00:33.000000000","message":"I think its pretty clear from line 22 - the longer the list gets the more it appears to be exhaustive, which is not intended to be.\n\nI will add \"metadata\" in line 22","commit_id":"2e9007613c609de7a918f2c7a96060876485eaad"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"d40eff72ff042ca083b256f3a166acc5285c1285","unresolved":false,"context_lines":[{"line_number":217,"context_line":"  object_key \u003d HMAC(encryption_root_secret, \"/a/c/o\")"},{"line_number":218,"context_line":""},{"line_number":219,"context_line":"Other strategies for providing object and container keys may be employed by"},{"line_number":220,"context_line":"future implementations of alternative keymaster middleware."},{"line_number":221,"context_line":""},{"line_number":222,"context_line":"The encrypter uses the object key to `wrap` other randomly generated keys that"},{"line_number":223,"context_line":"are used to encrypt object data. A random key is `wrapped` by encrypting it"}],"source_content_type":"text/x-rst","patch_set":10,"id":"3aaa91ec_5b6d9acb","line":220,"range":{"start_line":220,"start_character":26,"end_line":220,"end_character":58},"updated":"2016-06-27 19:06:27.000000000","message":"Would you ever want to use multiple keymasters on the same cluster? Would they need different account prefixes, similar to how auth systems currently do their namespacing? Do we have any sort of docs/specs for how this would work?","commit_id":"2e9007613c609de7a918f2c7a96060876485eaad"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"4e5cb9a3be89849d8d915d406fb090fdd10a062b","unresolved":false,"context_lines":[{"line_number":217,"context_line":"  object_key \u003d HMAC(encryption_root_secret, \"/a/c/o\")"},{"line_number":218,"context_line":""},{"line_number":219,"context_line":"Other strategies for providing object and container keys may be employed by"},{"line_number":220,"context_line":"future implementations of alternative keymaster middleware."},{"line_number":221,"context_line":""},{"line_number":222,"context_line":"The encrypter uses the object key to `wrap` other randomly generated keys that"},{"line_number":223,"context_line":"are used to encrypt object data. A random key is `wrapped` by encrypting it"}],"source_content_type":"text/x-rst","patch_set":10,"id":"3aaa91ec_2a13e15d","line":220,"range":{"start_line":220,"start_character":26,"end_line":220,"end_character":58},"in_reply_to":"3aaa91ec_5b6d9acb","updated":"2016-06-28 17:00:33.000000000","message":"1. Yes\n\n2. hopefully not - the use of a version string in the key_id should allow keymasters to be selected (much like the auth prefix acts as a discriminator)\n\n3. No","commit_id":"2e9007613c609de7a918f2c7a96060876485eaad"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"1ddc59551f98a3d865be02d53941ccc797b0d4c4","unresolved":false,"context_lines":[{"line_number":217,"context_line":"  object_key \u003d HMAC(encryption_root_secret, \"/a/c/o\")"},{"line_number":218,"context_line":""},{"line_number":219,"context_line":"Other strategies for providing object and container keys may be employed by"},{"line_number":220,"context_line":"future implementations of alternative keymaster middleware."},{"line_number":221,"context_line":""},{"line_number":222,"context_line":"The encrypter uses the object key to `wrap` other randomly generated keys that"},{"line_number":223,"context_line":"are used to encrypt object data. A random key is `wrapped` by encrypting it"}],"source_content_type":"text/x-rst","patch_set":10,"id":"3aaa91ec_8c368eb2","line":220,"range":{"start_line":220,"start_character":26,"end_line":220,"end_character":58},"in_reply_to":"3aaa91ec_5b6d9acb","updated":"2016-06-28 12:43:01.000000000","message":"If we would want to support future keymasters and migrating from one to another, it might be necessary to have multiple keymasters in the pipeline, so that new objects are encrypted according to the new keymaster, but existing objects would need to have their keys supplied from either the old or the new keymaster. Are there any significant roadblocks for this that would mean that migration would require all existing data to be e.g., moved from a cluster with the old keymaster to a new cluster with the new keymaster?","commit_id":"2e9007613c609de7a918f2c7a96060876485eaad"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"4e5cb9a3be89849d8d915d406fb090fdd10a062b","unresolved":false,"context_lines":[{"line_number":217,"context_line":"  object_key \u003d HMAC(encryption_root_secret, \"/a/c/o\")"},{"line_number":218,"context_line":""},{"line_number":219,"context_line":"Other strategies for providing object and container keys may be employed by"},{"line_number":220,"context_line":"future implementations of alternative keymaster middleware."},{"line_number":221,"context_line":""},{"line_number":222,"context_line":"The encrypter uses the object key to `wrap` other randomly generated keys that"},{"line_number":223,"context_line":"are used to encrypt object data. A random key is `wrapped` by encrypting it"}],"source_content_type":"text/x-rst","patch_set":10,"id":"3aaa91ec_8a281587","line":220,"range":{"start_line":220,"start_character":26,"end_line":220,"end_character":58},"in_reply_to":"3aaa91ec_8c368eb2","updated":"2016-06-28 17:00:33.000000000","message":"We have tried to allow for that, so hopefully no roadblocks. See comment above.","commit_id":"2e9007613c609de7a918f2c7a96060876485eaad"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"d40eff72ff042ca083b256f3a166acc5285c1285","unresolved":false,"context_lines":[{"line_number":372,"context_line":"discovered then it will:"},{"line_number":373,"context_line":""},{"line_number":374,"context_line":"#. Fetch container and object keys from the keymaster via its callback"},{"line_number":375,"context_line":"#. Decrypt the ``X-Object-Sysmeta-Crypto-Etag`` value using the container"},{"line_number":376,"context_line":"   key and the IV found in the ``X-Object-Sysmeta-Crypto-Meta-Etag`` header"},{"line_number":377,"context_line":"#. Decrypt metadata header values using the object key"},{"line_number":378,"context_line":"#. Decrypt the wrapped body key found in ``X-Object-Sysmeta-Crypto-Meta``"},{"line_number":379,"context_line":"#. Decrypt the body using the body key"}],"source_content_type":"text/x-rst","patch_set":10,"id":"3aaa91ec_db618ad5","line":376,"range":{"start_line":375,"start_character":64,"end_line":376,"end_character":6},"updated":"2016-06-27 19:06:27.000000000","message":"This is no longer true, right? So we no longer strictly need the container key in the first list item (at least for GETs/HEADs).","commit_id":"2e9007613c609de7a918f2c7a96060876485eaad"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"4e5cb9a3be89849d8d915d406fb090fdd10a062b","unresolved":false,"context_lines":[{"line_number":372,"context_line":"discovered then it will:"},{"line_number":373,"context_line":""},{"line_number":374,"context_line":"#. Fetch container and object keys from the keymaster via its callback"},{"line_number":375,"context_line":"#. Decrypt the ``X-Object-Sysmeta-Crypto-Etag`` value using the container"},{"line_number":376,"context_line":"   key and the IV found in the ``X-Object-Sysmeta-Crypto-Meta-Etag`` header"},{"line_number":377,"context_line":"#. Decrypt metadata header values using the object key"},{"line_number":378,"context_line":"#. Decrypt the wrapped body key found in ``X-Object-Sysmeta-Crypto-Meta``"},{"line_number":379,"context_line":"#. Decrypt the body using the body key"}],"source_content_type":"text/x-rst","patch_set":10,"id":"3aaa91ec_2a41213a","line":376,"range":{"start_line":375,"start_character":64,"end_line":376,"end_character":6},"in_reply_to":"3aaa91ec_db618ad5","updated":"2016-06-28 17:00:33.000000000","message":"Done","commit_id":"2e9007613c609de7a918f2c7a96060876485eaad"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"e06b81561f96e2fcab8c7653d139d58b2abe09a3","unresolved":false,"context_lines":[{"line_number":15,"context_line":"    data is always encrypted while in transit and in storage, it is strongly"},{"line_number":16,"context_line":"    recommended that the data be encrypted before sending it to the Swift"},{"line_number":17,"context_line":"    cluster. Encrypting on the client side is the only way to ensure that the"},{"line_number":18,"context_line":"    data is fully encrypted for the its entire lifecycle."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"Encryption of data at rest is implemented by a set of three middleware modules"},{"line_number":21,"context_line":"that may be included in the proxy server WSGI pipeline. The feature is internal"}],"source_content_type":"text/x-rst","patch_set":11,"id":"3aaa91ec_40d609c4","line":18,"range":{"start_line":18,"start_character":32,"end_line":18,"end_character":56},"updated":"2016-06-28 21:25:32.000000000","message":"\"its entire lifecycle\" or \"the entirety of its lifecycle\"","commit_id":"5ee2a4ae53c122b79b2cfcfbb84c0664093a5ada"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"936305655564904764bd2a3654ed2f3c880a6ac4","unresolved":false,"context_lines":[{"line_number":15,"context_line":"    data is always encrypted while in transit and in storage, it is strongly"},{"line_number":16,"context_line":"    recommended that the data be encrypted before sending it to the Swift"},{"line_number":17,"context_line":"    cluster. Encrypting on the client side is the only way to ensure that the"},{"line_number":18,"context_line":"    data is fully encrypted for the its entire lifecycle."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"Encryption of data at rest is implemented by a set of three middleware modules"},{"line_number":21,"context_line":"that may be included in the proxy server WSGI pipeline. The feature is internal"}],"source_content_type":"text/x-rst","patch_set":11,"id":"3aaa91ec_17c37358","line":18,"range":{"start_line":18,"start_character":32,"end_line":18,"end_character":56},"in_reply_to":"3aaa91ec_40d609c4","updated":"2016-06-29 17:06:05.000000000","message":"Done","commit_id":"5ee2a4ae53c122b79b2cfcfbb84c0664093a5ada"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"e06b81561f96e2fcab8c7653d139d58b2abe09a3","unresolved":false,"context_lines":[{"line_number":88,"context_line":""},{"line_number":89,"context_line":"    The ``encryption_root_secret`` option holds the master secret key used for"},{"line_number":90,"context_line":"    encryption.  The security of all encrypted data critically depends on this"},{"line_number":91,"context_line":"    key, therefore it should be set to a high-entropy value. For example, a"},{"line_number":92,"context_line":"    suitable ``encryption_root_secret`` may be obtained by base-64 encoding a"},{"line_number":93,"context_line":"    32 byte (or longer) value generated by a cryptographically secure random"},{"line_number":94,"context_line":"    number generator."}],"source_content_type":"text/x-rst","patch_set":11,"id":"3aaa91ec_b360e5a5","line":91,"range":{"start_line":91,"start_character":7,"end_line":91,"end_character":8},"updated":"2016-06-28 21:25:32.000000000","message":"nit: maybe better as a semicolon?","commit_id":"5ee2a4ae53c122b79b2cfcfbb84c0664093a5ada"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"936305655564904764bd2a3654ed2f3c880a6ac4","unresolved":false,"context_lines":[{"line_number":88,"context_line":""},{"line_number":89,"context_line":"    The ``encryption_root_secret`` option holds the master secret key used for"},{"line_number":90,"context_line":"    encryption.  The security of all encrypted data critically depends on this"},{"line_number":91,"context_line":"    key, therefore it should be set to a high-entropy value. For example, a"},{"line_number":92,"context_line":"    suitable ``encryption_root_secret`` may be obtained by base-64 encoding a"},{"line_number":93,"context_line":"    32 byte (or longer) value generated by a cryptographically secure random"},{"line_number":94,"context_line":"    number generator."}],"source_content_type":"text/x-rst","patch_set":11,"id":"3aaa91ec_b796df3b","line":91,"range":{"start_line":91,"start_character":7,"end_line":91,"end_character":8},"in_reply_to":"3aaa91ec_b360e5a5","updated":"2016-06-29 17:06:05.000000000","message":"Done","commit_id":"5ee2a4ae53c122b79b2cfcfbb84c0664093a5ada"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"e06b81561f96e2fcab8c7653d139d58b2abe09a3","unresolved":false,"context_lines":[{"line_number":102,"context_line":"One method for generating a suitable value for ``encryption_root_secret`` is to"},{"line_number":103,"context_line":"use the ``openssl`` command line tool::"},{"line_number":104,"context_line":""},{"line_number":105,"context_line":"    openssl rand -base64 32"},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"Once deployed, the encrypter will by default encrypt object data and metadata"},{"line_number":108,"context_line":"when handling PUT and POST requests and the decrypter will decrypt object data"}],"source_content_type":"text/x-rst","patch_set":11,"id":"3aaa91ec_53e70112","line":105,"updated":"2016-06-28 21:25:32.000000000","message":"Nice.","commit_id":"5ee2a4ae53c122b79b2cfcfbb84c0664093a5ada"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"936305655564904764bd2a3654ed2f3c880a6ac4","unresolved":false,"context_lines":[{"line_number":102,"context_line":"One method for generating a suitable value for ``encryption_root_secret`` is to"},{"line_number":103,"context_line":"use the ``openssl`` command line tool::"},{"line_number":104,"context_line":""},{"line_number":105,"context_line":"    openssl rand -base64 32"},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"Once deployed, the encrypter will by default encrypt object data and metadata"},{"line_number":108,"context_line":"when handling PUT and POST requests and the decrypter will decrypt object data"}],"source_content_type":"text/x-rst","patch_set":11,"id":"3aaa91ec_979be365","line":105,"in_reply_to":"3aaa91ec_53e70112","updated":"2016-06-29 17:06:05.000000000","message":"Done","commit_id":"5ee2a4ae53c122b79b2cfcfbb84c0664093a5ada"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"e06b81561f96e2fcab8c7653d139d58b2abe09a3","unresolved":false,"context_lines":[{"line_number":107,"context_line":"Once deployed, the encrypter will by default encrypt object data and metadata"},{"line_number":108,"context_line":"when handling PUT and POST requests and the decrypter will decrypt object data"},{"line_number":109,"context_line":"and metadata when handling GET and HEAD requests. COPY requests are transformed"},{"line_number":110,"context_line":"into GET and PUT requests by the :ref:`copy` middleware before reaching the"},{"line_number":111,"context_line":"encryption middleware and as a result object data and metadata is decrypted and"},{"line_number":112,"context_line":"re-encrypted when copied."},{"line_number":113,"context_line":""}],"source_content_type":"text/x-rst","patch_set":11,"id":"3aaa91ec_2b8f59cd","line":110,"range":{"start_line":110,"start_character":33,"end_line":110,"end_character":55},"updated":"2016-06-28 21:25:32.000000000","message":"Maybe also worth calling out that versioned_writes should still work? Not necessarily here, but *somewhere*.","commit_id":"5ee2a4ae53c122b79b2cfcfbb84c0664093a5ada"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"936305655564904764bd2a3654ed2f3c880a6ac4","unresolved":false,"context_lines":[{"line_number":107,"context_line":"Once deployed, the encrypter will by default encrypt object data and metadata"},{"line_number":108,"context_line":"when handling PUT and POST requests and the decrypter will decrypt object data"},{"line_number":109,"context_line":"and metadata when handling GET and HEAD requests. COPY requests are transformed"},{"line_number":110,"context_line":"into GET and PUT requests by the :ref:`copy` middleware before reaching the"},{"line_number":111,"context_line":"encryption middleware and as a result object data and metadata is decrypted and"},{"line_number":112,"context_line":"re-encrypted when copied."},{"line_number":113,"context_line":""}],"source_content_type":"text/x-rst","patch_set":11,"id":"3aaa91ec_527fc9df","line":110,"range":{"start_line":110,"start_character":33,"end_line":110,"end_character":55},"in_reply_to":"3aaa91ec_2b8f59cd","updated":"2016-06-29 17:06:05.000000000","message":"Done. In the \u0027impact on other Swift...\u0027 section.","commit_id":"5ee2a4ae53c122b79b2cfcfbb84c0664093a5ada"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"e06b81561f96e2fcab8c7653d139d58b2abe09a3","unresolved":false,"context_lines":[{"line_number":118,"context_line":"written again by a PUT, POST or COPY request."},{"line_number":119,"context_line":""},{"line_number":120,"context_line":"Once deployed, the encryption middlewares should not be removed from the"},{"line_number":121,"context_line":"pipeline. To do so might cause encrypted object data and/or metadata to be"},{"line_number":122,"context_line":"returned in response to GET or HEAD requests."},{"line_number":123,"context_line":""},{"line_number":124,"context_line":"Encryption of inbound object data may be disabled by setting the encrypter"}],"source_content_type":"text/x-rst","patch_set":11,"id":"3aaa91ec_ac76c6a0","line":121,"range":{"start_line":121,"start_character":19,"end_line":121,"end_character":24},"updated":"2016-06-28 21:25:32.000000000","message":"I think it would be stronger to say this *will* happen, given these conditions.","commit_id":"5ee2a4ae53c122b79b2cfcfbb84c0664093a5ada"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"936305655564904764bd2a3654ed2f3c880a6ac4","unresolved":false,"context_lines":[{"line_number":118,"context_line":"written again by a PUT, POST or COPY request."},{"line_number":119,"context_line":""},{"line_number":120,"context_line":"Once deployed, the encryption middlewares should not be removed from the"},{"line_number":121,"context_line":"pipeline. To do so might cause encrypted object data and/or metadata to be"},{"line_number":122,"context_line":"returned in response to GET or HEAD requests."},{"line_number":123,"context_line":""},{"line_number":124,"context_line":"Encryption of inbound object data may be disabled by setting the encrypter"}],"source_content_type":"text/x-rst","patch_set":11,"id":"3aaa91ec_d2529966","line":121,"range":{"start_line":121,"start_character":19,"end_line":121,"end_character":24},"in_reply_to":"3aaa91ec_ac76c6a0","updated":"2016-06-29 17:06:05.000000000","message":"The \u0027might\u0027 was allowing for there being unencrypted objects in the cluster, but agree it can be stronger.","commit_id":"5ee2a4ae53c122b79b2cfcfbb84c0664093a5ada"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"e06b81561f96e2fcab8c7653d139d58b2abe09a3","unresolved":false,"context_lines":[{"line_number":125,"context_line":"``disable_encryption`` option to ``True``, in which case existing encrypted"},{"line_number":126,"context_line":"objects will remain encrypted but new data written with PUT, POST or COPY"},{"line_number":127,"context_line":"requests will not be encrypted. The encryption middlewares should remain in the"},{"line_number":128,"context_line":"pipeline even when encryption of new objects is not required. The encrypter"},{"line_number":129,"context_line":"middleware is needed to handle conditional GET requests for objects that may"},{"line_number":130,"context_line":"have been previously encrypted. The decrypter middleware is needed to handle"},{"line_number":131,"context_line":"all GET requests that are for encrypted objects. The keymaster is needed to"},{"line_number":132,"context_line":"provide keys for those requests."},{"line_number":133,"context_line":""},{"line_number":134,"context_line":".. _container_sync_client_config:"}],"source_content_type":"text/x-rst","patch_set":11,"id":"3aaa91ec_2c6db699","line":131,"range":{"start_line":128,"start_character":62,"end_line":131,"end_character":48},"updated":"2016-06-28 21:25:32.000000000","message":"I might switch the order of the reasonings for the encrypter and decrypter here, just because the decrypter is a more obvious case while the encrypter is more subtle.\n\nMaybe that\u0027s just bike-shedding, though. This is fine, and other people may have different opinions.","commit_id":"5ee2a4ae53c122b79b2cfcfbb84c0664093a5ada"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"936305655564904764bd2a3654ed2f3c880a6ac4","unresolved":false,"context_lines":[{"line_number":125,"context_line":"``disable_encryption`` option to ``True``, in which case existing encrypted"},{"line_number":126,"context_line":"objects will remain encrypted but new data written with PUT, POST or COPY"},{"line_number":127,"context_line":"requests will not be encrypted. The encryption middlewares should remain in the"},{"line_number":128,"context_line":"pipeline even when encryption of new objects is not required. The encrypter"},{"line_number":129,"context_line":"middleware is needed to handle conditional GET requests for objects that may"},{"line_number":130,"context_line":"have been previously encrypted. The decrypter middleware is needed to handle"},{"line_number":131,"context_line":"all GET requests that are for encrypted objects. The keymaster is needed to"},{"line_number":132,"context_line":"provide keys for those requests."},{"line_number":133,"context_line":""},{"line_number":134,"context_line":".. _container_sync_client_config:"}],"source_content_type":"text/x-rst","patch_set":11,"id":"3aaa91ec_0d46c64e","line":131,"range":{"start_line":128,"start_character":62,"end_line":131,"end_character":48},"in_reply_to":"3aaa91ec_2c6db699","updated":"2016-06-29 17:06:05.000000000","message":"Can I leave it? I prefer the less-obvious being up-front.","commit_id":"5ee2a4ae53c122b79b2cfcfbb84c0664093a5ada"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"e06b81561f96e2fcab8c7653d139d58b2abe09a3","unresolved":false,"context_lines":[{"line_number":143,"context_line":"#. Create a custom internal client configuration file for container sync (if"},{"line_number":144,"context_line":"   one is not already in use) based on the sample file"},{"line_number":145,"context_line":"   `internal-client.conf-sample`. For example, copy"},{"line_number":146,"context_line":"   `internal-client.conf-sample` to `/etc/swift/container-sync-client.conf`."},{"line_number":147,"context_line":"#. Modify this file to include the encryption middlewares in the pipeline in"},{"line_number":148,"context_line":"   the same way as described above for the proxy server."},{"line_number":149,"context_line":"#. Modify the container-sync section of all container server config files to"}],"source_content_type":"text/x-rst","patch_set":11,"id":"3aaa91ec_cc87d210","line":146,"updated":"2016-06-28 21:25:32.000000000","message":"We may want to mention that this file should be separated from data disks, similar to proxy-server.conf. You\u0027d hope operators would infer it from the next item, but it couldn\u0027t hurt to be explicit.","commit_id":"5ee2a4ae53c122b79b2cfcfbb84c0664093a5ada"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"936305655564904764bd2a3654ed2f3c880a6ac4","unresolved":false,"context_lines":[{"line_number":143,"context_line":"#. Create a custom internal client configuration file for container sync (if"},{"line_number":144,"context_line":"   one is not already in use) based on the sample file"},{"line_number":145,"context_line":"   `internal-client.conf-sample`. For example, copy"},{"line_number":146,"context_line":"   `internal-client.conf-sample` to `/etc/swift/container-sync-client.conf`."},{"line_number":147,"context_line":"#. Modify this file to include the encryption middlewares in the pipeline in"},{"line_number":148,"context_line":"   the same way as described above for the proxy server."},{"line_number":149,"context_line":"#. Modify the container-sync section of all container server config files to"}],"source_content_type":"text/x-rst","patch_set":11,"id":"3aaa91ec_08bfd4aa","line":146,"in_reply_to":"3aaa91ec_cc87d210","updated":"2016-06-29 17:06:05.000000000","message":"Done. Belt and braces.","commit_id":"5ee2a4ae53c122b79b2cfcfbb84c0664093a5ada"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"e06b81561f96e2fcab8c7653d139d58b2abe09a3","unresolved":false,"context_lines":[{"line_number":158,"context_line":"    sync probe tests to pass if encryption middleware is included in the proxy"},{"line_number":159,"context_line":"    pipeline of a test cluster."},{"line_number":160,"context_line":""},{"line_number":161,"context_line":"Upgrade Considerations"},{"line_number":162,"context_line":"----------------------"},{"line_number":163,"context_line":""},{"line_number":164,"context_line":"When upgrading an existing cluster to deploy encryption, the following sequence"}],"source_content_type":"text/x-rst","patch_set":11,"id":"3aaa91ec_0720939a","line":161,"updated":"2016-06-28 21:25:32.000000000","message":"Maybe swap Container sync and Upgrade Considerations sections. I want the need for a two-stage config deploy to be very obvious and fear that an operator may naively follow along in the first section, get to container sync, say \"that doesn\u0027t apply to me\", and deploy.\n\nMight even want to move the\n\n\u003e Objects that existed in the cluster prior to the encryption middlewares being deployed ...\n\nparagraph under here, just to shorten the distance between \"Here\u0027s a what a final config looks like.\" and \"Don\u0027t deploy that! Do this other thing first.\"","commit_id":"5ee2a4ae53c122b79b2cfcfbb84c0664093a5ada"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"936305655564904764bd2a3654ed2f3c880a6ac4","unresolved":false,"context_lines":[{"line_number":158,"context_line":"    sync probe tests to pass if encryption middleware is included in the proxy"},{"line_number":159,"context_line":"    pipeline of a test cluster."},{"line_number":160,"context_line":""},{"line_number":161,"context_line":"Upgrade Considerations"},{"line_number":162,"context_line":"----------------------"},{"line_number":163,"context_line":""},{"line_number":164,"context_line":"When upgrading an existing cluster to deploy encryption, the following sequence"}],"source_content_type":"text/x-rst","patch_set":11,"id":"3aaa91ec_88b2a4e3","line":161,"in_reply_to":"3aaa91ec_0720939a","updated":"2016-06-29 17:06:05.000000000","message":"Done","commit_id":"5ee2a4ae53c122b79b2cfcfbb84c0664093a5ada"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"e06b81561f96e2fcab8c7653d139d58b2abe09a3","unresolved":false,"context_lines":[{"line_number":178,"context_line":"Encryption scheme"},{"line_number":179,"context_line":"-----------------"},{"line_number":180,"context_line":""},{"line_number":181,"context_line":"Plaintext data is encrypted to a ciphertext using the AES cipher with 256-bit"},{"line_number":182,"context_line":"keys implemented by the python `cryptography package"},{"line_number":183,"context_line":"\u003chttps://pypi.python.org/pypi/cryptography\u003e`_. The cipher is used in counter"},{"line_number":184,"context_line":"(CTR) mode so that any byte or range of bytes in the ciphertext may be"}],"source_content_type":"text/x-rst","patch_set":11,"id":"3aaa91ec_27d82f7f","line":181,"range":{"start_line":181,"start_character":31,"end_line":181,"end_character":43},"updated":"2016-06-28 21:25:32.000000000","message":"Maybe just \"ciphertext\"?","commit_id":"5ee2a4ae53c122b79b2cfcfbb84c0664093a5ada"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"936305655564904764bd2a3654ed2f3c880a6ac4","unresolved":false,"context_lines":[{"line_number":178,"context_line":"Encryption scheme"},{"line_number":179,"context_line":"-----------------"},{"line_number":180,"context_line":""},{"line_number":181,"context_line":"Plaintext data is encrypted to a ciphertext using the AES cipher with 256-bit"},{"line_number":182,"context_line":"keys implemented by the python `cryptography package"},{"line_number":183,"context_line":"\u003chttps://pypi.python.org/pypi/cryptography\u003e`_. The cipher is used in counter"},{"line_number":184,"context_line":"(CTR) mode so that any byte or range of bytes in the ciphertext may be"}],"source_content_type":"text/x-rst","patch_set":11,"id":"3aaa91ec_68de5812","line":181,"range":{"start_line":181,"start_character":31,"end_line":181,"end_character":43},"in_reply_to":"3aaa91ec_27d82f7f","updated":"2016-06-29 17:06:05.000000000","message":"Done","commit_id":"5ee2a4ae53c122b79b2cfcfbb84c0664093a5ada"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"e06b81561f96e2fcab8c7653d139d58b2abe09a3","unresolved":false,"context_lines":[{"line_number":209,"context_line":"the IV and the cipher algorithm used for the encryption::"},{"line_number":210,"context_line":""},{"line_number":211,"context_line":"  crypto_metadata \u003d {\"iv\": \u003c16 byte value\u003e,"},{"line_number":212,"context_line":"                     \"cipher\": \"AES_CTR_256\"}"},{"line_number":213,"context_line":""},{"line_number":214,"context_line":"Key management"},{"line_number":215,"context_line":"--------------"}],"source_content_type":"text/x-rst","patch_set":11,"id":"3aaa91ec_a2608da5","line":212,"updated":"2016-06-28 21:25:32.000000000","message":"Should this also mention key_id?\n\nShould we also add something like\n\n\u003e This crypto-metadata will be stored either with the ciphertext (for user metadata and etags) or as a separate header (for object bodies).\n\n?","commit_id":"5ee2a4ae53c122b79b2cfcfbb84c0664093a5ada"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"936305655564904764bd2a3654ed2f3c880a6ac4","unresolved":false,"context_lines":[{"line_number":209,"context_line":"the IV and the cipher algorithm used for the encryption::"},{"line_number":210,"context_line":""},{"line_number":211,"context_line":"  crypto_metadata \u003d {\"iv\": \u003c16 byte value\u003e,"},{"line_number":212,"context_line":"                     \"cipher\": \"AES_CTR_256\"}"},{"line_number":213,"context_line":""},{"line_number":214,"context_line":"Key management"},{"line_number":215,"context_line":"--------------"}],"source_content_type":"text/x-rst","patch_set":11,"id":"3aaa91ec_c86b0c1d","line":212,"in_reply_to":"3aaa91ec_a2608da5","updated":"2016-06-29 17:06:05.000000000","message":"I have held off on key_id while its content is under question. But also, given its a future-proof only feature, I\u0027d like to avoid the detail here. This is after all just an overview of the mechanisms.","commit_id":"5ee2a4ae53c122b79b2cfcfbb84c0664093a5ada"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"e06b81561f96e2fcab8c7653d139d58b2abe09a3","unresolved":false,"context_lines":[{"line_number":232,"context_line":"future implementations of alternative keymaster middleware."},{"line_number":233,"context_line":""},{"line_number":234,"context_line":"The encrypter uses the object key to `wrap` other randomly generated keys that"},{"line_number":235,"context_line":"are used to encrypt object data. A random key is `wrapped` by encrypting it"},{"line_number":236,"context_line":"using the object key provided by the keymaster. This makes it safe to store the"},{"line_number":237,"context_line":"wrapped key alongside object data and metadata."},{"line_number":238,"context_line":""}],"source_content_type":"text/x-rst","patch_set":11,"id":"3aaa91ec_c262f915","line":235,"range":{"start_line":235,"start_character":50,"end_line":235,"end_character":57},"updated":"2016-06-28 21:25:32.000000000","message":"I found all of the `wrap`, `wrapped`, `key wrapping` a little distracting. Maybe better to describe what happens, then apply a label to it in the next paragraph? Something like\n\n\u003e During each object PUT, a random key is generated to encrypt the body. The random key is then encrypted using the object key provided by the keymaster. This makes it safe to store the encrypted key alongside the encrypted object data and metadata.\n\n\u003e This process of `key wrapping`...","commit_id":"5ee2a4ae53c122b79b2cfcfbb84c0664093a5ada"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"e06b81561f96e2fcab8c7653d139d58b2abe09a3","unresolved":false,"context_lines":[{"line_number":236,"context_line":"using the object key provided by the keymaster. This makes it safe to store the"},{"line_number":237,"context_line":"wrapped key alongside object data and metadata."},{"line_number":238,"context_line":""},{"line_number":239,"context_line":"This process of `key wrapping` is performed to enable more efficient re-keying"},{"line_number":240,"context_line":"events when the object key may need to be replaced and consequently any data"},{"line_number":241,"context_line":"encrypted using that key must be re-encrypted. Key wrapping minimizes the"},{"line_number":242,"context_line":"amount of data encrypted using those keys to just other randomly chosen keys"}],"source_content_type":"text/x-rst","patch_set":11,"id":"3aaa91ec_a2140d9f","line":239,"range":{"start_line":239,"start_character":31,"end_line":239,"end_character":53},"updated":"2016-06-28 21:25:32.000000000","message":"nit: s/is performed to enable/enables/, maybe?","commit_id":"5ee2a4ae53c122b79b2cfcfbb84c0664093a5ada"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"936305655564904764bd2a3654ed2f3c880a6ac4","unresolved":false,"context_lines":[{"line_number":236,"context_line":"using the object key provided by the keymaster. This makes it safe to store the"},{"line_number":237,"context_line":"wrapped key alongside object data and metadata."},{"line_number":238,"context_line":""},{"line_number":239,"context_line":"This process of `key wrapping` is performed to enable more efficient re-keying"},{"line_number":240,"context_line":"events when the object key may need to be replaced and consequently any data"},{"line_number":241,"context_line":"encrypted using that key must be re-encrypted. Key wrapping minimizes the"},{"line_number":242,"context_line":"amount of data encrypted using those keys to just other randomly chosen keys"}],"source_content_type":"text/x-rst","patch_set":11,"id":"3aaa91ec_6eef811e","line":239,"range":{"start_line":239,"start_character":31,"end_line":239,"end_character":53},"in_reply_to":"3aaa91ec_a2140d9f","updated":"2016-06-29 17:06:05.000000000","message":"Done","commit_id":"5ee2a4ae53c122b79b2cfcfbb84c0664093a5ada"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"e06b81561f96e2fcab8c7653d139d58b2abe09a3","unresolved":false,"context_lines":[{"line_number":243,"context_line":"which can be re-wrapped efficiently without needing to re-encrypt the larger"},{"line_number":244,"context_line":"amounts of data that were encrypted using the random keys."},{"line_number":245,"context_line":""},{"line_number":246,"context_line":"For example, as described below, the object body is encrypted using a random"},{"line_number":247,"context_line":"key which is then wrapped using the object key. If re-keying requires the"},{"line_number":248,"context_line":"object key to be replaced then only the random key needs to be re-encrypted and"},{"line_number":249,"context_line":"not the object body, which is potentially a large amount of data."}],"source_content_type":"text/x-rst","patch_set":11,"id":"3aaa91ec_28b59f30","line":246,"range":{"start_line":246,"start_character":16,"end_line":246,"end_character":31},"updated":"2016-06-28 21:25:32.000000000","message":"Wait, wasn\u0027t this described *above*?\n\nI\u0027m not sure this paragraph is necessary.","commit_id":"5ee2a4ae53c122b79b2cfcfbb84c0664093a5ada"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"936305655564904764bd2a3654ed2f3c880a6ac4","unresolved":false,"context_lines":[{"line_number":243,"context_line":"which can be re-wrapped efficiently without needing to re-encrypt the larger"},{"line_number":244,"context_line":"amounts of data that were encrypted using the random keys."},{"line_number":245,"context_line":""},{"line_number":246,"context_line":"For example, as described below, the object body is encrypted using a random"},{"line_number":247,"context_line":"key which is then wrapped using the object key. If re-keying requires the"},{"line_number":248,"context_line":"object key to be replaced then only the random key needs to be re-encrypted and"},{"line_number":249,"context_line":"not the object body, which is potentially a large amount of data."}],"source_content_type":"text/x-rst","patch_set":11,"id":"3aaa91ec_6e3dc18e","line":246,"range":{"start_line":246,"start_character":16,"end_line":246,"end_character":31},"in_reply_to":"3aaa91ec_28b59f30","updated":"2016-06-29 17:06:05.000000000","message":"IIRC at some point somebody requested text to be added somewhere in these paragraphs. With your change above it does seem a little repetitive.","commit_id":"5ee2a4ae53c122b79b2cfcfbb84c0664093a5ada"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"e06b81561f96e2fcab8c7653d139d58b2abe09a3","unresolved":false,"context_lines":[{"line_number":301,"context_line":"      {\"iv\": body_iv,"},{"line_number":302,"context_line":"       \"cipher\": \"AES_CTR_256\","},{"line_number":303,"context_line":"       \"body_key\": {\"key\": wrapped_body_key,"},{"line_number":304,"context_line":"                    \"iv\": body_key_iv}}"},{"line_number":305,"context_line":""},{"line_number":306,"context_line":"Note that in this case there is an extra item of crypto-metadata which stores"},{"line_number":307,"context_line":"the wrapped body key and its IV."}],"source_content_type":"text/x-rst","patch_set":11,"id":"3aaa91ec_68bde7d6","line":304,"range":{"start_line":304,"start_character":26,"end_line":304,"end_character":37},"updated":"2016-06-28 21:25:32.000000000","message":"For some reason I had it in my head that body_iv and body_key_iv were the same. Looks like this is accurate, though.","commit_id":"5ee2a4ae53c122b79b2cfcfbb84c0664093a5ada"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"936305655564904764bd2a3654ed2f3c880a6ac4","unresolved":false,"context_lines":[{"line_number":301,"context_line":"      {\"iv\": body_iv,"},{"line_number":302,"context_line":"       \"cipher\": \"AES_CTR_256\","},{"line_number":303,"context_line":"       \"body_key\": {\"key\": wrapped_body_key,"},{"line_number":304,"context_line":"                    \"iv\": body_key_iv}}"},{"line_number":305,"context_line":""},{"line_number":306,"context_line":"Note that in this case there is an extra item of crypto-metadata which stores"},{"line_number":307,"context_line":"the wrapped body key and its IV."}],"source_content_type":"text/x-rst","patch_set":11,"id":"3aaa91ec_8e890d29","line":304,"range":{"start_line":304,"start_character":26,"end_line":304,"end_character":37},"in_reply_to":"3aaa91ec_68bde7d6","updated":"2016-06-29 17:06:05.000000000","message":"Done","commit_id":"5ee2a4ae53c122b79b2cfcfbb84c0664093a5ada"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"e06b81561f96e2fcab8c7653d139d58b2abe09a3","unresolved":false,"context_lines":[{"line_number":307,"context_line":"the wrapped body key and its IV."},{"line_number":308,"context_line":""},{"line_number":309,"context_line":"Entity tag"},{"line_number":310,"context_line":"++++++++++"},{"line_number":311,"context_line":""},{"line_number":312,"context_line":"While encrypting the object body the encrypter also calculates the ETag (md5"},{"line_number":313,"context_line":"digest) of the plaintext body. This value is encrypted using the object key"}],"source_content_type":"text/x-rst","patch_set":11,"id":"3aaa91ec_6bfccb3e","line":310,"updated":"2016-06-28 21:25:32.000000000","message":"This needs updating now that X-Object-Sysmeta-Crypto-Meta-Etag has been folded into X-Object-Sysmeta-Crypto-Etag.","commit_id":"5ee2a4ae53c122b79b2cfcfbb84c0664093a5ada"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"936305655564904764bd2a3654ed2f3c880a6ac4","unresolved":false,"context_lines":[{"line_number":307,"context_line":"the wrapped body key and its IV."},{"line_number":308,"context_line":""},{"line_number":309,"context_line":"Entity tag"},{"line_number":310,"context_line":"++++++++++"},{"line_number":311,"context_line":""},{"line_number":312,"context_line":"While encrypting the object body the encrypter also calculates the ETag (md5"},{"line_number":313,"context_line":"digest) of the plaintext body. This value is encrypted using the object key"}],"source_content_type":"text/x-rst","patch_set":11,"id":"3aaa91ec_713da08e","line":310,"in_reply_to":"3aaa91ec_6bfccb3e","updated":"2016-06-29 17:06:05.000000000","message":"Done","commit_id":"5ee2a4ae53c122b79b2cfcfbb84c0664093a5ada"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"e06b81561f96e2fcab8c7653d139d58b2abe09a3","unresolved":false,"context_lines":[{"line_number":335,"context_line":"decrypter must be able to decrypt the ETags in container listings using only"},{"line_number":336,"context_line":"the container key (since object keys may not be available when handling a"},{"line_number":337,"context_line":"container request) so the ETags must therefore be encrypted using the container"},{"line_number":338,"context_line":"key."},{"line_number":339,"context_line":""},{"line_number":340,"context_line":"Since the plaintext ETag value is only known once the encrypter has completed"},{"line_number":341,"context_line":"processing the entire object body, the ``X-Object-Sysmeta-Crypto-Etag``,"}],"source_content_type":"text/x-rst","patch_set":11,"id":"3aaa91ec_6898471c","line":338,"updated":"2016-06-28 21:25:32.000000000","message":"Maybe better?\n\n\u003e Note that the container key is used for this encryption. This allows the decrypter to decrypt the ETags in container listings, when only the container key is available. None of the object keys are available when handling a container request.\n\n...and leave off the bit about needing to encrypt with the same key you\u0027ll use to decrypt (since that\u0027s just how symmetric encryption works).","commit_id":"5ee2a4ae53c122b79b2cfcfbb84c0664093a5ada"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"936305655564904764bd2a3654ed2f3c880a6ac4","unresolved":false,"context_lines":[{"line_number":335,"context_line":"decrypter must be able to decrypt the ETags in container listings using only"},{"line_number":336,"context_line":"the container key (since object keys may not be available when handling a"},{"line_number":337,"context_line":"container request) so the ETags must therefore be encrypted using the container"},{"line_number":338,"context_line":"key."},{"line_number":339,"context_line":""},{"line_number":340,"context_line":"Since the plaintext ETag value is only known once the encrypter has completed"},{"line_number":341,"context_line":"processing the entire object body, the ``X-Object-Sysmeta-Crypto-Etag``,"}],"source_content_type":"text/x-rst","patch_set":11,"id":"3aaa91ec_91d48c20","line":338,"in_reply_to":"3aaa91ec_6898471c","updated":"2016-06-29 17:06:05.000000000","message":"ok I\u0027ll reword it.","commit_id":"5ee2a4ae53c122b79b2cfcfbb84c0664093a5ada"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"e06b81561f96e2fcab8c7653d139d58b2abe09a3","unresolved":false,"context_lines":[{"line_number":352,"context_line":"metadata. This is not possible when the ETag stored in object metadata has been"},{"line_number":353,"context_line":"encrypted. The encrypter therefore calculates an HMAC using the object key and"},{"line_number":354,"context_line":"the ETag while handling object PUT requests, and stores this under the metadata"},{"line_number":355,"context_line":"key ``X-Object-Sysmeta-Crypto-Meta-Etag-Mac``::"},{"line_number":356,"context_line":""},{"line_number":357,"context_line":"  X-Object-Sysmeta-Crypto-Meta-Etag-Mac: HMAC(object_key, md5(plaintext))"},{"line_number":358,"context_line":""}],"source_content_type":"text/x-rst","patch_set":11,"id":"3aaa91ec_2b5e3912","line":355,"range":{"start_line":355,"start_character":30,"end_line":355,"end_character":34},"updated":"2016-06-28 21:25:32.000000000","message":"Just X-Object-Sysmeta-Crypto-Etag-Mac. Ditto elsewhere in this section.","commit_id":"5ee2a4ae53c122b79b2cfcfbb84c0664093a5ada"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"936305655564904764bd2a3654ed2f3c880a6ac4","unresolved":false,"context_lines":[{"line_number":352,"context_line":"metadata. This is not possible when the ETag stored in object metadata has been"},{"line_number":353,"context_line":"encrypted. The encrypter therefore calculates an HMAC using the object key and"},{"line_number":354,"context_line":"the ETag while handling object PUT requests, and stores this under the metadata"},{"line_number":355,"context_line":"key ``X-Object-Sysmeta-Crypto-Meta-Etag-Mac``::"},{"line_number":356,"context_line":""},{"line_number":357,"context_line":"  X-Object-Sysmeta-Crypto-Meta-Etag-Mac: HMAC(object_key, md5(plaintext))"},{"line_number":358,"context_line":""}],"source_content_type":"text/x-rst","patch_set":11,"id":"3aaa91ec_51d98421","line":355,"range":{"start_line":355,"start_character":30,"end_line":355,"end_character":34},"in_reply_to":"3aaa91ec_2b5e3912","updated":"2016-06-29 17:06:05.000000000","message":"Done","commit_id":"5ee2a4ae53c122b79b2cfcfbb84c0664093a5ada"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"e06b81561f96e2fcab8c7653d139d58b2abe09a3","unresolved":false,"context_lines":[{"line_number":356,"context_line":""},{"line_number":357,"context_line":"  X-Object-Sysmeta-Crypto-Meta-Etag-Mac: HMAC(object_key, md5(plaintext))"},{"line_number":358,"context_line":""},{"line_number":359,"context_line":"Like other ETag related metadata, this is sent after the encrypted object body"},{"line_number":360,"context_line":"using the proxy server\u0027s support for request footers."},{"line_number":361,"context_line":""},{"line_number":362,"context_line":"The encrypter similarly calculates an HMAC for each ETag value included in"}],"source_content_type":"text/x-rst","patch_set":11,"id":"3aaa91ec_ab7fc964","line":359,"range":{"start_line":359,"start_character":11,"end_line":359,"end_character":23},"updated":"2016-06-28 21:25:32.000000000","message":"nit: s/ETag related/ETag-related/","commit_id":"5ee2a4ae53c122b79b2cfcfbb84c0664093a5ada"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"936305655564904764bd2a3654ed2f3c880a6ac4","unresolved":false,"context_lines":[{"line_number":356,"context_line":""},{"line_number":357,"context_line":"  X-Object-Sysmeta-Crypto-Meta-Etag-Mac: HMAC(object_key, md5(plaintext))"},{"line_number":358,"context_line":""},{"line_number":359,"context_line":"Like other ETag related metadata, this is sent after the encrypted object body"},{"line_number":360,"context_line":"using the proxy server\u0027s support for request footers."},{"line_number":361,"context_line":""},{"line_number":362,"context_line":"The encrypter similarly calculates an HMAC for each ETag value included in"}],"source_content_type":"text/x-rst","patch_set":11,"id":"3aaa91ec_912c8c03","line":359,"range":{"start_line":359,"start_character":11,"end_line":359,"end_character":23},"in_reply_to":"3aaa91ec_ab7fc964","updated":"2016-06-29 17:06:05.000000000","message":"Done","commit_id":"5ee2a4ae53c122b79b2cfcfbb84c0664093a5ada"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"e06b81561f96e2fcab8c7653d139d58b2abe09a3","unresolved":false,"context_lines":[{"line_number":385,"context_line":""},{"line_number":386,"context_line":"#. Fetch the object key from the keymaster via its callback"},{"line_number":387,"context_line":"#. Decrypt the ``X-Object-Sysmeta-Crypto-Etag`` value using the object"},{"line_number":388,"context_line":"   key and the IV found in the ``X-Object-Sysmeta-Crypto-Meta-Etag`` header"},{"line_number":389,"context_line":"#. Decrypt metadata header values using the object key"},{"line_number":390,"context_line":"#. Decrypt the wrapped body key found in ``X-Object-Sysmeta-Crypto-Meta``"},{"line_number":391,"context_line":"#. Decrypt the body using the body key"}],"source_content_type":"text/x-rst","patch_set":11,"id":"3aaa91ec_cb41750d","line":388,"range":{"start_line":388,"start_character":33,"end_line":388,"end_character":66},"updated":"2016-06-28 21:25:32.000000000","message":"More details about the now-removed X-Object-Sysmeta-Crypto-Meta-Etag.","commit_id":"5ee2a4ae53c122b79b2cfcfbb84c0664093a5ada"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"936305655564904764bd2a3654ed2f3c880a6ac4","unresolved":false,"context_lines":[{"line_number":385,"context_line":""},{"line_number":386,"context_line":"#. Fetch the object key from the keymaster via its callback"},{"line_number":387,"context_line":"#. Decrypt the ``X-Object-Sysmeta-Crypto-Etag`` value using the object"},{"line_number":388,"context_line":"   key and the IV found in the ``X-Object-Sysmeta-Crypto-Meta-Etag`` header"},{"line_number":389,"context_line":"#. Decrypt metadata header values using the object key"},{"line_number":390,"context_line":"#. Decrypt the wrapped body key found in ``X-Object-Sysmeta-Crypto-Meta``"},{"line_number":391,"context_line":"#. Decrypt the body using the body key"}],"source_content_type":"text/x-rst","patch_set":11,"id":"3aaa91ec_711800d4","line":388,"range":{"start_line":388,"start_character":33,"end_line":388,"end_character":66},"in_reply_to":"3aaa91ec_cb41750d","updated":"2016-06-29 17:06:05.000000000","message":"Done. Removed the stale content but I\u0027d prefer not to add more detail. I like this being a very simple overview.","commit_id":"5ee2a4ae53c122b79b2cfcfbb84c0664093a5ada"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"e06b81561f96e2fcab8c7653d139d58b2abe09a3","unresolved":false,"context_lines":[{"line_number":390,"context_line":"#. Decrypt the wrapped body key found in ``X-Object-Sysmeta-Crypto-Meta``"},{"line_number":391,"context_line":"#. Decrypt the body using the body key"},{"line_number":392,"context_line":""},{"line_number":393,"context_line":"For each GET request to a container that includes a format param, the"},{"line_number":394,"context_line":"decrypter will:"},{"line_number":395,"context_line":""},{"line_number":396,"context_line":"#. GET the container listing"}],"source_content_type":"text/x-rst","patch_set":11,"id":"3aaa91ec_8ba12dac","line":393,"range":{"start_line":393,"start_character":41,"end_line":393,"end_character":64},"updated":"2016-06-28 21:25:32.000000000","message":"Or that includes an `Accept: application/json` or `Accept: application/xml` header. (Right?)\n\nMaybe better as \"that would include object ETags in its output\"?","commit_id":"5ee2a4ae53c122b79b2cfcfbb84c0664093a5ada"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"936305655564904764bd2a3654ed2f3c880a6ac4","unresolved":false,"context_lines":[{"line_number":390,"context_line":"#. Decrypt the wrapped body key found in ``X-Object-Sysmeta-Crypto-Meta``"},{"line_number":391,"context_line":"#. Decrypt the body using the body key"},{"line_number":392,"context_line":""},{"line_number":393,"context_line":"For each GET request to a container that includes a format param, the"},{"line_number":394,"context_line":"decrypter will:"},{"line_number":395,"context_line":""},{"line_number":396,"context_line":"#. GET the container listing"}],"source_content_type":"text/x-rst","patch_set":11,"id":"3aaa91ec_541b3273","line":393,"range":{"start_line":393,"start_character":41,"end_line":393,"end_character":64},"in_reply_to":"3aaa91ec_8ba12dac","updated":"2016-06-29 17:06:05.000000000","message":"Done. I prefer the simpler text.","commit_id":"5ee2a4ae53c122b79b2cfcfbb84c0664093a5ada"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"e06b81561f96e2fcab8c7653d139d58b2abe09a3","unresolved":false,"context_lines":[{"line_number":395,"context_line":""},{"line_number":396,"context_line":"#. GET the container listing"},{"line_number":397,"context_line":"#. Fetch container key from the keymaster via its callback"},{"line_number":398,"context_line":"#. Decrypt the response body ETag entries using the container key"},{"line_number":399,"context_line":""},{"line_number":400,"context_line":""},{"line_number":401,"context_line":"Impact on other Swift services"}],"source_content_type":"text/x-rst","patch_set":11,"id":"3aaa91ec_8b8f6d22","line":398,"updated":"2016-06-28 21:25:32.000000000","message":"Maybe worth noting that the original response may have a mix of encrypted and unencrypted ETags?","commit_id":"5ee2a4ae53c122b79b2cfcfbb84c0664093a5ada"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"936305655564904764bd2a3654ed2f3c880a6ac4","unresolved":false,"context_lines":[{"line_number":395,"context_line":""},{"line_number":396,"context_line":"#. GET the container listing"},{"line_number":397,"context_line":"#. Fetch container key from the keymaster via its callback"},{"line_number":398,"context_line":"#. Decrypt the response body ETag entries using the container key"},{"line_number":399,"context_line":""},{"line_number":400,"context_line":""},{"line_number":401,"context_line":"Impact on other Swift services"}],"source_content_type":"text/x-rst","patch_set":11,"id":"3aaa91ec_d41d6263","line":398,"in_reply_to":"3aaa91ec_8b8f6d22","updated":"2016-06-29 17:06:05.000000000","message":"Done","commit_id":"5ee2a4ae53c122b79b2cfcfbb84c0664093a5ada"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"e06b81561f96e2fcab8c7653d139d58b2abe09a3","unresolved":false,"context_lines":[{"line_number":421,"context_line":"Encryption has no impact on the `container-reconciler` service. The"},{"line_number":422,"context_line":"`container-reconciler` uses an internal client to move objects between"},{"line_number":423,"context_line":"different policy rings. The destination object has the same URL as the source"},{"line_number":424,"context_line":"object and the object is moved without re-encryption."},{"line_number":425,"context_line":""},{"line_number":426,"context_line":""},{"line_number":427,"context_line":"Considerations for developers"}],"source_content_type":"text/x-rst","patch_set":11,"id":"3aaa91ec_6b07a181","line":424,"updated":"2016-06-28 21:25:32.000000000","message":"I remember at one point thinking, \"Maybe it would make sense to have encryption  turned on/off at the storage-policy level.\" This gives a strong argument against that.","commit_id":"5ee2a4ae53c122b79b2cfcfbb84c0664093a5ada"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"936305655564904764bd2a3654ed2f3c880a6ac4","unresolved":false,"context_lines":[{"line_number":421,"context_line":"Encryption has no impact on the `container-reconciler` service. The"},{"line_number":422,"context_line":"`container-reconciler` uses an internal client to move objects between"},{"line_number":423,"context_line":"different policy rings. The destination object has the same URL as the source"},{"line_number":424,"context_line":"object and the object is moved without re-encryption."},{"line_number":425,"context_line":""},{"line_number":426,"context_line":""},{"line_number":427,"context_line":"Considerations for developers"}],"source_content_type":"text/x-rst","patch_set":11,"id":"3aaa91ec_b4437612","line":424,"in_reply_to":"3aaa91ec_6b07a181","updated":"2016-06-29 17:06:05.000000000","message":"Done","commit_id":"5ee2a4ae53c122b79b2cfcfbb84c0664093a5ada"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"e06b81561f96e2fcab8c7653d139d58b2abe09a3","unresolved":false,"context_lines":[{"line_number":424,"context_line":"object and the object is moved without re-encryption."},{"line_number":425,"context_line":""},{"line_number":426,"context_line":""},{"line_number":427,"context_line":"Considerations for developers"},{"line_number":428,"context_line":"-----------------------------"},{"line_number":429,"context_line":""},{"line_number":430,"context_line":"Developers should be aware that encryption middlewares rely on the path of an"}],"source_content_type":"text/x-rst","patch_set":11,"id":"3aaa91ec_2ba9197c","line":427,"range":{"start_line":427,"start_character":19,"end_line":427,"end_character":29},"updated":"2016-06-28 21:25:32.000000000","message":"Middleware developers, or client-application developers?","commit_id":"5ee2a4ae53c122b79b2cfcfbb84c0664093a5ada"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"936305655564904764bd2a3654ed2f3c880a6ac4","unresolved":false,"context_lines":[{"line_number":424,"context_line":"object and the object is moved without re-encryption."},{"line_number":425,"context_line":""},{"line_number":426,"context_line":""},{"line_number":427,"context_line":"Considerations for developers"},{"line_number":428,"context_line":"-----------------------------"},{"line_number":429,"context_line":""},{"line_number":430,"context_line":"Developers should be aware that encryption middlewares rely on the path of an"}],"source_content_type":"text/x-rst","patch_set":11,"id":"3aaa91ec_740bced6","line":427,"range":{"start_line":427,"start_character":19,"end_line":427,"end_character":29},"in_reply_to":"3aaa91ec_2ba9197c","updated":"2016-06-29 17:06:05.000000000","message":"swift developers","commit_id":"5ee2a4ae53c122b79b2cfcfbb84c0664093a5ada"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"e06b81561f96e2fcab8c7653d139d58b2abe09a3","unresolved":false,"context_lines":[{"line_number":429,"context_line":""},{"line_number":430,"context_line":"Developers should be aware that encryption middlewares rely on the path of an"},{"line_number":431,"context_line":"object remaining unchanged. The included keymaster derives keys for containers"},{"line_number":432,"context_line":"and objects based on their paths and the ``encryption_root_secret``. The"},{"line_number":433,"context_line":"encrypter also uses the object path to derive an IV for encrypting the ETag. As"},{"line_number":434,"context_line":"explained above, this choice of IV is made to enable conditional request ETag"},{"line_number":435,"context_line":"values to be encrypted in an identical fashion prior to matching with the"},{"line_number":436,"context_line":"object ETag."},{"line_number":437,"context_line":""},{"line_number":438,"context_line":"Developers should therefore give careful consideration to any new features that"},{"line_number":439,"context_line":"would relocate object data and metadata within a Swift cluster by means that do"}],"source_content_type":"text/x-rst","patch_set":11,"id":"3aaa91ec_8b792dff","line":436,"range":{"start_line":432,"start_character":69,"end_line":436,"end_character":12},"updated":"2016-06-28 21:25:32.000000000","message":"No longer true. (Yay!)","commit_id":"5ee2a4ae53c122b79b2cfcfbb84c0664093a5ada"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"936305655564904764bd2a3654ed2f3c880a6ac4","unresolved":false,"context_lines":[{"line_number":429,"context_line":""},{"line_number":430,"context_line":"Developers should be aware that encryption middlewares rely on the path of an"},{"line_number":431,"context_line":"object remaining unchanged. The included keymaster derives keys for containers"},{"line_number":432,"context_line":"and objects based on their paths and the ``encryption_root_secret``. The"},{"line_number":433,"context_line":"encrypter also uses the object path to derive an IV for encrypting the ETag. As"},{"line_number":434,"context_line":"explained above, this choice of IV is made to enable conditional request ETag"},{"line_number":435,"context_line":"values to be encrypted in an identical fashion prior to matching with the"},{"line_number":436,"context_line":"object ETag."},{"line_number":437,"context_line":""},{"line_number":438,"context_line":"Developers should therefore give careful consideration to any new features that"},{"line_number":439,"context_line":"would relocate object data and metadata within a Swift cluster by means that do"}],"source_content_type":"text/x-rst","patch_set":11,"id":"3aaa91ec_148b6ac4","line":436,"range":{"start_line":432,"start_character":69,"end_line":436,"end_character":12},"in_reply_to":"3aaa91ec_8b792dff","updated":"2016-06-29 17:06:05.000000000","message":"Done","commit_id":"5ee2a4ae53c122b79b2cfcfbb84c0664093a5ada"},{"author":{"_account_id":11330,"name":"Christian Cachin","email":"cca@zurich.ibm.com","username":"cca88"},"change_message_id":"fadc2b2621df22f503e4f06650b6a53e8fb6e957","unresolved":false,"context_lines":[{"line_number":47,"context_line":"    access to disks on which object data is stored."},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"    This feature is not intended to prevent undetectable `modification`"},{"line_number":50,"context_line":"    of user data at rest on disk."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"    This feature is not intended to protect against an attacker that gains"},{"line_number":53,"context_line":"    access to Swift\u0027s internal network connections, or gains access to key"}],"source_content_type":"text/x-rst","patch_set":12,"id":"3aaa91ec_43f09691","line":50,"range":{"start_line":50,"start_character":17,"end_line":50,"end_character":31},"updated":"2016-06-29 18:48:51.000000000","message":"data at rest is always on disk \u003d\u003e either \"at rest\" or \"on disk\"","commit_id":"50fb1666c1b80afe5a6c4ad273408e9ed6ad714e"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"bfa45f680f2c143daadcd2407632d9a75216a67d","unresolved":false,"context_lines":[{"line_number":47,"context_line":"    access to disks on which object data is stored."},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"    This feature is not intended to prevent undetectable `modification`"},{"line_number":50,"context_line":"    of user data at rest on disk."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"    This feature is not intended to protect against an attacker that gains"},{"line_number":53,"context_line":"    access to Swift\u0027s internal network connections, or gains access to key"}],"source_content_type":"text/x-rst","patch_set":12,"id":"3aaa91ec_54f019c9","line":50,"range":{"start_line":50,"start_character":17,"end_line":50,"end_character":31},"in_reply_to":"3aaa91ec_43f09691","updated":"2016-06-30 16:40:53.000000000","message":"Done","commit_id":"50fb1666c1b80afe5a6c4ad273408e9ed6ad714e"},{"author":{"_account_id":11330,"name":"Christian Cachin","email":"cca@zurich.ibm.com","username":"cca88"},"change_message_id":"fadc2b2621df22f503e4f06650b6a53e8fb6e957","unresolved":false,"context_lines":[{"line_number":59,"context_line":"Deployment and operation"},{"line_number":60,"context_line":"------------------------"},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"Encryption at rest is deployed by adding three middleware filters to the proxy"},{"line_number":63,"context_line":"server WSGI pipeline and including their respective filter configuration"},{"line_number":64,"context_line":"sections in the `proxy-server.conf` file. :ref:`Additional steps"},{"line_number":65,"context_line":"\u003ccontainer_sync_client_config\u003e` are required if the container sync feature is"}],"source_content_type":"text/x-rst","patch_set":12,"id":"3aaa91ec_03416ea9","line":62,"range":{"start_line":62,"start_character":0,"end_line":62,"end_character":18},"updated":"2016-06-29 18:48:51.000000000","message":"remove \"at rest\" or say: \"Encryption for data at rest\"","commit_id":"50fb1666c1b80afe5a6c4ad273408e9ed6ad714e"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"bfa45f680f2c143daadcd2407632d9a75216a67d","unresolved":false,"context_lines":[{"line_number":59,"context_line":"Deployment and operation"},{"line_number":60,"context_line":"------------------------"},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"Encryption at rest is deployed by adding three middleware filters to the proxy"},{"line_number":63,"context_line":"server WSGI pipeline and including their respective filter configuration"},{"line_number":64,"context_line":"sections in the `proxy-server.conf` file. :ref:`Additional steps"},{"line_number":65,"context_line":"\u003ccontainer_sync_client_config\u003e` are required if the container sync feature is"}],"source_content_type":"text/x-rst","patch_set":12,"id":"3aaa91ec_d4b24905","line":62,"range":{"start_line":62,"start_character":0,"end_line":62,"end_character":18},"in_reply_to":"3aaa91ec_03416ea9","updated":"2016-06-30 16:40:53.000000000","message":"Done","commit_id":"50fb1666c1b80afe5a6c4ad273408e9ed6ad714e"},{"author":{"_account_id":11330,"name":"Christian Cachin","email":"cca@zurich.ibm.com","username":"cca88"},"change_message_id":"fadc2b2621df22f503e4f06650b6a53e8fb6e957","unresolved":false,"context_lines":[{"line_number":123,"context_line":"When upgrading an existing cluster to deploy encryption, the following sequence"},{"line_number":124,"context_line":"of steps is recommended:"},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"#. Upgrade all object servers"},{"line_number":127,"context_line":"#. Upgrade all proxy servers"},{"line_number":128,"context_line":"#. Add all encryption middlewares to every proxy server\u0027s middleware pipeline"},{"line_number":129,"context_line":"   with the encrypter ``disable_encryption`` option set to ``True`` and the"}],"source_content_type":"text/x-rst","patch_set":12,"id":"3aaa91ec_03ddeedf","line":126,"range":{"start_line":126,"start_character":3,"end_line":126,"end_character":29},"updated":"2016-06-29 18:48:51.000000000","message":"pardon my ignorance, but are the object servers even aware that encryption is deployed? i thought the main idea was the object servers would not notice a difference.","commit_id":"50fb1666c1b80afe5a6c4ad273408e9ed6ad714e"},{"author":{"_account_id":12279,"name":"Janie Richling","email":"jrichli@us.ibm.com","username":"jrichli"},"change_message_id":"294ca1c8950f973815a20b0a74798aeaf9f0d55b","unresolved":false,"context_lines":[{"line_number":123,"context_line":"When upgrading an existing cluster to deploy encryption, the following sequence"},{"line_number":124,"context_line":"of steps is recommended:"},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"#. Upgrade all object servers"},{"line_number":127,"context_line":"#. Upgrade all proxy servers"},{"line_number":128,"context_line":"#. Add all encryption middlewares to every proxy server\u0027s middleware pipeline"},{"line_number":129,"context_line":"   with the encrypter ``disable_encryption`` option set to ``True`` and the"}],"source_content_type":"text/x-rst","patch_set":12,"id":"3aaa91ec_cbb65cf8","line":126,"range":{"start_line":126,"start_character":3,"end_line":126,"end_character":29},"in_reply_to":"3aaa91ec_03ddeedf","updated":"2016-06-29 19:38:06.000000000","message":"New code was added to support the changes.  The code was not implemented in an encryption specific way, however. There was support added to be able to specify http footers (needed for crypto to specify the etag, for example).  Before this, only erasure coded policies could send the etag in a footer.  See https://review.openstack.org/#/c/328204/7","commit_id":"50fb1666c1b80afe5a6c4ad273408e9ed6ad714e"},{"author":{"_account_id":11330,"name":"Christian Cachin","email":"cca@zurich.ibm.com","username":"cca88"},"change_message_id":"fadc2b2621df22f503e4f06650b6a53e8fb6e957","unresolved":false,"context_lines":[{"line_number":187,"context_line":".. note::"},{"line_number":188,"context_line":""},{"line_number":189,"context_line":"    These container sync configuration steps will be necessary for container"},{"line_number":190,"context_line":"    sync probe tests to pass if encryption middleware is included in the proxy"},{"line_number":191,"context_line":"    pipeline of a test cluster."},{"line_number":192,"context_line":""},{"line_number":193,"context_line":"--------------"}],"source_content_type":"text/x-rst","patch_set":12,"id":"3aaa91ec_238e2ad0","line":190,"range":{"start_line":190,"start_character":31,"end_line":190,"end_character":32},"updated":"2016-06-29 18:48:51.000000000","message":"insert: the","commit_id":"50fb1666c1b80afe5a6c4ad273408e9ed6ad714e"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"bfa45f680f2c143daadcd2407632d9a75216a67d","unresolved":false,"context_lines":[{"line_number":187,"context_line":".. note::"},{"line_number":188,"context_line":""},{"line_number":189,"context_line":"    These container sync configuration steps will be necessary for container"},{"line_number":190,"context_line":"    sync probe tests to pass if encryption middleware is included in the proxy"},{"line_number":191,"context_line":"    pipeline of a test cluster."},{"line_number":192,"context_line":""},{"line_number":193,"context_line":"--------------"}],"source_content_type":"text/x-rst","patch_set":12,"id":"3aaa91ec_34990d7a","line":190,"range":{"start_line":190,"start_character":31,"end_line":190,"end_character":32},"in_reply_to":"3aaa91ec_238e2ad0","updated":"2016-06-30 16:40:53.000000000","message":"Done","commit_id":"50fb1666c1b80afe5a6c4ad273408e9ed6ad714e"},{"author":{"_account_id":11330,"name":"Christian Cachin","email":"cca@zurich.ibm.com","username":"cca88"},"change_message_id":"fadc2b2621df22f503e4f06650b6a53e8fb6e957","unresolved":false,"context_lines":[{"line_number":244,"context_line":"that the keymaster installs in the WSGI request environ."},{"line_number":245,"context_line":""},{"line_number":246,"context_line":"The current keymaster implementation derives container and object keys from the"},{"line_number":247,"context_line":"``encryption_root_secret`` in a deterministic way by constructing an SHA256"},{"line_number":248,"context_line":"HMAC using the ``encryption_root_secret`` as a key and the container or object"},{"line_number":249,"context_line":"path as a message, for example::"},{"line_number":250,"context_line":""}],"source_content_type":"text/x-rst","patch_set":12,"id":"3aaa91ec_631e7271","line":247,"range":{"start_line":247,"start_character":66,"end_line":247,"end_character":68},"updated":"2016-06-29 18:48:51.000000000","message":"an -\u003e a  (?)","commit_id":"50fb1666c1b80afe5a6c4ad273408e9ed6ad714e"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"bfa45f680f2c143daadcd2407632d9a75216a67d","unresolved":false,"context_lines":[{"line_number":244,"context_line":"that the keymaster installs in the WSGI request environ."},{"line_number":245,"context_line":""},{"line_number":246,"context_line":"The current keymaster implementation derives container and object keys from the"},{"line_number":247,"context_line":"``encryption_root_secret`` in a deterministic way by constructing an SHA256"},{"line_number":248,"context_line":"HMAC using the ``encryption_root_secret`` as a key and the container or object"},{"line_number":249,"context_line":"path as a message, for example::"},{"line_number":250,"context_line":""}],"source_content_type":"text/x-rst","patch_set":12,"id":"3aaa91ec_f4794530","line":247,"range":{"start_line":247,"start_character":66,"end_line":247,"end_character":68},"in_reply_to":"3aaa91ec_631e7271","updated":"2016-06-30 16:40:53.000000000","message":"Done","commit_id":"50fb1666c1b80afe5a6c4ad273408e9ed6ad714e"},{"author":{"_account_id":11330,"name":"Christian Cachin","email":"cca@zurich.ibm.com","username":"cca88"},"change_message_id":"fadc2b2621df22f503e4f06650b6a53e8fb6e957","unresolved":false,"context_lines":[{"line_number":343,"context_line":"      E(md5(plaintext), container_key, override_etag_iv);"},{"line_number":344,"context_line":"      meta\u003d{\"iv\": override_etag_iv, \"cipher\": \"AES_CTR_256\"}"},{"line_number":345,"context_line":""},{"line_number":346,"context_line":"The container key for is used for this encryption so that the decrypter is able"},{"line_number":347,"context_line":"to decrypt the ETags in container listings when handling a container request,"},{"line_number":348,"context_line":"since object keys may not be available in that context."},{"line_number":349,"context_line":""}],"source_content_type":"text/x-rst","patch_set":12,"id":"3aaa91ec_b5752d99","line":346,"range":{"start_line":346,"start_character":18,"end_line":346,"end_character":21},"updated":"2016-06-29 18:48:51.000000000","message":"remove: for","commit_id":"50fb1666c1b80afe5a6c4ad273408e9ed6ad714e"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"bfa45f680f2c143daadcd2407632d9a75216a67d","unresolved":false,"context_lines":[{"line_number":343,"context_line":"      E(md5(plaintext), container_key, override_etag_iv);"},{"line_number":344,"context_line":"      meta\u003d{\"iv\": override_etag_iv, \"cipher\": \"AES_CTR_256\"}"},{"line_number":345,"context_line":""},{"line_number":346,"context_line":"The container key for is used for this encryption so that the decrypter is able"},{"line_number":347,"context_line":"to decrypt the ETags in container listings when handling a container request,"},{"line_number":348,"context_line":"since object keys may not be available in that context."},{"line_number":349,"context_line":""}],"source_content_type":"text/x-rst","patch_set":12,"id":"3aaa91ec_94060184","line":346,"range":{"start_line":346,"start_character":18,"end_line":346,"end_character":21},"in_reply_to":"3aaa91ec_b5752d99","updated":"2016-06-30 16:40:53.000000000","message":"Done","commit_id":"50fb1666c1b80afe5a6c4ad273408e9ed6ad714e"},{"author":{"_account_id":11330,"name":"Christian Cachin","email":"cca@zurich.ibm.com","username":"cca88"},"change_message_id":"fadc2b2621df22f503e4f06650b6a53e8fb6e957","unresolved":false,"context_lines":[{"line_number":386,"context_line":""},{"line_number":387,"context_line":"  If-Match: match_etag,HMAC(object_key, match_etag)"},{"line_number":388,"context_line":"  X-Backend-Etag-Is-At: X-Object-Sysmeta-Crypto-Etag-Mac"},{"line_number":389,"context_line":""},{"line_number":390,"context_line":"Decrypter operation"},{"line_number":391,"context_line":"-------------------"},{"line_number":392,"context_line":""}],"source_content_type":"text/x-rst","patch_set":12,"id":"3aaa91ec_956471b9","line":389,"range":{"start_line":389,"start_character":0,"end_line":389,"end_character":0},"updated":"2016-06-29 18:48:51.000000000","message":"Maybe we should now explain here why this is done:\n\nThis enables the object server to perform an encrypted comparison to check whether the etags match, without leaking the etag itself or leaking information about the object body.","commit_id":"50fb1666c1b80afe5a6c4ad273408e9ed6ad714e"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"bfa45f680f2c143daadcd2407632d9a75216a67d","unresolved":false,"context_lines":[{"line_number":386,"context_line":""},{"line_number":387,"context_line":"  If-Match: match_etag,HMAC(object_key, match_etag)"},{"line_number":388,"context_line":"  X-Backend-Etag-Is-At: X-Object-Sysmeta-Crypto-Etag-Mac"},{"line_number":389,"context_line":""},{"line_number":390,"context_line":"Decrypter operation"},{"line_number":391,"context_line":"-------------------"},{"line_number":392,"context_line":""}],"source_content_type":"text/x-rst","patch_set":12,"id":"3aaa91ec_74c1d5e3","line":389,"range":{"start_line":389,"start_character":0,"end_line":389,"end_character":0},"in_reply_to":"3aaa91ec_956471b9","updated":"2016-06-30 16:40:53.000000000","message":"nice, thanks.","commit_id":"50fb1666c1b80afe5a6c4ad273408e9ed6ad714e"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"0a6f37082e67ae2d731a916373c017292b1698f9","unresolved":false,"context_lines":[{"line_number":178,"context_line":""},{"line_number":179,"context_line":".. note::"},{"line_number":180,"context_line":""},{"line_number":181,"context_line":"    The ``encryption_root_secret`` value is necessary to recover any encrypted"},{"line_number":182,"context_line":"    data from the storage system, and therefore, it must be guarded against"},{"line_number":183,"context_line":"    accidental loss. Its value (and consequently, the custom internal client"},{"line_number":184,"context_line":"    configuration file) should not be stored on any disk that is in any"},{"line_number":185,"context_line":"    account, container or object ring."},{"line_number":186,"context_line":""}],"source_content_type":"text/x-rst","patch_set":13,"id":"3aaa91ec_4f399fa3","line":183,"range":{"start_line":181,"start_character":41,"end_line":183,"end_character":19},"updated":"2016-06-30 18:21:49.000000000","message":"Might better as \"may be used to recover... guarded against accidental disclosure.\"","commit_id":"5337f44e6ef27e96d4830b7827f50577f7650687"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"0a6f37082e67ae2d731a916373c017292b1698f9","unresolved":false,"context_lines":[{"line_number":345,"context_line":""},{"line_number":346,"context_line":"The container key is used for this encryption so that the decrypter is able"},{"line_number":347,"context_line":"to decrypt the ETags in container listings when handling a container request,"},{"line_number":348,"context_line":"since object keys may not be available in that context."},{"line_number":349,"context_line":""},{"line_number":350,"context_line":"Since the plaintext ETag value is only known once the encrypter has completed"},{"line_number":351,"context_line":"processing the entire object body, the ``X-Object-Sysmeta-Crypto-Etag`` and"}],"source_content_type":"text/x-rst","patch_set":13,"id":"3aaa91ec_6fff3b66","line":348,"updated":"2016-06-30 18:21:49.000000000","message":"I was also trying to keep this from running on too long...","commit_id":"5337f44e6ef27e96d4830b7827f50577f7650687"},{"author":{"_account_id":4608,"name":"Kota Tsuyuzaki","email":"bloodeagle40234@gmail.com","username":"tsuyuzaki-kota"},"change_message_id":"d8fe0f1e37d3d6c6fdcee11eedcadffa5786bf1f","unresolved":false,"context_lines":[{"line_number":176,"context_line":""},{"line_number":177,"context_line":"    The ``encryption_root_secret`` value is necessary to recover any encrypted"},{"line_number":178,"context_line":"    data from the storage system, and therefore, it must be guarded against"},{"line_number":179,"context_line":"    accidental loss. Its value (and consequently, the custom internal client"},{"line_number":180,"context_line":"    configuration file) should not be stored on any disk that is in any"},{"line_number":181,"context_line":"    account, container or object ring."},{"line_number":182,"context_line":""}],"source_content_type":"text/x-rst","patch_set":15,"id":"3aaa91ec_c7f56451","line":179,"updated":"2016-07-01 04:56:54.000000000","message":"nits) And once deployed and any object stored, encryption_root_secret should not be changed until re-keying feature (or its backward compatibility) supported, right?","commit_id":"f22d753a1b454a8f7a3f674da93888c9ec391a69"}],"etc/proxy-server.conf-sample":[{"author":{"_account_id":4608,"name":"Kota Tsuyuzaki","email":"bloodeagle40234@gmail.com","username":"tsuyuzaki-kota"},"change_message_id":"e6542dd24a4be4be3a066c95b8c7030cb485c073","unresolved":false,"context_lines":[{"line_number":79,"context_line":"[pipeline:main]"},{"line_number":80,"context_line":"# This sample pipeline uses tempauth and is used for SAIO dev work and"},{"line_number":81,"context_line":"# testing. See below for a pipeline using keystone."},{"line_number":82,"context_line":"pipeline \u003d catch_errors gatekeeper healthcheck proxy-logging cache container_sync bulk tempurl ratelimit tempauth copy container-quotas account-quotas slo dlo versioned_writes proxy-logging proxy-server"},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"# The following pipeline shows keystone integration. Comment out the one"},{"line_number":85,"context_line":"# above and uncomment this one. Additional steps for integrating keystone are"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"7aa08908_39c2e834","line":82,"updated":"2016-06-13 07:24:49.000000000","message":"Well... IMHO, it might be better to keep those encryption components in the pipeline and set encrypter\u0027s disable_encryption as True rather than removing them from pipline example.\n\nThat is because the middleware location place will be probably significant (from my experience) in proxy pipeline and (I\u0027m not sure yet) the encryption stuffs should be later than versioned_writes and prior to proxy-server, right?\n\nIf we remove them here, the docs exists only in the overview_encryption.rst and it says:\n\n ... decrypter keymaster encrypter proxy-logging proxy-server\n\nPerhaps some operators make a mistake to place them more left position than where we are expecting.\n\nOr, is adding pipline example in keymaster section better with keeping current docs (i.e. removing encryption components from pipeline) if someone who doesn\u0027t use encryption concerns the key-checking overheads?","commit_id":"c5cb86b66acdb6f9b66a53aba60c95144db9a9dd"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"01aa2f74fdef16029eababc51ccbd3838b414391","unresolved":false,"context_lines":[{"line_number":79,"context_line":"[pipeline:main]"},{"line_number":80,"context_line":"# This sample pipeline uses tempauth and is used for SAIO dev work and"},{"line_number":81,"context_line":"# testing. See below for a pipeline using keystone."},{"line_number":82,"context_line":"pipeline \u003d catch_errors gatekeeper healthcheck proxy-logging cache container_sync bulk tempurl ratelimit tempauth copy container-quotas account-quotas slo dlo versioned_writes proxy-logging proxy-server"},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"# The following pipeline shows keystone integration. Comment out the one"},{"line_number":85,"context_line":"# above and uncomment this one. Additional steps for integrating keystone are"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"7aa08908_a977db06","line":82,"in_reply_to":"7aa08908_39c2e834","updated":"2016-06-16 17:00:53.000000000","message":"Problem is that if we leave the encryption middleware in the pipeline then we must have a sample encryption_root_secret for the keymaster, and we wanted to avoid that (the fear is that epople would run their production system with the sample root secret!).\n\nAs it is, the keymaster raises an exception if it has not been configured with a root secret. We could have the keymaster simply not function if it has no root secret i.e. effectively disable encryption and print a warning, but then the risk is that ops think they have crypto but in fact don\u0027t if they forget to set the config option.\n\nCan we discuss this some more and get more opinions on the \"right thing\"?\n\nI will make sure the docs emphasize the position in the pipeline.","commit_id":"c5cb86b66acdb6f9b66a53aba60c95144db9a9dd"},{"author":{"_account_id":4608,"name":"Kota Tsuyuzaki","email":"bloodeagle40234@gmail.com","username":"tsuyuzaki-kota"},"change_message_id":"e6542dd24a4be4be3a066c95b8c7030cb485c073","unresolved":false,"context_lines":[{"line_number":782,"context_line":"# be obtained by base-64 encoding a 32 byte (or longer) value generated by a"},{"line_number":783,"context_line":"# cryptographically secure random number generator. Changing the root secret is"},{"line_number":784,"context_line":"# likely to result in data loss."},{"line_number":785,"context_line":"# encryption_root_secret \u003d"},{"line_number":786,"context_line":"[filter:encrypter]"},{"line_number":787,"context_line":"use \u003d egg:swift#encrypter"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"7aa08908_797ab0f2","line":785,"updated":"2016-06-13 07:24:49.000000000","message":"Hopefully, the required variable should not be commented out, IMHO. Can we set the variable as \u0027changeme\u0027 to let operators know it\u0027s not recommended value like swift_hash_path_suffix in swift.conf-example?","commit_id":"c5cb86b66acdb6f9b66a53aba60c95144db9a9dd"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"01aa2f74fdef16029eababc51ccbd3838b414391","unresolved":false,"context_lines":[{"line_number":782,"context_line":"# be obtained by base-64 encoding a 32 byte (or longer) value generated by a"},{"line_number":783,"context_line":"# cryptographically secure random number generator. Changing the root secret is"},{"line_number":784,"context_line":"# likely to result in data loss."},{"line_number":785,"context_line":"# encryption_root_secret \u003d"},{"line_number":786,"context_line":"[filter:encrypter]"},{"line_number":787,"context_line":"use \u003d egg:swift#encrypter"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"7aa08908_c9e98781","line":785,"in_reply_to":"7aa08908_797ab0f2","updated":"2016-06-16 17:00:53.000000000","message":"If we uncomment and set a sample secret then it has to be a *valid* secret which means it could end up being used in production. I\u0027m not sure what the risk is of not changing hash_[path_suffix/prefix, but not changing the root secret is too big a risk IMO.","commit_id":"c5cb86b66acdb6f9b66a53aba60c95144db9a9dd"},{"author":{"_account_id":4608,"name":"Kota Tsuyuzaki","email":"bloodeagle40234@gmail.com","username":"tsuyuzaki-kota"},"change_message_id":"e6542dd24a4be4be3a066c95b8c7030cb485c073","unresolved":false,"context_lines":[{"line_number":784,"context_line":"# likely to result in data loss."},{"line_number":785,"context_line":"# encryption_root_secret \u003d"},{"line_number":786,"context_line":"[filter:encrypter]"},{"line_number":787,"context_line":"use \u003d egg:swift#encrypter"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"7aa08908_f9fa20bc","line":787,"updated":"2016-06-13 07:24:49.000000000","message":"Please add an option for \"disable_encryption\"","commit_id":"c5cb86b66acdb6f9b66a53aba60c95144db9a9dd"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"01aa2f74fdef16029eababc51ccbd3838b414391","unresolved":false,"context_lines":[{"line_number":784,"context_line":"# likely to result in data loss."},{"line_number":785,"context_line":"# encryption_root_secret \u003d"},{"line_number":786,"context_line":"[filter:encrypter]"},{"line_number":787,"context_line":"use \u003d egg:swift#encrypter"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"7aa08908_7b2e5a8d","line":787,"in_reply_to":"7aa08908_f9fa20bc","updated":"2016-06-16 17:00:53.000000000","message":"Done","commit_id":"c5cb86b66acdb6f9b66a53aba60c95144db9a9dd"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"d40eff72ff042ca083b256f3a166acc5285c1285","unresolved":false,"context_lines":[{"line_number":79,"context_line":"[pipeline:main]"},{"line_number":80,"context_line":"# This sample pipeline uses tempauth and is used for SAIO dev work and"},{"line_number":81,"context_line":"# testing. See below for a pipeline using keystone."},{"line_number":82,"context_line":"pipeline \u003d catch_errors gatekeeper healthcheck proxy-logging cache container_sync bulk tempurl ratelimit tempauth copy container-quotas account-quotas slo dlo versioned_writes proxy-logging proxy-server"},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"# The following pipeline shows keystone integration. Comment out the one"},{"line_number":85,"context_line":"# above and uncomment this one. Additional steps for integrating keystone are"}],"source_content_type":"application/octet-stream","patch_set":10,"id":"3aaa91ec_68b52e7d","line":82,"updated":"2016-06-27 19:06:27.000000000","message":"Related to Kota\u0027s comment on patchset 1: what about just removing the keymaster middleware? Neither encrypter nor decrypter would get keys, effectively no-oping them, right? And we (should) just have to specify that the keymaster goes between decrypter and encrypter.","commit_id":"2e9007613c609de7a918f2c7a96060876485eaad"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"4e5cb9a3be89849d8d915d406fb090fdd10a062b","unresolved":false,"context_lines":[{"line_number":79,"context_line":"[pipeline:main]"},{"line_number":80,"context_line":"# This sample pipeline uses tempauth and is used for SAIO dev work and"},{"line_number":81,"context_line":"# testing. See below for a pipeline using keystone."},{"line_number":82,"context_line":"pipeline \u003d catch_errors gatekeeper healthcheck proxy-logging cache container_sync bulk tempurl ratelimit tempauth copy container-quotas account-quotas slo dlo versioned_writes proxy-logging proxy-server"},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"# The following pipeline shows keystone integration. Comment out the one"},{"line_number":85,"context_line":"# above and uncomment this one. Additional steps for integrating keystone are"}],"source_content_type":"application/octet-stream","patch_set":10,"id":"3aaa91ec_aab991ee","line":82,"in_reply_to":"3aaa91ec_68b52e7d","updated":"2016-06-28 17:00:33.000000000","message":"Things break without a keymaster. Not saying that\u0027s good, but it does preclude what you suggest without more work. And I am not sure I see the gain - an op still needs to insert a keymaster. In fact, I think it is worse - an op could be left thinking they have encryption when in fact it is a no-op middleware.","commit_id":"2e9007613c609de7a918f2c7a96060876485eaad"},{"author":{"_account_id":330,"name":"John Dickinson","email":"me@not.mn","username":"notmyname"},"change_message_id":"1065e2df04a9f5415512003642ac38da2c6200e2","unresolved":false,"context_lines":[{"line_number":784,"context_line":"# be obtained by base-64 encoding a 32 byte (or longer) value generated by a"},{"line_number":785,"context_line":"# cryptographically secure random number generator. Changing the root secret is"},{"line_number":786,"context_line":"# likely to result in data loss."},{"line_number":787,"context_line":"# encryption_root_secret \u003d"},{"line_number":788,"context_line":""},{"line_number":789,"context_line":"[filter:encrypter]"},{"line_number":790,"context_line":"use \u003d egg:swift#encrypter"}],"source_content_type":"application/octet-stream","patch_set":12,"id":"3aaa91ec_e394228c","line":787,"updated":"2016-06-29 18:23:00.000000000","message":"Since our pattern so far is to have optional setting commented out (with the default value shown) and to have required values uncommented (eg see bind_ip and bind_port at the top), then I\u0027d recommend uncommenting this line. Since we want people to actually set this to something good, then setting the value to \"changeme\" will cause an error and force the operator to explicitly chose a better value. This will get us what we want for a good secret and allows us to keep to our sample config file pattern.\n\nSo the new line would be:\nencryption_root_secret \u003d changeme","commit_id":"50fb1666c1b80afe5a6c4ad273408e9ed6ad714e"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"bfa45f680f2c143daadcd2407632d9a75216a67d","unresolved":false,"context_lines":[{"line_number":784,"context_line":"# be obtained by base-64 encoding a 32 byte (or longer) value generated by a"},{"line_number":785,"context_line":"# cryptographically secure random number generator. Changing the root secret is"},{"line_number":786,"context_line":"# likely to result in data loss."},{"line_number":787,"context_line":"# encryption_root_secret \u003d"},{"line_number":788,"context_line":""},{"line_number":789,"context_line":"[filter:encrypter]"},{"line_number":790,"context_line":"use \u003d egg:swift#encrypter"}],"source_content_type":"application/octet-stream","patch_set":12,"id":"3aaa91ec_4f452641","line":787,"in_reply_to":"3aaa91ec_e394228c","updated":"2016-06-30 16:40:53.000000000","message":"Done","commit_id":"50fb1666c1b80afe5a6c4ad273408e9ed6ad714e"}]}