)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"3ff02ed8aa08e91ce8b33f93921630c4df4457cb","unresolved":false,"context_lines":[{"line_number":4,"context_line":"Commit:     Emilien Macchi \u003cemilien@redhat.com\u003e"},{"line_number":5,"context_line":"CommitDate: 2017-03-21 22:28:23 -0400"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"specs/pike: propose a solution for keystone fernet tokens rotation"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Propose a solution to perform Keystone Fernet tokens rotation in a way"},{"line_number":10,"context_line":"that scales and is secure."}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"1a1ced50_5ea4d9b8","line":7,"updated":"2017-03-22 12:53:25.000000000","message":"It\u0027s specifically Fernet *keys* that require rotation, not tokens.","commit_id":"48317ba3337d7c1ac7482c7d07906c1ee79aeb31"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"3ff02ed8aa08e91ce8b33f93921630c4df4457cb","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"specs/pike: propose a solution for keystone fernet tokens rotation"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Propose a solution to perform Keystone Fernet tokens rotation in a way"},{"line_number":10,"context_line":"that scales and is secure."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"Change-Id: I845ed58bc2bd63b1c129c54cea71b9a7e2b27b98"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"1a1ced50_7ea7d5bc","line":9,"updated":"2017-03-22 12:53:25.000000000","message":"Same.","commit_id":"48317ba3337d7c1ac7482c7d07906c1ee79aeb31"}],"specs/pike/keystone_fernet_rotation.rst":[{"author":{"_account_id":17068,"name":"Jean-Philippe Evrard","email":"openstack@a.spamming.party","username":"evrardjp"},"change_message_id":"62098fcbba83c8fd5e21772f9e31311fb292a3d4","unresolved":false,"context_lines":[{"line_number":56,"context_line":"push them to an etcd database. Each Fernet key would be a single key in etcd"},{"line_number":57,"context_line":"with its own value."},{"line_number":58,"context_line":"It would be achieved by a tool that would use `keystone-manage fernet_rotate`"},{"line_number":59,"context_line":"and push the results into etcd."},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"Keystone nodes or containers would run a script called `fernet-watch` that"},{"line_number":62,"context_line":"would constently query etcd to get the Fernet keys content and write them"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a1ff146_efee4eeb","line":59,"range":{"start_line":59,"start_character":26,"end_line":59,"end_character":30},"updated":"2017-03-15 10:22:19.000000000","message":"I\u0027m not really familiar with tripleO, and how you can push design decisions. But if this spec has a scope outside tripleO, maybe we should be more modular, and not force an implementation detail to keystone devs.\n\nWhile I like the etcd idea, I could see it working with any key-value store, and memcached is already known by keystone developers, IIRC.\n\nIn other words, what I mean is \"Yes, etcd seems nice\" but if we can\u0027t enforce the technical solution to deployers, I\u0027d prefer to avoid the war \"etcd is nice but I prefer consul/x/y and/or I already have x/y/z\". \n\nI don\u0027t see what\u0027s wrong by being flexible in the wording here. I also realise that just saying \"key-value\" store doesn\u0027t really *solve* anything for you, so you\u0027re maybe right to define a technology, this way we can go forward and be more modular later.","commit_id":"09695ffeec6545b350fb7f6a8c9939b1ffba6f27"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"b22f3bba1dfd07c4457b891a54b65dab0d8b17c1","unresolved":false,"context_lines":[{"line_number":56,"context_line":"push them to an etcd database. Each Fernet key would be a single key in etcd"},{"line_number":57,"context_line":"with its own value."},{"line_number":58,"context_line":"It would be achieved by a tool that would use `keystone-manage fernet_rotate`"},{"line_number":59,"context_line":"and push the results into etcd."},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"Keystone nodes or containers would run a script called `fernet-watch` that"},{"line_number":62,"context_line":"would constently query etcd to get the Fernet keys content and write them"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a1ff146_74f869e6","line":59,"range":{"start_line":59,"start_character":26,"end_line":59,"end_character":30},"in_reply_to":"3a1ff146_efee4eeb","updated":"2017-03-15 13:23:54.000000000","message":"this makes sense, how about something on the lines of \"key-value store with strong security features (e.g. etcd)\"\n\nHowever, I\u0027m not familiar with etcd, I just know the \"security\" part of the storage solution is fundamental.","commit_id":"09695ffeec6545b350fb7f6a8c9939b1ffba6f27"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"0ea7d9ae7ff26a8abc8e0cbcdc612367c13207b6","unresolved":false,"context_lines":[{"line_number":62,"context_line":"would constently query etcd to get the Fernet keys content and write them"},{"line_number":63,"context_line":"into the /etc/keystone/fernet-keys directory."},{"line_number":64,"context_line":"The staged key would be promoted as a primary key only when we\u0027re sure that"},{"line_number":65,"context_line":"all nodes are in sync, by using some etcd queries."},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"In the long-term, it would be great to implement a new feature in Keystone"},{"line_number":68,"context_line":"which would allow the token provider to query an external database (etcd"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a1ff146_d6dce21a","line":65,"updated":"2017-03-14 20:47:48.000000000","message":"This step might not be necessary with a little development orchestration with the keystone team. If we ended up writing a backend for keystone to support putting fernet keys into etcd, there shouldn\u0027t be a need for a `fernet-watch` script. In a world where fernet keys are stored in etcd, once the rotation happens, all keys should be available to all keystone nodes that are looking at etcd for fernet keys - so the key distribution pieces shouldn\u0027t be necessary (which seems like it makes things a bit easier).","commit_id":"09695ffeec6545b350fb7f6a8c9939b1ffba6f27"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"0ea7d9ae7ff26a8abc8e0cbcdc612367c13207b6","unresolved":false,"context_lines":[{"line_number":67,"context_line":"In the long-term, it would be great to implement a new feature in Keystone"},{"line_number":68,"context_line":"which would allow the token provider to query an external database (etcd"},{"line_number":69,"context_line":"for example) instead of reading the keys from the filesystem like it is"},{"line_number":70,"context_line":"right now."},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"Alternatives"},{"line_number":73,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a1ff146_56d1d2fa","line":70,"updated":"2017-03-14 20:47:48.000000000","message":"Aha! You\u0027re already two steps ahead of me :)","commit_id":"09695ffeec6545b350fb7f6a8c9939b1ffba6f27"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"b22f3bba1dfd07c4457b891a54b65dab0d8b17c1","unresolved":false,"context_lines":[{"line_number":67,"context_line":"In the long-term, it would be great to implement a new feature in Keystone"},{"line_number":68,"context_line":"which would allow the token provider to query an external database (etcd"},{"line_number":69,"context_line":"for example) instead of reading the keys from the filesystem like it is"},{"line_number":70,"context_line":"right now."},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"Alternatives"},{"line_number":73,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a1ff146_74b949e9","line":70,"in_reply_to":"3a1ff146_2f306656","updated":"2017-03-15 13:23:54.000000000","message":"++\n\nwe can try to sync here and deliver a solution together :)","commit_id":"09695ffeec6545b350fb7f6a8c9939b1ffba6f27"},{"author":{"_account_id":17068,"name":"Jean-Philippe Evrard","email":"openstack@a.spamming.party","username":"evrardjp"},"change_message_id":"62098fcbba83c8fd5e21772f9e31311fb292a3d4","unresolved":false,"context_lines":[{"line_number":67,"context_line":"In the long-term, it would be great to implement a new feature in Keystone"},{"line_number":68,"context_line":"which would allow the token provider to query an external database (etcd"},{"line_number":69,"context_line":"for example) instead of reading the keys from the filesystem like it is"},{"line_number":70,"context_line":"right now."},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"Alternatives"},{"line_number":73,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a1ff146_2f306656","line":70,"in_reply_to":"3a1ff146_56d1d2fa","updated":"2017-03-15 10:22:19.000000000","message":"hehe.\n\nThe long term goal is setting a nice precedent, IMO. It looks like we could even have consensus (pun intended).","commit_id":"09695ffeec6545b350fb7f6a8c9939b1ffba6f27"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"27d650383a133404dbdf999aae970adcf2b7da79","unresolved":false,"context_lines":[{"line_number":69,"context_line":"for example) instead of reading the keys from the filesystem like it is"},{"line_number":70,"context_line":"right now."},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"Alternatives"},{"line_number":73,"context_line":"------------"},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"The first proposal is about doing Fernet keys rotation without servvers."}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a1ff146_bf9ae0c3","line":72,"updated":"2017-03-14 17:46:30.000000000","message":"An alternative which we use in OSA is to setup a regularly running a cron job which rotates and distributes the keys from a known source server. It\u0027s pretty low tech and works.\n\nFor reference:\nhttps://github.com/openstack/openstack-ansible-os_keystone/blob/master/tasks/keystone_credential_autorotate.yml\nhttps://github.com/openstack/openstack-ansible-os_keystone/blob/master/templates/keystone-credential-rotate.sh.j2\n\nWe have similar task lists and scripts for the fernet key rotation.","commit_id":"09695ffeec6545b350fb7f6a8c9939b1ffba6f27"},{"author":{"_account_id":17068,"name":"Jean-Philippe Evrard","email":"openstack@a.spamming.party","username":"evrardjp"},"change_message_id":"62098fcbba83c8fd5e21772f9e31311fb292a3d4","unresolved":false,"context_lines":[{"line_number":69,"context_line":"for example) instead of reading the keys from the filesystem like it is"},{"line_number":70,"context_line":"right now."},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"Alternatives"},{"line_number":73,"context_line":"------------"},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"The first proposal is about doing Fernet keys rotation without servvers."}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a1ff146_6f5fbe72","line":72,"in_reply_to":"3a1ff146_5f3c8c2f","updated":"2017-03-15 10:22:19.000000000","message":"Two different alternatives based on the same technology (cron), one with central server and distribution, the other generating in place.\n\nFor the sake of completeness, we could think of a third kind of distribution, based on some kind of torrenting/DHT to avoid the central part. Definitely higher tech than cron, but scales better when having many servers (which I doubt we have in this case, so I\u0027m not sure it\u0027s worth the hassle).","commit_id":"09695ffeec6545b350fb7f6a8c9939b1ffba6f27"},{"author":{"_account_id":3153,"name":"Emilien Macchi","email":"emilien@redhat.com","username":"emilienm"},"change_message_id":"880aafc94d29423f2e729af8e5491426699013f1","unresolved":false,"context_lines":[{"line_number":69,"context_line":"for example) instead of reading the keys from the filesystem like it is"},{"line_number":70,"context_line":"right now."},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"Alternatives"},{"line_number":73,"context_line":"------------"},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"The first proposal is about doing Fernet keys rotation without servvers."}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a1ff146_bfb580d1","line":72,"in_reply_to":"3a1ff146_bf9ae0c3","updated":"2017-03-14 17:54:29.000000000","message":"I think what OSA is doing is very related to what I propose as an alternative, isn\u0027t?","commit_id":"09695ffeec6545b350fb7f6a8c9939b1ffba6f27"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"09bed2c77bdd3ea8b197752f3b8d18fd6b4b09e7","unresolved":false,"context_lines":[{"line_number":69,"context_line":"for example) instead of reading the keys from the filesystem like it is"},{"line_number":70,"context_line":"right now."},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"Alternatives"},{"line_number":73,"context_line":"------------"},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"The first proposal is about doing Fernet keys rotation without servvers."}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a1ff146_5f3c8c2f","line":72,"in_reply_to":"3a1ff146_bfb580d1","updated":"2017-03-14 17:58:20.000000000","message":"We do a generate and push, whereas you\u0027re proposing generating from the same seed at each node. I think that\u0027s quite different.","commit_id":"09695ffeec6545b350fb7f6a8c9939b1ffba6f27"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"0ea7d9ae7ff26a8abc8e0cbcdc612367c13207b6","unresolved":false,"context_lines":[{"line_number":75,"context_line":"The first proposal is about doing Fernet keys rotation without servvers."},{"line_number":76,"context_line":"Each Keystone node (server or container) would have one crontab per Key and"},{"line_number":77,"context_line":"run a script that would perform the key rotation."},{"line_number":78,"context_line":"The script would generate predictable keys so we wouldn\u0027t need to generate a"},{"line_number":79,"context_line":"key from a central server and push it to the other nodes."},{"line_number":80,"context_line":"The algorithm would be smart enough to generate the same secure key across"},{"line_number":81,"context_line":"all nodes where Keystone is running. Because we use time synchronization,"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a1ff146_363a9637","line":78,"updated":"2017-03-14 20:47:48.000000000","message":"Does that fact it\u0027s predictable mean that it\u0027s open to more attack vectors? Would this require each keystone node to have the same seed?","commit_id":"09695ffeec6545b350fb7f6a8c9939b1ffba6f27"},{"author":{"_account_id":3153,"name":"Emilien Macchi","email":"emilien@redhat.com","username":"emilienm"},"change_message_id":"76b04df3d7053a3da3c21cacd5d1d9bb532f24d7","unresolved":false,"context_lines":[{"line_number":75,"context_line":"The first proposal is about doing Fernet keys rotation without servvers."},{"line_number":76,"context_line":"Each Keystone node (server or container) would have one crontab per Key and"},{"line_number":77,"context_line":"run a script that would perform the key rotation."},{"line_number":78,"context_line":"The script would generate predictable keys so we wouldn\u0027t need to generate a"},{"line_number":79,"context_line":"key from a central server and push it to the other nodes."},{"line_number":80,"context_line":"The algorithm would be smart enough to generate the same secure key across"},{"line_number":81,"context_line":"all nodes where Keystone is running. Because we use time synchronization,"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a1ff146_bbc0fb2b","line":78,"in_reply_to":"3a1ff146_363a9637","updated":"2017-03-15 20:14:51.000000000","message":"that\u0027s why I would hate to predict the keys... It expose attackers to find out the key at some point.","commit_id":"09695ffeec6545b350fb7f6a8c9939b1ffba6f27"},{"author":{"_account_id":17068,"name":"Jean-Philippe Evrard","email":"openstack@a.spamming.party","username":"evrardjp"},"change_message_id":"62098fcbba83c8fd5e21772f9e31311fb292a3d4","unresolved":false,"context_lines":[{"line_number":99,"context_line":"  token management system. It will reduce the chance for attackers to"},{"line_number":100,"context_line":"  decrypt tokens sent over the network when intercepted."},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"* Storing the keys in etcd will require some advanced configuration"},{"line_number":103,"context_line":"  to make etcd working with TLS. It should not be a problem because"},{"line_number":104,"context_line":"  etcd supports automatic TLS as well as authentication through client"},{"line_number":105,"context_line":"  certificates for both clients to server as well as peer"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a1ff146_afad3633","line":102,"updated":"2017-03-15 10:22:19.000000000","message":"\"We should ensure the tokens are \u0027secure in transit\u0027 when implementing/using a K/V store. i.e: Storing the keys in etcd (..)\"","commit_id":"09695ffeec6545b350fb7f6a8c9939b1ffba6f27"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"b22f3bba1dfd07c4457b891a54b65dab0d8b17c1","unresolved":false,"context_lines":[{"line_number":99,"context_line":"  token management system. It will reduce the chance for attackers to"},{"line_number":100,"context_line":"  decrypt tokens sent over the network when intercepted."},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"* Storing the keys in etcd will require some advanced configuration"},{"line_number":103,"context_line":"  to make etcd working with TLS. It should not be a problem because"},{"line_number":104,"context_line":"  etcd supports automatic TLS as well as authentication through client"},{"line_number":105,"context_line":"  certificates for both clients to server as well as peer"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a1ff146_dd87810d","line":102,"in_reply_to":"3a1ff146_afad3633","updated":"2017-03-15 13:23:54.000000000","message":"++","commit_id":"09695ffeec6545b350fb7f6a8c9939b1ffba6f27"},{"author":{"_account_id":3153,"name":"Emilien Macchi","email":"emilien@redhat.com","username":"emilienm"},"change_message_id":"76b04df3d7053a3da3c21cacd5d1d9bb532f24d7","unresolved":false,"context_lines":[{"line_number":99,"context_line":"  token management system. It will reduce the chance for attackers to"},{"line_number":100,"context_line":"  decrypt tokens sent over the network when intercepted."},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"* Storing the keys in etcd will require some advanced configuration"},{"line_number":103,"context_line":"  to make etcd working with TLS. It should not be a problem because"},{"line_number":104,"context_line":"  etcd supports automatic TLS as well as authentication through client"},{"line_number":105,"context_line":"  certificates for both clients to server as well as peer"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a1ff146_fbe0b3ce","line":102,"in_reply_to":"3a1ff146_afad3633","updated":"2017-03-15 20:14:51.000000000","message":"I can change it, thanks.","commit_id":"09695ffeec6545b350fb7f6a8c9939b1ffba6f27"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"0ea7d9ae7ff26a8abc8e0cbcdc612367c13207b6","unresolved":false,"context_lines":[{"line_number":121,"context_line":"done the get/put actions to manage keys, and also the replications between"},{"line_number":122,"context_line":"etcd servers."},{"line_number":123,"context_line":"Since etcd has been designed to scale, we should not notify performance"},{"line_number":124,"context_line":"changes but it is something that we\u0027ll have to measure."},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"Deployer Impact"},{"line_number":127,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a1ff146_9677ca01","line":124,"updated":"2017-03-14 20:47:48.000000000","message":"I\u0027m super curious to see what this would do in today\u0027s deployments.","commit_id":"09695ffeec6545b350fb7f6a8c9939b1ffba6f27"},{"author":{"_account_id":17068,"name":"Jean-Philippe Evrard","email":"openstack@a.spamming.party","username":"evrardjp"},"change_message_id":"62098fcbba83c8fd5e21772f9e31311fb292a3d4","unresolved":false,"context_lines":[{"line_number":181,"context_line":"Since we\u0027re switched TripleO to use Fernet keys as a default token provider,"},{"line_number":182,"context_line":"the feature would be tested when rotation will be enabled."},{"line_number":183,"context_line":"Also, ovb-ha job will be useful to test if distribution actually works, since"},{"line_number":184,"context_line":"it deploys 3 instances of Keystone."},{"line_number":185,"context_line":""},{"line_number":186,"context_line":"Documentation Impact"},{"line_number":187,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a1ff146_72cfa1b0","line":184,"updated":"2017-03-15 10:22:19.000000000","message":"Do you have more details there?\n\nI think it\u0027s an interesting point and definitely useful for others deploy projects.","commit_id":"09695ffeec6545b350fb7f6a8c9939b1ffba6f27"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"3ff02ed8aa08e91ce8b33f93921630c4df4457cb","unresolved":false,"context_lines":[{"line_number":44,"context_line":"  distribute the keys to all Keystone instances."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"The first implementation isn\u0027t secure enough because an attacker could break"},{"line_number":47,"context_line":"the AES256 key and the SHA256 HMAC to get decrypt Keystone tokens."},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"Proposed Change"},{"line_number":50,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a1ced50_9e98116c","line":47,"updated":"2017-03-22 12:53:25.000000000","message":"The ability to decrypt tokens is hardly useful on it\u0027s own. More importantly, if an attacker compromises the entirety of a trusted Fernet key, then they can then generate their own, arbitrary trusted tokens. The entire cloud would likely be compromised at that point.","commit_id":"48317ba3337d7c1ac7482c7d07906c1ee79aeb31"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"3ff02ed8aa08e91ce8b33f93921630c4df4457cb","unresolved":false,"context_lines":[{"line_number":67,"context_line":"In the long-term, it would be great to implement a new feature in Keystone"},{"line_number":68,"context_line":"which would allow the token provider to query an external database (etcd"},{"line_number":69,"context_line":"for example) instead of reading the keys from the filesystem like it is"},{"line_number":70,"context_line":"right now."},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"Alternatives"},{"line_number":73,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a1ced50_5e2e99fb","line":70,"updated":"2017-03-22 12:53:25.000000000","message":"(this last paragraph sounds like a spec for keystone, not for tripleo!)","commit_id":"48317ba3337d7c1ac7482c7d07906c1ee79aeb31"},{"author":{"_account_id":3153,"name":"Emilien Macchi","email":"emilien@redhat.com","username":"emilienm"},"change_message_id":"10a32a35acda36cf7f956a8a674f2b20539901d6","unresolved":false,"context_lines":[{"line_number":67,"context_line":"In the long-term, it would be great to implement a new feature in Keystone"},{"line_number":68,"context_line":"which would allow the token provider to query an external database (etcd"},{"line_number":69,"context_line":"for example) instead of reading the keys from the filesystem like it is"},{"line_number":70,"context_line":"right now."},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"Alternatives"},{"line_number":73,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a1ced50_4a85dc57","line":70,"in_reply_to":"1a1ced50_5e2e99fb","updated":"2017-03-22 21:34:10.000000000","message":"yes exactly, that\u0027s why I don\u0027t like this spec and I really want to trash it.\n\nI wrote it to demonstrate that it doesn\u0027t make sense to solve this problem in TripleO and we should rather do it in Keystone.","commit_id":"48317ba3337d7c1ac7482c7d07906c1ee79aeb31"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"3ff02ed8aa08e91ce8b33f93921630c4df4457cb","unresolved":false,"context_lines":[{"line_number":72,"context_line":"Alternatives"},{"line_number":73,"context_line":"------------"},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"The first proposal is about doing Fernet keys rotation without servvers."},{"line_number":76,"context_line":"Each Keystone node (server or container) would have one crontab per Key and"},{"line_number":77,"context_line":"run a script that would perform the key rotation."},{"line_number":78,"context_line":"The script would generate predictable keys so we wouldn\u0027t need to generate a"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a1ced50_1ee501a7","line":75,"updated":"2017-03-22 12:53:25.000000000","message":"servers*","commit_id":"48317ba3337d7c1ac7482c7d07906c1ee79aeb31"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"3ff02ed8aa08e91ce8b33f93921630c4df4457cb","unresolved":false,"context_lines":[{"line_number":75,"context_line":"The first proposal is about doing Fernet keys rotation without servvers."},{"line_number":76,"context_line":"Each Keystone node (server or container) would have one crontab per Key and"},{"line_number":77,"context_line":"run a script that would perform the key rotation."},{"line_number":78,"context_line":"The script would generate predictable keys so we wouldn\u0027t need to generate a"},{"line_number":79,"context_line":"key from a central server and push it to the other nodes."},{"line_number":80,"context_line":"The algorithm would be smart enough to generate the same secure key across"},{"line_number":81,"context_line":"all nodes where Keystone is running. Because we use time synchronization,"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a1ced50_fe002536","line":78,"updated":"2017-03-22 12:53:25.000000000","message":"Not rotating keys at all is simpler and just as effective as \"predictable keys.\" No where in the Alternative section is it explained why this is not an effective or viable option.","commit_id":"48317ba3337d7c1ac7482c7d07906c1ee79aeb31"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"3ff02ed8aa08e91ce8b33f93921630c4df4457cb","unresolved":false,"context_lines":[{"line_number":79,"context_line":"key from a central server and push it to the other nodes."},{"line_number":80,"context_line":"The algorithm would be smart enough to generate the same secure key across"},{"line_number":81,"context_line":"all nodes where Keystone is running. Because we use time synchronization,"},{"line_number":82,"context_line":"the keys would be updated at the same time."},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"To have this alternative working in real world, we need to ensure that:"},{"line_number":85,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a1ced50_7e50b532","line":82,"updated":"2017-03-22 12:53:25.000000000","message":"I\u0027m not sure what time has to do with anything here, because Fernet keys do not need to be rotated with any sort of synchronicity.","commit_id":"48317ba3337d7c1ac7482c7d07906c1ee79aeb31"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"3ff02ed8aa08e91ce8b33f93921630c4df4457cb","unresolved":false,"context_lines":[{"line_number":87,"context_line":""},{"line_number":88,"context_line":"* Servers are synchronized otherwise Keystone won\u0027t be able to serve valid"},{"line_number":89,"context_line":"  tokens to the OpenStack Cloud correctly, since keys wouldn\u0027t be the same"},{"line_number":90,"context_line":"  everywhere."},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"This proposal is here for example but we don\u0027t think that\u0027s the best way to"},{"line_number":93,"context_line":"achieve it."}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a1ced50_3e539d3a","line":90,"updated":"2017-03-22 12:53:25.000000000","message":"This just isn\u0027t true, because it\u0027s the problem that the staged Fernet key solves (key 0).","commit_id":"48317ba3337d7c1ac7482c7d07906c1ee79aeb31"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"3ff02ed8aa08e91ce8b33f93921630c4df4457cb","unresolved":false,"context_lines":[{"line_number":90,"context_line":"  everywhere."},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"This proposal is here for example but we don\u0027t think that\u0027s the best way to"},{"line_number":93,"context_line":"achieve it."},{"line_number":94,"context_line":""},{"line_number":95,"context_line":"Security Impact"},{"line_number":96,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a1ced50_7e37d5fe","line":93,"updated":"2017-03-22 12:53:25.000000000","message":"You should explain why!","commit_id":"48317ba3337d7c1ac7482c7d07906c1ee79aeb31"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"3ff02ed8aa08e91ce8b33f93921630c4df4457cb","unresolved":false,"context_lines":[{"line_number":97,"context_line":""},{"line_number":98,"context_line":"* Having Fernet keys rotation is of course bringing security in our Keystone"},{"line_number":99,"context_line":"  token management system. It will reduce the chance for attackers to"},{"line_number":100,"context_line":"  decrypt tokens sent over the network when intercepted."},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"* Storing the keys in etcd will require some advanced configuration"},{"line_number":103,"context_line":"  to make etcd working with TLS. It should not be a problem because"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a1ced50_81535616","line":100,"updated":"2017-03-22 12:53:25.000000000","message":"Again, decrypting tokens is absolutely NOT the worst case scenario here. Nor do tokens need to be intercepted for the keys to be attacked. A legitimate client simply needs to generate enough tokens before they are rotated to theoretically give them the ability to crack the keys and therefore generate their own tokens.\n\nThe decrypted plaintext of Fernet tokens is relatively unimportant.","commit_id":"48317ba3337d7c1ac7482c7d07906c1ee79aeb31"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"3ff02ed8aa08e91ce8b33f93921630c4df4457cb","unresolved":false,"context_lines":[{"line_number":120,"context_line":"The performance impact would rely on the etcd architecture and how fast are"},{"line_number":121,"context_line":"done the get/put actions to manage keys, and also the replications between"},{"line_number":122,"context_line":"etcd servers."},{"line_number":123,"context_line":"Since etcd has been designed to scale, we should not notify performance"},{"line_number":124,"context_line":"changes but it is something that we\u0027ll have to measure."},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"Deployer Impact"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a1ced50_c17e2e69","line":123,"updated":"2017-03-22 12:53:25.000000000","message":"s/notify/notice/","commit_id":"48317ba3337d7c1ac7482c7d07906c1ee79aeb31"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"3ff02ed8aa08e91ce8b33f93921630c4df4457cb","unresolved":false,"context_lines":[{"line_number":130,"context_line":"deployer will have to deploy OS::TripleO::Services::Etcd service."},{"line_number":131,"context_line":"The configuration of etcd will be automatic and transparent for the"},{"line_number":132,"context_line":"deployer though. The service will be horizontaly scalable so deployers"},{"line_number":133,"context_line":"will be able to deploy as many instances of etcd as they think it\u0027s"},{"line_number":134,"context_line":"reasonable."},{"line_number":135,"context_line":""},{"line_number":136,"context_line":"Developer Impact"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a1ced50_41e23e30","line":133,"updated":"2017-03-22 12:53:25.000000000","message":"s/it\u0027s/is/","commit_id":"48317ba3337d7c1ac7482c7d07906c1ee79aeb31"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"3ff02ed8aa08e91ce8b33f93921630c4df4457cb","unresolved":false,"context_lines":[{"line_number":167,"context_line":"  at any time."},{"line_number":168,"context_line":""},{"line_number":169,"context_line":"* Investigate if Keystone could beneficiate of an etcd backend to store"},{"line_number":170,"context_line":"  Fernet keys and engage some collaboration on this side (spec, etc)."},{"line_number":171,"context_line":""},{"line_number":172,"context_line":""},{"line_number":173,"context_line":"Dependencies"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a1ced50_61081adb","line":170,"updated":"2017-03-22 12:53:25.000000000","message":"Again, I think this is out of scope for this spec.","commit_id":"48317ba3337d7c1ac7482c7d07906c1ee79aeb31"}]}