<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:"Calibri","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoPlainText">Oleg, just the thought I had earlier in the day!<o:p></o:p></p>
<p class="MsoPlainText">Suggested a session for key manager at <a href="http://summit.openstack.org/">
http://summit.openstack.org/</a>.<o:p></o:p></p>
<p class="MsoPlainText">To your list of blueprints, I added another one I found.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Nate, if your volume meta data included a key-id, it could pull the key-string from the key-manager (as yet a fuzzy) entity.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">The keystone token could also capture preferences for encryption algorithm (for Cinder/Glance/Swift) and these default to<o:p></o:p></p>
<p class="MsoPlainText">strong versions like Caitlin suggests.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Regards,<o:p></o:p></p>
<p class="MsoPlainText">Malini<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Oleg Gelbukh [mailto:ogelbukh@mirantis.com]
<br>
<b>Sent:</b> Wednesday, February 13, 2013 12:52 PM<br>
<b>To:</b> OpenStack Development Mailing List<br>
<b>Cc:</b> Nate Reller<br>
<b>Subject:</b> Re: [openstack-dev] Volume Encryption<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">Hello,<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I believe that this discussion need actually be split into two parts: encryption algorithms and specific tools, and key management.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">The implementation of actual encryption are specific for every project. We identified a number of blueprints which utilize encryption in one way or another:<o:p></o:p></p>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif""><a href="https://blueprints.launchpad.net/keystone/+spec/access-key-authentication" target="_blank">https://blueprints.launchpad.net/keystone/+spec/access-key-authentication</a><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif""><a href="https://blueprints.launchpad.net/nova/+spec/encrypt-ephemeral-volumes" target="_blank">https://blueprints.launchpad.net/nova/+spec/encrypt-ephemeral-volumes</a><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif""><a href="https://blueprints.launchpad.net/swift/+spec/encrypted-objects" target="_blank">https://blueprints.launchpad.net/swift/+spec/encrypted-objects</a><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif""><a href="https://blueprints.launchpad.net/nova/+spec/encrypt-cinder-volumes" target="_blank">https://blueprints.launchpad.net/nova/+spec/encrypt-cinder-volumes</a><o:p></o:p></span></p>
</div>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">All these blueprints involve some key management, and it seems reasonable to implement it as a shared component. Where does it belongs is a discussion topic. Our understanding is that Keystone API could be extended with new resource keys/
to proxy keys operations with pluggable back-end drivers (much like Identity or Catalog).<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Please, tell me if this sounds reasonable to you. Do you think this kind of discussion should take place at Summit?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">--<br>
Best regards,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Oleg<o:p></o:p></p>
</div>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On Wed, Feb 13, 2013 at 12:32 PM, Caitlin Bestler <<a href="mailto:caitlin.bestler@nexenta.com" target="_blank">caitlin.bestler@nexenta.com</a>> wrote:<o:p></o:p></p>
<div>
<div>
<div>
<p class="MsoNormal">On 2/13/2013 9:46 AM, Nate Reller wrote:<o:p></o:p></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<div>
<p class="MsoNormal">Our intent was not to limit which encryption algorithms to use or to propose a minimum standard. We needed to pick a default implementation to use for the Grizzly release. We did not have enough time to make the algorithm configurable,
so we needed to pick a default for the release.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><br>
In the future we would like to support many different algorithms and key sizes. We are imagining the user inputting which algorithm and key size they would like to use via the dashboard. The administrators of the cloud would be responsible for configuring
the dashboard and other components to report which encryption algorithms are available. This will depend upon their cloud, and the encryption algorithm and key sizes will likely be dictated by the features supported by the compute nodes.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><br>
-Nate<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt">Something like this should always be pluggable, even if it requires editing configuration files.<br>
Dashboard selection would also be nice, but would presume providing some text about what<br>
the options were.<br>
<br>
In any case, the general rule of thumb I have followed on security issues is to allow the user<br>
a great deal of flexibility, but to default high. Users who do not know how to configure their<br>
security settings probably need them to be set high.<o:p></o:p></p>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
_______________________________________________<br>
OpenStack-dev mailing list<br>
<a href="mailto:OpenStack-dev@lists.openstack.org">OpenStack-dev@lists.openstack.org</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</body>
</html>