<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
p.yiv1290123928msoplaintext, li.yiv1290123928msoplaintext, div.yiv1290123928msoplaintext
{mso-style-name:yiv1290123928msoplaintext;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
p.yiv1290123928msonormal, li.yiv1290123928msonormal, div.yiv1290123928msonormal
{mso-style-name:yiv1290123928msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
p.yiv1290123928msochpdefault, li.yiv1290123928msochpdefault, div.yiv1290123928msochpdefault
{mso-style-name:yiv1290123928msochpdefault;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
span.yiv1290123928msohyperlink
{mso-style-name:yiv1290123928msohyperlink;}
span.yiv1290123928msohyperlinkfollowed
{mso-style-name:yiv1290123928msohyperlinkfollowed;}
span.yiv1290123928emailstyle17
{mso-style-name:yiv1290123928emailstyle17;}
span.yiv1290123928plaintextchar
{mso-style-name:yiv1290123928plaintextchar;}
p.yiv1290123928msonormal1, li.yiv1290123928msonormal1, div.yiv1290123928msonormal1
{mso-style-name:yiv1290123928msonormal1;
margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
span.yiv1290123928msohyperlink1
{mso-style-name:yiv1290123928msohyperlink1;
color:blue;
text-decoration:underline;}
span.yiv1290123928msohyperlinkfollowed1
{mso-style-name:yiv1290123928msohyperlinkfollowed1;
color:purple;
text-decoration:underline;}
p.yiv1290123928msoplaintext1, li.yiv1290123928msoplaintext1, div.yiv1290123928msoplaintext1
{mso-style-name:yiv1290123928msoplaintext1;
margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
span.yiv1290123928emailstyle171
{mso-style-name:yiv1290123928emailstyle171;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.yiv1290123928plaintextchar1
{mso-style-name:yiv1290123928plaintextchar1;
font-family:"Calibri","sans-serif";}
p.yiv1290123928msochpdefault1, li.yiv1290123928msochpdefault1, div.yiv1290123928msochpdefault1
{mso-style-name:yiv1290123928msochpdefault1;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Calibri","sans-serif";}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
span.EmailStyle33
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="color:#1F497D">Nate -- I vote for (2). Also wonder if you would like to not just make a copy of the volume, but also make a copy of the key and save it, in so doing it gets a new key-id and associate that key-id with the snapshot
in its meta data.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">An advantage of making a copy of the key is that if one were to delete a volume, one may also delete its associated key without worrying about rendering data inaccessible because of sharing or for fear of loss,
never reclaiming key space.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">I am reviewing your code .. without getting into where the key-manager resides as a service ..<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Would like to propose keys as distinct from the algorithm that uses them.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Keys would have properties such as public/private/symmetric, and length in addition to your format (asn.1)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">I am thinking it would be a good idea to attach with a domain/project/user a preferred encryption preference,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">So one would need to traverse up the user to domain to determine the most specific preference for that user while encrypting a volume, and likewise a preference for objects etc.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">The algorithm would also be attached as meta data to the volume based on the results of the above discovery process during encryption.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">The defaults are the strongest known at the time we deploy.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Further, I am thinking in the UI, should the domain/project/user creator desire to set them, these should be retrieved from openssl or other implementation for object, from dm-crypt for volume etc.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">A problem that could arise .. the compute node on which a volume is attached might have an older version of dum-crypt than the node that hosted the horizon user interface .. but I am guessing in the immediate
future that may not be an issue. If it becomes one, then we would need to specify a filter instance for the same and that would need to be factored in while determining where to host the volume.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Regards<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">malini<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:black">2) Support clone with same key. This should be easy to implement as well. We could use the metadata key-id and set it to the same value for the clone. The drawback to this is that the key has multiple uses,
and it could be used to decrypt many different volumes. I don't like the idea of that. If the key is compromised then what do you do?<o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="color:black">There are similar issues for snapshots, but I am not as opposed to option 2 for snapshots. Any thoughts on this?<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black">-Nate<o:p></o:p></span></p>
</div>
</div>
</body>
</html>