<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
span.hoenzb
{mso-style-name:hoenzb;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:130946601;
mso-list-type:hybrid;
mso-list-template-ids:1143872004 -1993842968 67698713 67698715 67698703 67698713 67698715 67698703 67698713 67698715;}
@list l0:level1
{mso-level-text:"%1\)";
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level2
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level3
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l0:level4
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level5
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level6
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l0:level7
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level8
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level9
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l1
{mso-list-id:1107121431;
mso-list-type:hybrid;
mso-list-template-ids:31866710 725115750 67698713 67698715 67698703 67698713 67698715 67698703 67698713 67698715;}
@list l1:level1
{mso-level-text:"%1\)";
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
mso-ascii-font-family:Calibri;
mso-fareast-font-family:Calibri;
mso-hansi-font-family:Calibri;
mso-bidi-font-family:"Times New Roman";}
@list l1:level2
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l1:level3
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l1:level4
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l1:level5
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l1:level6
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l1:level7
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l1:level8
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l1:level9
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Calibri","sans-serif"">Hello Everyone!<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Calibri","sans-serif""><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Calibri","sans-serif"">Just wanted to let you know that the key manager folks are busy ..<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Calibri","sans-serif""><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Calibri","sans-serif"">Our postings to the mailing list will have the subject prefix: [openstack-dev] [barbican]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Calibri","sans-serif"">Freenode IRC hangout: ‘#openstack-cloudkeep’<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Calibri","sans-serif"">Wiki
<a href="https://github.com/cloudkeep/barbican/wiki/_pages"><span style="color:windowtext">https://github.com/cloudkeep/barbican/wiki/_pages</span></a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Calibri","sans-serif""><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Calibri","sans-serif""><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Calibri","sans-serif"">Early developers and adoptors:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Calibri","sans-serif"">John Wood
<a href="mailto:john.wood@RACKSPACE.COM"><span style="color:windowtext">john.wood@RACKSPACE.COM</span></a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Calibri","sans-serif"">Douglas Mendizabal <<a href="mailto:douglas.mendizabal@RACKSPACE.COM"><span style="color:windowtext">douglas.mendizabal@RACKSPACE.COM</span></a>>;<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Calibri","sans-serif"">Andrew Hartnett
<a href="mailto:andrew.hartnett@RACKSPACE.COM" target="_blank"><span style="color:windowtext">andrew.hartnett@RACKSPACE.COM</span></a>
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Calibri","sans-serif"">Jarret Raim
<a href="mailto:jarret.raim@RACKSPACE.COM" target="_blank"><span style="color:windowtext">jarret.raim@RACKSPACE.COM</span></a>;
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Calibri","sans-serif"">Malini Bhandaru
<a href="mailto:malini.k.bhandaru@intel.com"><span style="color:windowtext">malini.k.bhandaru@intel.com</span></a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Calibri","sans-serif"">Reller, Nathan S. <<a href="mailto:Nathan.Reller@jhuapl.edu"><span style="color:windowtext">Nathan.Reller@jhuapl.edu</span></a>>;
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Calibri","sans-serif"">Coffman, Joel M. <<a href="mailto:Joel.Coffman@jhuapl.edu"><span style="color:windowtext">Joel.Coffman@jhuapl.edu</span></a>>;
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Calibri","sans-serif"">Glendenning, Laura J. <<a href="mailto:Laura.Glendenning@jhuapl.edu"><span style="color:windowtext">Laura.Glendenning@jhuapl.edu</span></a>>;
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Calibri","sans-serif"">Nate Reller (<a href="mailto:rellerreller@yahoo.com" target="_blank"><span style="color:windowtext">rellerreller@yahoo.com</span></a>);
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Calibri","sans-serif"">Benjamin, Bruce P. <<a href="mailto:Bruce.Benjamin@jhuapl.edu"><span style="color:windowtext">Bruce.Benjamin@jhuapl.edu</span></a>>
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Calibri","sans-serif""><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Calibri","sans-serif"">Meeting minutes from today, April 26, 2013<o:p></o:p></span></b></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Calibri","sans-serif"">.
<o:p></o:p></span></p>
<p class="MsoListParagraph" style="text-indent:-.25in"><span style="font-size:10.0pt">1)
<b>Acknowledged: </b>team has a common goal of getting volume encryption and key manager into Havana.<o:p></o:p></span></p>
<p class="MsoListParagraph"><span style="font-size:10.0pt"> Volume encryption needs key management<o:p></o:p></span></p>
<p class="MsoListParagraph"><span style="font-size:10.0pt"> Key manager needs a user and demonstrate integration
<o:p></o:p></span></p>
<p class="MsoListParagraph" style="text-indent:-.25in"><span style="font-size:10.0pt">2)
<b>Goal: July 18, 2013 incubation target for Havana.</b> Need a stable, minimally functional, integrated implementation.<o:p></o:p></span></p>
<p class="MsoListParagraph" style="text-indent:-.25in"><span style="font-size:10.0pt">3) API: <b>create_key</b> (optional args: type, length)
<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.25in"><span style="font-size:10.0pt"> Returns key-id, and key-string<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.25in"><span style="font-size:10.0pt"> First cut: symmetric key<o:p></o:p></span></p>
<p class="MsoListParagraph"><span style="font-size:10.0pt"> (Stub API implementation could return the exact same string for all key-ids)<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.25in"><b><span style="font-size:10.0pt"> Get_key (key-id),</span></b><span style="font-size:10.0pt"> returns key-string<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.25in"><b><span style="font-size:10.0pt"> Delete_key</span></b><span style="font-size:10.0pt"><o:p></o:p></span></p>
<p class="MsoListParagraph" style="text-indent:-.25in"><span style="font-size:10.0pt">4) Client for key manager -- ala python-barbican_client<o:p></o:p></span></p>
<p class="MsoListParagraph"><span style="font-size:10.0pt"> Data formats json and xml.<o:p></o:p></span></p>
<p class="MsoListParagraph"><span style="font-size:10.0pt"> Initial json<o:p></o:p></span></p>
<p class="MsoListParagraph" style="text-indent:-.25in"><span style="font-size:10.0pt">5) Defer tackling split-keys, user holding a part, or user part domain/project/etc specific in keystone or ..<o:p></o:p></span></p>
<p class="MsoListParagraph" style="text-indent:-.25in"><span style="font-size:10.0pt">6) Flesh out concept of key-access. We could separate owner and delegated-access aspects.<o:p></o:p></span></p>
<p class="MsoListParagraph"><span style="font-size:10.0pt"> A key could have delegated-access = {Nova-compute, swift, cinder ..} etc typically openstack services<o:p></o:p></span></p>
<p class="MsoListParagraph"><span style="font-size:10.0pt"> Scope-access = domain/project(s)/user<o:p></o:p></span></p>
<p class="MsoListParagraph"><span style="font-size:10.0pt">Through keystone delegation, limit access time to keys and which keys<o:p></o:p></span></p>
<p class="MsoListParagraph" style="text-indent:-.25in"><b><span style="font-size:10.0pt">7) Meta data:</span></b><span style="font-size:10.0pt"><o:p></o:p></span></p>
<p class="MsoListParagraph"><span style="font-size:10.0pt">Cinder will hold meta data with volume regarding key-id, algorithm etc<o:p></o:p></span></p>
<p class="MsoListParagraph"><span style="font-size:10.0pt">Current thinking how key is used and where, can be key agnostic (will revisit later if necessary based on use case convulsions, JHU_APL at this point fine with this.)
<o:p></o:p></span></p>
<p class="MsoListParagraph" style="text-indent:-.25in"><span style="font-size:10.0pt">8) First cut: supporting above API. How the encryption, random keys etc generate, all internal. An HSM, a KMIP implementation whatever.<o:p></o:p></span></p>
<p class="MsoListParagraph" style="text-indent:-.25in"><span style="font-size:10.0pt">9) First cut, users can pull functionality from git and have their own service instance, ala devstack one-all-in-box model or other. Will speed integration effort.<o:p></o:p></span></p>
<p class="MsoListParagraph" style="text-indent:-.25in"><span style="font-size:10.0pt">10)
<b>TODO</b> – move code into sourceforge to take advantage of the code review, build and other tools<o:p></o:p></span></p>
<p class="MsoListParagraph" style="text-indent:-.25in"><span style="font-size:10.0pt">11) Questions:<o:p></o:p></span></p>
<p class="MsoListParagraph" style="margin-left:1.0in;text-indent:-.25in"><span style="font-size:10.0pt">a) What auth tokens that come along with a request – user only? Delegated-user? (learn more from OpenStack and Keystone folks)<o:p></o:p></span></p>
<p class="MsoListParagraph" style="margin-left:1.0in;text-indent:-.25in"><span style="font-size:10.0pt">b) Token expiration– what happens if primary user token is 24 hrs. long and a volume request comes in the last minute and falls on the edge of expiration
during the process<o:p></o:p></span></p>
<p class="MsoListParagraph" style="margin-left:1.0in;text-indent:-.25in"><span style="font-size:10.0pt">c) JHU-APL to discuss and learn more about KMIP requirements from their sponsor.<o:p></o:p></span></p>
<p class="MsoListParagraph" style="margin-left:1.0in;text-indent:-.25in"><span style="font-size:10.0pt">d) Later on – for an open key management system might want to request some port number like keystone with IANA<o:p></o:p></span></p>
<p class="MsoListParagraph" style="margin-left:1.0in;text-indent:-.25in"><span style="font-size:10.0pt">e) Maintaining re-key history<o:p></o:p></span></p>
<p class="MsoListParagraph" style="margin-left:1.0in"><span style="font-size:10.0pt"> Event logs would contain it but elsewhere? if yes, what ..<o:p></o:p></span></p>
<p class="MsoListParagraph" style="margin-left:1.0in;text-indent:-.25in"><span style="font-size:10.0pt">f) Is there any OpenStack requirement that a product needs to support Python 2.6 too. Most of the projects seem to mention Python 2.6.<o:p></o:p></span></p>
<p class="MsoListParagraph" style="margin-left:1.0in;text-indent:-.25in"><span style="font-size:10.0pt">g) Should keys maintain a URI to the object they wrap – from a security point may be not, some opacity is nice!!<o:p></o:p></span></p>
<p class="MsoListParagraph" style="margin-left:1.0in"><span style="font-size:10.0pt">Adds a layer of work in that if a resource moves, we need some other middleware to transparently take care of the mapping. First cut – not supporting.<o:p></o:p></span></p>
<p class="MsoListParagraph" style="margin-left:1.0in;text-indent:-.25in"><span style="font-size:10.0pt">h) Volumes -- At point of attach, through horizon UI specify encryption yes/no, algorithm etc. May be later this could be part of user preference.<o:p></o:p></span></p>
<p class="MsoListParagraph" style="margin-left:1.0in;text-indent:-.25in"><span style="font-size:10.0pt"><o:p> </o:p></span></p>
<p class="MsoListParagraph" style="margin-left:1.0in;text-indent:-.25in"><span style="font-size:10.0pt"><o:p> </o:p></span></p>
<p class="MsoListParagraph" style="margin-left:1.0in;text-indent:-.25in"><span style="font-size:10.0pt">Regards<o:p></o:p></span></p>
<p class="MsoListParagraph" style="margin-left:1.0in;text-indent:-.25in"><span style="font-size:10.0pt">John, Jarret & Malini<o:p></o:p></span></p>
<p class="MsoListParagraph" style="margin-left:1.0in"><span style="font-size:10.0pt"> <o:p></o:p></span></p>
<p class="MsoListParagraph" style="margin-left:1.0in"><span style="font-size:10.0pt"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Calibri","sans-serif""><o:p> </o:p></span></p>
</div>
</div>
</body>
</html>