<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=euc-kr">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 255); font-size: 14px; font-family: Calibri, sans-serif;">
<div>Hello Asha,</div>
<div><br>
</div>
<div>So the last step you have is retrieving a decrypted secret from Barbican. Barbican indeed stores the secret internally encrypted using an internal KEK. When it is retrieved however, it is first decrypted by Barbican and then returned the client decrypted. </div>
<div><br>
</div>
<div>Beyond TLS to protect this information back to the client, there is also a transport key feature that has not yet been fully supported via the client library, that allows the client to select a session key that can be used to encrypt the secret between
the client and Barbican.</div>
<div><br>
</div>
<div>Thanks,</div>
<div>John</div>
<div><br>
</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>Asha Seshagiri <<a href="mailto:asha.seshagiri@gmail.com">asha.seshagiri@gmail.com</a>><br>
<span style="font-weight:bold">Date: </span>Friday, April 17, 2015 at 1:02 PM<br>
<span style="font-weight:bold">To: </span>John Wood <<a href="mailto:john.wood@rackspace.com">john.wood@rackspace.com</a>><br>
<span style="font-weight:bold">Cc: </span>openstack-dev <<a href="mailto:openstack-dev@lists.openstack.org">openstack-dev@lists.openstack.org</a>>, "Reller, Nathan S." <<a href="mailto:Nathan.Reller@jhuapl.edu">Nathan.Reller@jhuapl.edu</a>>, Douglas Mendizabal
<<a href="mailto:douglas.mendizabal@RACKSPACE.COM">douglas.mendizabal@RACKSPACE.COM</a>>, Paul Kehrer <<a href="mailto:paul.kehrer@RACKSPACE.COM">paul.kehrer@RACKSPACE.COM</a>>, Adam Harwell <<a href="mailto:adam.harwell@RACKSPACE.COM">adam.harwell@RACKSPACE.COM</a>>,
Alexis Lee <<a href="mailto:alexisl@hp.com">alexisl@hp.com</a>><br>
<span style="font-weight:bold">Subject: </span>Re: Barbican : What is the difference between secret and order resource<br>
</div>
<div><br>
</div>
<div>
<div>
<div dir="ltr">Hi All,
<div><br>
</div>
<div> I would like to know if the keys generated by Barbican through the order resource are encrypted using KEKS and then stored in the secret object or is it stored in unencypted format.</div>
<div class="gmail_extra"><br>
</div>
<div class="gmail_extra">Any help would be highly appreciated.</div>
<div class="gmail_extra"><br>
</div>
<div class="gmail_extra">
<div class="gmail_extra">root@barbican:~# curl -H 'Accept: application/json' -H 'X-Project-Id:12345' http ://localhost:9311/v1/orders</div>
<div class="gmail_extra"><br>
</div>
<div class="gmail_extra">Please find the command and response below :</div>
<div class="gmail_extra"><br>
</div>
<div class="gmail_extra">{"total": 3, "orders": [{"status": "ACTIVE", "secret_ref": "<b><a href="http://localhost:9311/v1/secrets/b3709da7-4691-40d6-af9a-1ae23772a7b2">http://localhost:9311/v1/secrets/b3709da7-4691-40d6-af9a-1ae23772a7b2</a></b>", "updated":
"2015-03-13T22:27:48.866683", "meta": {"name": "secretname2", "algorithm": "aes", "payload_content_type": "application/octet-stream", "mode": "cbc", "bit_length": 256, "expiration": null}, "created": "2015-03-13T22:27:48.844860", "type": "key", "order_ref":
"<a href="http://localhost:9311/v1/orders/5a4844ca-47a9-4bd7-ae56-fb84655f48d9">http://localhost:9311/v1/orders/5a4844ca-47a9-4bd7-ae56-fb84655f48d9</a>"},....</div>
</div>
<div class="gmail_extra"><br>
</div>
<div class="gmail_extra">
<div>
<div>root@barbican:~# curl -H 'Accept: application/json' -H 'X-Project-Id:12345' <a href="http://localhost:9311/v1/secrets/b3709da7-4691-40d6-af9a-1ae23772a7b2">
http://localhost:9311/v1/secrets/b3709da7-4691-40d6-af9a-1ae23772a7b2</a></div>
<div>{"status": "ACTIVE", "secret_type": "opaque", "updated": "2015-03-13T22:27:48.863403", "name": "secretname2", "algorithm": "aes", "created": "2015-03-13T22:27:48.860600", "secret_ref": "<a href="http://localhost:9311/v1/secrets/b3709da7-4691-40d6-af9a-1ae23772a7b2">http://localhost:9311/v1/secrets/b3709da7-4691-40d6-af9a-1ae23772a7b2</a>",
"content_types": {"default": "application/octet-stream"}, "expiration": null, "bit_length": 256, "mode": "cbc"}</div>
</div>
<div><br>
</div>
<br clear="all">
<div>
<div>root@barbican:~# curl -H 'Accept:application/octet-stream' -H 'X-Project-Id:12345'
<a href="http://localhost:9311/v1/secrets/b3709da7-4691-40d6-af9a-1ae23772a7b2">http://localhost:9311/v1/secrets/b3709da7-4691-40d6-af9a-1ae23772a7b2</a></div>
<div>¢Æ¢ÆR¢Æv¢Æ¢Æ¢ÆW¢Æ4¢ÆA?Md¢ÆL[¢ÆK4A¢Æ¢Æbx¢Æ¢Æ¢Æ - ><b> would like to know if this response is encyprted by barbican using KEKS or it is unencypted format whose content type is application/octet-stream</b></div>
</div>
<div><b><br>
</b></div>
<div></div>
</div>
<div class="gmail_extra"><br>
</div>
<div class="gmail_extra">Thanks and Regards,</div>
<div class="gmail_extra">Asha Seshagiri</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Fri, Apr 17, 2015 at 11:30 AM, Asha Seshagiri <span dir="ltr">
<<a href="mailto:asha.seshagiri@gmail.com" target="_blank">asha.seshagiri@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div dir="ltr">
<div>Thanks a lot John for your response.<br>
</div>
<div><br>
</div>
<div>I also thank everyone who has been responding to my queries if I have missed someone .</div>
<div>There was some problem while configuring my email .I do not receive the email response directly from openstack Dev group.I would check the archive folder for that.</div>
<div>I will have a look into it </div>
<div><br>
</div>
<div>Once again , it's nice working and collaborating with the openstack Dev -group.</div>
<span class="">
<div><br>
</div>
<div>Thanks and Regards,</div>
<div>Asha Seshagiri</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
</span>
<div>jh</div>
<span class="">
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div>Thanks and Regards,</div>
<div>Asha Seshagiri</div>
</span>
<div>
<div class="h5">
<div class="gmail_extra"><br>
<div class="gmail_quote">On Thu, Apr 16, 2015 at 8:10 AM, John Wood <span dir="ltr">
<<a href="mailto:john.wood@rackspace.com" target="_blank">john.wood@rackspace.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div style="word-wrap:break-word;color:rgb(0,0,255);font-size:14px;font-family:Calibri,sans-serif">
<div>Hello Asha,</div>
<div><br>
</div>
<div>The /v1/secrets resource is used to upload, encrypt and store your secrets, and to decrypt and retrieve those secrets. Key encryption keys (KEKs) internal to Barbican are used to encrypt the secret.</div>
<div><br>
</div>
<div>The /v1/orders resource is used when you want Barbican to generate secrets for you. When they are done they give you references to where the secrets are stored so you can retrieve them via the secrets resource above.</div>
<div><br>
</div>
<div>Hope that helps!</div>
<div><br>
</div>
<div>Thanks,</div>
<div>John</div>
<div><br>
</div>
<span>
<div style="font-family:Calibri;font-size:11pt;text-align:left;color:black;border-width:1pt medium medium;border-style:solid none none;padding:3pt 0in 0in;border-top-color:rgb(181,196,223)">
<span style="font-weight:bold">From: </span>Asha Seshagiri <<a href="mailto:asha.seshagiri@gmail.com" target="_blank">asha.seshagiri@gmail.com</a>><br>
<span style="font-weight:bold">Date: </span>Thursday, April 16, 2015 at 1:23 AM<br>
<span style="font-weight:bold">To: </span>openstack-dev <<a href="mailto:openstack-dev@lists.openstack.org" target="_blank">openstack-dev@lists.openstack.org</a>><br>
<span style="font-weight:bold">Cc: </span>John Wood <<a href="mailto:john.wood@rackspace.com" target="_blank">john.wood@rackspace.com</a>>, "Reller, Nathan S." <<a href="mailto:Nathan.Reller@jhuapl.edu" target="_blank">Nathan.Reller@jhuapl.edu</a>>, Douglas
Mendizabal <<a href="mailto:douglas.mendizabal@RACKSPACE.COM" target="_blank">douglas.mendizabal@RACKSPACE.COM</a>>, Paul Kehrer <<a href="mailto:paul.kehrer@RACKSPACE.COM" target="_blank">paul.kehrer@RACKSPACE.COM</a>>, Adam Harwell <<a href="mailto:adam.harwell@RACKSPACE.COM" target="_blank">adam.harwell@RACKSPACE.COM</a>>,
Alexis Lee <<a href="mailto:alexisl@hp.com" target="_blank">alexisl@hp.com</a>><br>
<span style="font-weight:bold">Subject: </span>Barbican : What is the difference between secret and order resource<br>
</div>
<div>
<div>
<div><br>
</div>
<div>
<div>
<div dir="ltr">Hi All ,
<div><br>
</div>
<div>What is the difference between secret and the order resource ?</div>
<div>Where is the key stored that is used for encrypting the payload in the secret resource and how do we access it. </div>
<div><br>
</div>
<div>According to my understanding ,</div>
<div><br>
</div>
<div>Storing/Posting the secret means we are encrypting the actual information(payload) using the key generated internally by the barbican based on the type mentioned in the secret type.</div>
<div>Geting the secret means we are decryprting the information and geting the actual information.</div>
<div><br>
</div>
<div>Posting the order refers to the generation of the actual keys by the barbican and encyrpting those keys based on the algorithm and the internal key generated by barbican.</div>
<div>This encrypted key is referred through the secret reference and the whole meta data is referred through a order reference.</div>
<div><br>
</div>
<div>Please correct me if I am wrong.</div>
<div>Any help would be highly appreciated.</div>
<div><br>
</div>
<div><br>
</div>
<div>-- <br>
<div>
<div><em>Thanks and Regards,</em></div>
<div><em>Asha Seshagiri</em></div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</span></div>
</blockquote>
</div>
<br>
<br clear="all">
<div><br>
</div>
-- <br>
<div>
<div><em>Thanks and Regards,</em></div>
<div><em>Asha Seshagiri</em></div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
<br>
<br clear="all">
<div><br>
</div>
-- <br>
<div class="gmail_signature">
<div><em>Thanks and Regards,</em></div>
<div><em>Asha Seshagiri</em></div>
</div>
</div>
</div>
</div>
</div>
</span>
</body>
</html>