Open Stack

On Tuesday, November 6, 2012 at 08:35 AM, Russell Bryant wrote:

> On 11/06/2012 06:35 AM, Clark, Robert Graham wrote:
> > I believe there are two options here, role based signing and entity based
> > signing note that I'm not calling out any specific crypto here, there's a
> > bunch of stuff that could be used. In roll based signing each role
> > 
> 
> 
> I think we need machine-based signing. Really, I want machine+role signing.

Agreed. My intention is that services can specify their key through a configuration option. Different services could use different configuration options. Those keys would be associated with signed certificates, those certificates would be signed by various authorities to provide different roles. This can be done via PKI, although it is admittedly a bit messy to implement and the tools won't (immediately?) be part of the OpenStack software stack.

I want to take the "build it and they will follow" approach. Put in the signing, then let tools develop around it.

I should note that the toughest part with role-based messaging is with message replies. It isn't at all insurmountable, but this is why I'm pushing out role-based signing from the initial blueprint.

Robert, as to the various cryptosystems that are available...  I looked at Attribute and Role based encyption, but decided they were not sufficiently secure. They're relatively new and just this summer, an attack discovered against such mechanisms. It is a pity, too, because it would have been perfect for our messaging requirements. The PKI pattern is well-established, even if it does have overhead and complexity.  However, I'd like to leave the wire-format flexible enough that alternative systems could be plumbed in and used if someone wanted to implement and use them.

Regards,
Eric Windisch

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openstack.org/pipermail/openstack-dev/attachments/20121106/23a4fd75/attachment.html>