| *** antosh has quit IRC | 00:23 | |
| *** DongHM has joined #openstack-barbican | 00:58 | |
| *** mhen has quit IRC | 01:32 | |
| *** mhen has joined #openstack-barbican | 01:32 | |
| *** antosh has joined #openstack-barbican | 01:39 | |
| *** annp has joined #openstack-barbican | 01:52 | |
| *** ricolin has joined #openstack-barbican | 02:09 | |
| *** antosh has quit IRC | 04:28 | |
| *** FrankZhang has quit IRC | 05:20 | |
| *** FrankZhang has joined #openstack-barbican | 05:20 | |
| *** FrankZhang has joined #openstack-barbican | 05:21 | |
| *** Luzi has joined #openstack-barbican | 06:00 | |
| *** openstackgerrit has joined #openstack-barbican | 06:56 | |
| openstackgerrit | Dao Cong Tien proposed openstack/barbican master: Invalid sphinx syntax of link to static file in doc https://review.openstack.org/579781 | 06:56 |
|---|---|---|
| *** ducnv has joined #openstack-barbican | 07:18 | |
| *** peereb has joined #openstack-barbican | 07:21 | |
| *** alee has joined #openstack-barbican | 07:22 | |
| *** serlex has joined #openstack-barbican | 07:24 | |
| *** ricolin has quit IRC | 07:55 | |
| *** DongHM has quit IRC | 07:58 | |
| *** DongHM has joined #openstack-barbican | 08:08 | |
| openstackgerrit | Nguyen Van Trung proposed openstack/barbican master: Add doc8 to pep8 check for project https://review.openstack.org/579812 | 08:39 |
| *** alee has quit IRC | 08:42 | |
| *** alee has joined #openstack-barbican | 08:43 | |
| *** pbourke has quit IRC | 09:10 | |
| *** pbourke has joined #openstack-barbican | 09:12 | |
| *** DongHM has quit IRC | 09:56 | |
| openstackgerrit | Dao Cong Tien proposed openstack/barbican master: Activate html_static_path config option https://review.openstack.org/579781 | 10:01 |
| *** abishop has joined #openstack-barbican | 10:15 | |
| *** alee has quit IRC | 10:28 | |
| *** alee has joined #openstack-barbican | 10:29 | |
| *** alee has quit IRC | 10:43 | |
| *** serlex has quit IRC | 10:59 | |
| *** alee has joined #openstack-barbican | 11:42 | |
| alee | barbican weekly meeting in 5 minutes .. | 11:50 |
| alee | or 10 actually .. | 11:50 |
| alee | #startmeeting barbican | 12:00 |
| openstack | Meeting started Tue Jul 3 12:00:28 2018 UTC and is due to finish in 60 minutes. The chair is alee. Information about MeetBot at http://wiki.debian.org/MeetBot. | 12:00 |
| openstack | Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. | 12:00 |
| *** openstack changes topic to " (Meeting topic: barbican)" | 12:00 | |
| openstack | The meeting name has been set to 'barbican' | 12:00 |
| alee | #topic roll call | 12:00 |
| *** openstack changes topic to "roll call (Meeting topic: barbican)" | 12:00 | |
| alee | anyone here -- I realize this is a big week for holidays .. | 12:01 |
| alee | ? | 12:01 |
| Luzi | o/ | 12:01 |
| mhen | o/ | 12:01 |
| alee | hi Luzi mhen | 12:01 |
| alee | we'll wait a couple of minutes for other folks to join .. | 12:02 |
| Luzi | hi alee - is redrobot here today? | 12:02 |
| alee | I think he's on PTO this week | 12:02 |
| alee | (holiday) | 12:03 |
| alee | given that tommorow is July 4th, many folks in the US are taking holidays | 12:03 |
| alee | (I would be - but I've been on holiday for the last two weeks) | 12:03 |
| Luzi | ah I see | 12:04 |
| alee | ok - lets get started | 12:04 |
| alee | I dont have much of an agenda this week. still getting caught up. | 12:05 |
| alee | we're still marching on to get all the rocky features in | 12:05 |
| alee | in particular the OVO feature | 12:05 |
| mhen | OVO? | 12:05 |
| alee | I've done a ton of reviews and need other core (who are all on vacation) to do some as well | 12:06 |
| alee | oslo versioned objects | 12:06 |
| mhen | ah I see | 12:06 |
| alee | here is tracker page for rocky -- https://etherpad.openstack.org/p/barbican-tracker-rocky | 12:07 |
| alee | in addition there is work ongoing to document policy in code and make some policy more consisitent | 12:07 |
| alee | and some additional work to get the vault plugin tests running | 12:07 |
| alee | not much more to report here except that there is a bunch to review and to do before rocky comes out | 12:08 |
| mhen | "SGX plugin" - sounds interesting | 12:08 |
| alee | next milestone is week of July 23 | 12:08 |
| mhen | is there any spec or PoC regarding that already? | 12:09 |
| alee | mhen, yeah - the Intel folks worked on a plugin for SGX which they got working .. | 12:09 |
| alee | and they wrote a whitepaper | 12:09 |
| alee | some folks here have tried it out | 12:09 |
| mhen | do you happen to have any links to that? | 12:10 |
| alee | let me get link .. | 12:10 |
| alee | https://arxiv.org/abs/1712.07694 | 12:10 |
| *** raildo has joined #openstack-barbican | 12:10 | |
| alee | hey raildo | 12:10 |
| mhen | thank you very much | 12:11 |
| raildo | hey :) | 12:11 |
| Luzi | hi raildo | 12:11 |
| alee | https://github.com/cloud-security-research/sgx-kms/tree/master/Barbican | 12:11 |
| raildo | hello everyone! | 12:11 |
| mhen | welcome :) | 12:12 |
| alee | they have some good work there including some barbican changes to do attestation | 12:12 |
| alee | but have not tried to upstream any of it yet. | 12:12 |
| alee | if anyone is interested in working on that -- that would be a great addition for Stein | 12:12 |
| mhen | no promises yet but it could be relevant for our project - we'll have a look at it | 12:13 |
| alee | there is another company called Fortanix which has built a solution based on SGX, which has used the pkcs11 plugin to work with their solution | 12:14 |
| alee | they are going to write a gate soon | 12:14 |
| alee | mhen, that would be great | 12:14 |
| alee | #topic summit | 12:14 |
| *** openstack changes topic to "summit (Meeting topic: barbican)" | 12:14 | |
| alee | the deadline for submissions for the Berlin summit is fast approaching | 12:15 |
| alee | July 13 IIRC | 12:15 |
| Luzi | i thought 17 | 12:15 |
| alee | so any barbican related topics would be great .. | 12:15 |
| Luzi | July 17th or am I wrong? | 12:15 |
| alee | no I stand corrected | 12:16 |
| alee | July 17th -- I think I was confused by some internal deadline here | 12:16 |
| alee | anyone have any ideas of barbican related talks? | 12:16 |
| alee | barbican/security? | 12:17 |
| * mhen shrugs | 12:17 | |
| alee | I'm probably going to propose something related to the vault backend work I've been wokring on | 12:18 |
| alee | not fleshed out yet | 12:18 |
| raildo | alee, that would be awesome | 12:19 |
| alee | raildo, I assume you'll be doing something about the oslo.config work? | 12:19 |
| raildo | alee, are you saying about proposing something to the Summit, or just about the development? | 12:20 |
| alee | raildo, summit | 12:20 |
| alee | (I know you're doing the development) | 12:20 |
| raildo | alee, well, probably, I'll skip this summit and maybe propose something for the next one, when we'll have some more mature | 12:21 |
| raildo | alee, using the castellan driver and so on | 12:21 |
| alee | ok | 12:21 |
| alee | well just to keep deadline in mind | 12:21 |
| raildo | I'd rather do something showing that working, than just "this is the next steps" | 12:21 |
| raildo | alee, sure, thanks! | 12:21 |
| alee | ack | 12:21 |
| alee | #topic castellan as base service | 12:22 |
| *** openstack changes topic to "castellan as base service (Meeting topic: barbican)" | 12:22 | |
| alee | so for a long time, the TC has been pushing to have castellan added as a base service | 12:22 |
| alee | and finally that change has merged .. | 12:22 |
| * alee finding review .. | 12:22 | |
| raildo | yay | 12:22 |
| alee | https://review.openstack.org/#/c/572656/ | 12:23 |
| alee | so -- a castellan compatible service is now a base service - which means that developers should expect to use castellan to store secrets | 12:24 |
| alee | hopefully this will drive the secure and centralized storage of secrets | 12:24 |
| alee | either using vault or barbican | 12:25 |
| mhen | this is great news! | 12:25 |
| alee | yeah - took forever to get there :) | 12:25 |
| alee | #topic anything else? | 12:25 |
| *** openstack changes topic to "anything else? (Meeting topic: barbican)" | 12:25 | |
| mhen | o/ | 12:26 |
| mhen | there's also "PKCS#11 (against soft crypto)" on the etherpad you linked before - any details on that? | 12:26 |
| alee | mhen, yeah - that was more aspirational -- nothing there | 12:27 |
| mhen | what does "soft crypto" mean actually? software-emulated HSM? | 12:27 |
| alee | yup | 12:27 |
| mhen | I see | 12:27 |
| mhen | something like Utimaco's simulator? https://hsm.utimaco.com/downloads/utimaco-portal/hsm-simulator/ | 12:28 |
| mhen | or something more abstract? | 12:28 |
| alee | yes - smething like that | 12:28 |
| mhen | but isn't PKCS11 already implemented? | 12:28 |
| alee | mhen, yes - but the only tests for it have been against HSMs | 12:29 |
| alee | mhen, and so there are no gates | 12:29 |
| alee | mhen, it would be great to have a soft HSM gate -- also as an option for those who cant afford an HSM | 12:29 |
| mhen | I see | 12:30 |
| mhen | so we'd need a free HSM emulator/simulator I guess | 12:30 |
| alee | of course, SGX fills that void too | 12:30 |
| alee | right | 12:30 |
| alee | and then we can create a gate job against that | 12:31 |
| alee | mhen, PKCS11 is tricky -- every vendor has their own idiosyncracies | 12:31 |
| alee | and then there are various versions | 12:31 |
| alee | we had some patches submitted to update the pkcs11 version, but we unable to merge without good testing | 12:32 |
| alee | mhen, Luzi - not sure if I've "met" you guys before. can you do a brief intro and explain your interest in barbican? | 12:33 |
| Luzi | mhen and i actually sit next to each other | 12:34 |
| Luzi | we work in the same team | 12:34 |
| mhen | that's right :) | 12:34 |
| Luzi | i started attending this meeting 2 weeks ago, to discuss aes-xts bit lengths | 12:34 |
| alee | Luzi, thats right -- I remember reviewing your patch the other day | 12:35 |
| Luzi | we proposed a patch therefore, you already reviewed it. | 12:35 |
| alee | cool | 12:35 |
| alee | (I know you're name sounded familiar) | 12:36 |
| mhen | our team is working on SecuStack, a security-enhanced OpenStack | 12:36 |
| alee | Luzi, I want to get feedback from redrobot and other folks on how best to fix the issue you raised | 12:37 |
| alee | mhen, cool - so using barbican for things like volume encryption and imge signing and swift object encrytion ? | 12:38 |
| Luzi | that's a good thing to hear | 12:38 |
| mhen | alee, exactly | 12:38 |
| alee | also octavia stuff? | 12:38 |
| alee | or magnum? | 12:38 |
| mhen | not yet | 12:38 |
| mhen | we're currently focusing on a minimal set of components | 12:39 |
| alee | what backends are you guys looking at? | 12:39 |
| mhen | alee, are you referring to Barbican backends? | 12:39 |
| alee | yup | 12:39 |
| alee | (I know you guys have been looking at SimpleCrypto :)) | 12:40 |
| mhen | we're currently evaluating the usage of a HSM, specifically one from Safenet | 12:40 |
| alee | great | 12:40 |
| mhen | but the SGX one sounds very interesting as well | 12:40 |
| mhen | this is worth checking out | 12:41 |
| alee | definitely. | 12:41 |
| alee | well good to meet you guys - welcome aboard! | 12:42 |
| mhen | thank you :) | 12:42 |
| Luzi | thanks :) | 12:42 |
| alee | anything else? | 12:42 |
| alee | ok -- till next week then .. | 12:43 |
| alee | #endmeeting | 12:43 |
| *** openstack changes topic to "Discussion about development of OpenStack Barbican and its client libraries. - Logs: http://eavesdrop.openstack.org/irclogs/%23openstack-barbican/" | 12:43 | |
| openstack | Meeting ended Tue Jul 3 12:43:11 2018 UTC. Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4) | 12:43 |
| openstack | Minutes: http://eavesdrop.openstack.org/meetings/barbican/2018/barbican.2018-07-03-12.00.html | 12:43 |
| openstack | Minutes (text): http://eavesdrop.openstack.org/meetings/barbican/2018/barbican.2018-07-03-12.00.txt | 12:43 |
| openstack | Log: http://eavesdrop.openstack.org/meetings/barbican/2018/barbican.2018-07-03-12.00.log.html | 12:43 |
| alee | #endmeeting barbican | 12:43 |
| mhen | btw, regarding the topic of HSMs, when I use "openstack secret order create key", is the secret supposed to be both generated _and_ stored in the HSM per default? (assuming the HSM connection has been configured correctly) | 12:45 |
| *** d063130_ has quit IRC | 12:45 | |
| *** sapcc-bot has quit IRC | 12:45 | |
| alee | mhen, if you're using the PKCS11 plugin, the only keys in the HSM are the master key | 12:46 |
| *** d063130_ has joined #openstack-barbican | 12:46 | |
| *** sapcc-bot has joined #openstack-barbican | 12:46 | |
| alee | mhen, the master key is used to encrypt the project KEKs which are stored in the db | 12:46 |
| alee | mhen, when a key is generated - it is generated in the HSM and wrapped with the project KEK | 12:47 |
| alee | and then stored in the db | 12:47 |
| alee | so - generated in the HSM, encrypted in the HSM, stored in the DB | 12:48 |
| *** serlex has joined #openstack-barbican | 12:48 | |
| mhen | alee, I see | 12:49 |
| mhen | alee, thanks for the quick rundown! | 12:49 |
| *** rmascena has joined #openstack-barbican | 12:51 | |
| *** raildo has quit IRC | 12:51 | |
| alee | mhen, no prob | 12:52 |
| mhen | is there any easy way to figure out, whether Barbican is actually using the HSM correctly in the backend? | 12:53 |
| alee | mhen, I recently created a sequence diagram for volume encryption with an hsm -- http://paste.openstack.org/show/724891/ | 12:54 |
| alee | mhen, put that into websequencediagrams.com | 12:55 |
| alee | mhen, when I've connected to an hsm, I usually have set pkcs11 logging on in the hsm - and have examined the pkcs11 logs | 12:56 |
| mhen | alee, the pkcs11 logging is a good hint! | 12:56 |
| mhen | alee, are all key encryption/decryption processes involing the PKEK (encrypting secrets) or MKEK (encrypting PKEKs) done on the HSM exclusively? | 13:03 |
| *** rmascena__ has joined #openstack-barbican | 13:17 | |
| *** rmascena has quit IRC | 13:20 | |
| alee | mhen, they have to be. | 13:24 |
| alee | mhen, the only time the PKEK and MKEK is in the clear is in the HSM | 13:24 |
| mhen | alee, just as I assumed - great! | 13:25 |
| mhen | alee, thank you for you answers! You saved me a lot of research. | 13:26 |
| alee | mhen, np - happy to help | 13:26 |
| *** jmlowe has quit IRC | 13:51 | |
| *** FrankZhang has quit IRC | 13:57 | |
| *** namnh has joined #openstack-barbican | 13:58 | |
| *** tidwellr has joined #openstack-barbican | 14:06 | |
| namnh | alee: Hi Ade | 14:15 |
| *** tidwellr has quit IRC | 14:15 | |
| namnh | Sorry, I did not join weekly meeting for this week. | 14:15 |
| *** tidwellr has joined #openstack-barbican | 14:16 | |
| namnh | alee: I got a lot of comments from you, and i think your comments are right for sure. | 14:16 |
| namnh | alee: i would like to discuss this issue with you on the patch: https://review.openstack.org/#/c/576409 | 14:17 |
| namnh | can you check it :) | 14:17 |
| *** jmlowe has joined #openstack-barbican | 14:19 | |
| alee | namnh, looking | 14:19 |
| alee | namnh, have not had a chance yet to look at your responses to my comments | 14:19 |
| alee | namnh, had a nice long train ride with wifi so I could catch up on reviews | 14:20 |
| *** tidwellr has quit IRC | 14:21 | |
| namnh | alee: really, you are on vacation :) | 14:23 |
| *** rmascena__ has quit IRC | 14:24 | |
| alee | namnh, yeah last day .. nothing else to do on the train | 14:29 |
| alee | namnh, anyways -- looking | 14:29 |
| *** raildo has joined #openstack-barbican | 14:30 | |
| namnh | alee: thanks for great support :) i believe you had a great vacation | 14:31 |
| namnh | alee: no problem, i can wait for your comment. :) | 14:31 |
| alee | namnh, just a question -- what do you mean by a default value of this ? | 14:32 |
| alee | you mean a default value of true? | 14:32 |
| alee | A solution I have for now that. I will add a parameter with the __init__ method (named check_exception for example) and the default value of this. | 14:33 |
| alee | namnh, ^^ your comment | 14:34 |
| *** tidwellr has joined #openstack-barbican | 14:34 | |
| *** Luzi has quit IRC | 14:35 | |
| alee | or - I guess that wont work -- because OVO needs to instantiate with no args , right? | 14:35 |
| namnh | alee: yes, the default value of the parameter is True. Normally, when previous code call the model then the value of parameter is True and the code still raise exception | 14:36 |
| alee | namnh, ok - thats fine then | 14:36 |
| namnh | But when OVO call model then OVO will pass the value is False then exception can not be raised. | 14:37 |
| alee | namnh, yup - thats fine | 14:37 |
| namnh | After OVO done, then we can remove the parameter. | 14:37 |
| alee | ack | 14:37 |
| namnh | what do you think? | 14:37 |
| alee | works for me | 14:37 |
| namnh | ok, so i will try to push a new patch set to declare the idea | 14:38 |
| alee | (I commented as such on the review) | 14:38 |
| alee | cool | 14:39 |
| *** tidwellr has quit IRC | 14:39 | |
| namnh | got your comment, thanks. i will do it. | 14:39 |
| alee | namnh, cool -- thanks for sticking with all these reviews -- lots of changes! | 14:40 |
| *** FrankZhang has joined #openstack-barbican | 14:40 | |
| namnh | :))) | 14:42 |
| namnh | thanks | 14:42 |
| *** jmlowe has quit IRC | 14:43 | |
| *** jmlowe has joined #openstack-barbican | 14:45 | |
| *** serlex has left #openstack-barbican | 15:01 | |
| *** peereb has quit IRC | 15:05 | |
| *** namnh has quit IRC | 15:44 | |
| *** namnh has joined #openstack-barbican | 15:44 | |
| *** namnh has quit IRC | 15:58 | |
| *** namnh has joined #openstack-barbican | 16:05 | |
| *** namnh has quit IRC | 16:10 | |
| *** namnh has joined #openstack-barbican | 17:54 | |
| *** namnh has quit IRC | 17:59 | |
| *** FrankZhang has quit IRC | 18:44 | |
| *** namnh has joined #openstack-barbican | 19:42 | |
| *** namnh has quit IRC | 19:47 | |
| *** abishop has quit IRC | 20:20 | |
| *** jmlowe has quit IRC | 20:26 | |
| *** raildo has quit IRC | 20:54 | |
| *** namnh has joined #openstack-barbican | 21:30 | |
| *** namnh has quit IRC | 21:34 | |
| *** jmlowe has joined #openstack-barbican | 22:36 | |
| *** namnh has joined #openstack-barbican | 22:41 | |
| *** namnh_ has joined #openstack-barbican | 22:46 | |
| *** namnh has quit IRC | 22:48 | |
| openstackgerrit | Nam Nguyen Hoai proposed openstack/barbican master: Update two Barbican services to Docs https://review.openstack.org/576051 | 23:09 |
| *** namnh_ has quit IRC | 23:15 | |
| *** antosh has joined #openstack-barbican | 23:22 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!