Signing and encryption support for messages
Add signing and encryption for messages.
Blueprint information
- Status:
- Started
- Approver:
- Mark McLoughlin
- Priority:
- Medium
- Drafter:
- Simo Sorce
- Direction:
- Approved
- Assignee:
- None
- Definition:
- Approved
- Series goal:
- None
- Implementation:
-
Slow progress
- Milestone target:
- None
- Started by
- Mark McLoughlin
- Completed by
Related branches
Related bugs
Sprints
Whiteboard
Deferred until Icehouse - http://
---
Ongoing discussion here: http://
etherpad: https:/
Current patches:
https:/
https:/
https:/
---
(historical notes)
Simo and I had some offline discussion about whether we can land this stuff before the keystone key-distributio
Right now, the code has a "FIXME: fetch from server" which basically means the code can't be used right now. I don't think we should merge this code into Oslo until there's some way of testing it.
I suggested the idea of supporting multiple key distribution strategies and implementing a very hacky one to begin with - e.g. a SEK cache file (with the same permissions as secure_message_key file) which would contain an SEK for each peer pair. On the "key server" we'd have all the secret keys, a file which describes the peer relationships and a script to generate the SEK caches with a long TTL. These SEK caches could be distributed with e.g. scp or shared storage.
That might not be something we'd ever recommend people use in any sort of a production environment, but it could allow us to test the code paths in e.g. devstack or SmokeStack.
Simo's preference is to push forward with the keystone kds work and only fallback to a simpler, interim distribution strategy if the keystone work gets stalled.
Given all that, I'm moving this to the havana-2 milestone since havana-1 is two weeks away. -- markmc
----
As requested by ttx, I've set the status to Blocked pending progress on the kds side -- markmc
---
Unclear to me what's happening with KDS at this point, see http://
---
I adjusted the priority to medium, to reflect the fact that the key-distributio
---
Removed from icehouse from now - unless something changes dramatically, it's not going to make it -- @markmc
Gerrit topic: https:/
Addressed by: https:/
Adds message security plugins
Addressed by: https:/
Add simple hmac adding and validating
Work Items
Dependency tree
* Blueprints in grey have been implemented.
