Wednesday, 2014-11-19

*** david-lyle is now known as david-lyle_afk00:06
*** jorge_munoz has left #openstack-barbican00:09
*** kebray has joined #openstack-barbican00:13
*** liam_ has joined #openstack-barbican00:25
*** liam_ is now known as Guest5097700:25
*** Guest50977 has quit IRC00:26
*** stanzi has joined #openstack-barbican00:34
*** stanzi has quit IRC00:38
*** ayoung has quit IRC01:09
*** nkinder has joined #openstack-barbican01:09
*** jorge_munoz has joined #openstack-barbican01:39
*** gyee has quit IRC01:40
*** jorge_munoz has quit IRC01:42
*** jorge_munoz has joined #openstack-barbican01:42
*** jorge_munoz has quit IRC01:44
*** kebray has quit IRC01:45
*** zz_dimtruck is now known as dimtruck01:55
*** ayoung has joined #openstack-barbican02:05
*** bdpayne_ has quit IRC02:07
*** dave-mccowan has joined #openstack-barbican02:28
*** ryanpetrello has quit IRC02:32
*** ryanpetrello has joined #openstack-barbican02:34
*** dave-mccowan has quit IRC02:35
*** dave-mccowan has joined #openstack-barbican02:37
*** woodster_ has quit IRC02:40
*** dave-mccowan has quit IRC02:50
openstackgerritAde Lee proposed openstack/barbican-specs: Add Cert API Spec.  https://review.openstack.org/13549002:51
*** bdpayne has joined #openstack-barbican02:55
*** bdpayne has quit IRC03:04
*** miqui has joined #openstack-barbican03:07
miquinewbie question: can i run barbican standalone?03:08
miqui..thanks in adv..03:08
rm_youmiqui: yes03:09
miquirm_you: ...cool.. thanks03:10
rm_youI believe it is as easy as:03:10
miquimost use it as part of openstack... or as a standalone component...03:10
rm_youpython setup install03:11
miquicool.. great...03:11
rm_youthough there is also a script in bin/ that is like "barbican-install.sh" I think03:11
miqui...thanks i will check it out...03:11
rm_youwhich will install the deps and run the tests and then run the app03:11
rm_younp03:11
miquionce i learn a little more about it, might start to contrib...03:11
miquiperhaps i could start with just reviews...03:11
rm_youreading reviews can be a good way to get started, but it can also be hard to make sense of them at first :)03:12
miquihmmm yeah ..that is one drawback...03:12
rm_youI started by having a thing I needed to patch, and just diving in and trying to swim :P03:12
miqui..and no life jackets....03:13
miqui...thanks rm_you03:13
rm_youyeah no problem, good luck!03:14
rm_youthis is the off time for most contributors, so I don't know your timezone but there is much more activity here between like 10:00 - 18:00 CST03:15
*** ryanpetrello has quit IRC03:20
*** ryanpetrello has joined #openstack-barbican03:22
*** jorge_munoz has joined #openstack-barbican03:49
*** jorge_munoz has quit IRC03:50
*** jorge_munoz has joined #openstack-barbican03:58
*** jorge_munoz has quit IRC04:00
*** jorge_munoz has joined #openstack-barbican04:12
*** ayoung is now known as ayoung-ZZZzzzZzz04:13
*** jorge_munoz has quit IRC04:15
*** ryanpetrello has quit IRC04:54
*** jorge_munoz has joined #openstack-barbican05:00
*** dimtruck is now known as zz_dimtruck05:01
*** jorge_munoz has quit IRC05:04
*** miqui has quit IRC05:44
*** david-lyle_afk has quit IRC06:12
*** Nirupama has joined #openstack-barbican08:28
*** hyakuhei has quit IRC09:26
*** jamielennox is now known as jamielennox|away09:41
*** hyakuhei has joined #openstack-barbican10:04
openstackgerritTim Kelsey proposed openstack/barbican: Adding client certificates to connection credentials  https://review.openstack.org/13521712:05
*** jaosorior has joined #openstack-barbican13:12
*** rellerreller has joined #openstack-barbican13:28
rellerrelleralee_ ping13:29
*** ayoung-ZZZzzzZzz is now known as ayoung13:33
*** ryanpetrello has joined #openstack-barbican13:48
*** zz_dimtruck is now known as dimtruck13:53
alee_rellerreller, yo13:56
rellerrelleralee_ when you wrap the keys using the transport key how do you do that?13:57
rellerrellerAre you just encrypting or signing too?13:57
rellerrellerI'm working on the content types spec and am wondering what specs you are using to the transport key wrapping.13:57
alee_rellerreller, just encrypting iirc. let me get back to you -- need to joina meeting.13:58
rellerrelleralee_ ok see you later13:58
*** Nirupama has quit IRC14:00
*** rellerreller has quit IRC14:02
*** dimtruck is now known as zz_dimtruck14:03
*** woodster_ has joined #openstack-barbican14:17
*** openstackgerrit has quit IRC14:33
*** openstackgerrit has joined #openstack-barbican14:34
*** stanzi has joined #openstack-barbican14:35
*** dave-mccowan has joined #openstack-barbican14:37
*** dave-mccowan_ has joined #openstack-barbican14:39
*** dave-mccowan has quit IRC14:42
*** dave-mccowan_ is now known as dave-mccowan14:42
*** tdink has joined #openstack-barbican14:42
*** akoneru has joined #openstack-barbican14:46
*** openstackgerrit has quit IRC14:49
*** akoneru has quit IRC14:49
*** rellerreller has joined #openstack-barbican14:49
*** akoneru has joined #openstack-barbican14:49
*** openstackgerrit has joined #openstack-barbican14:49
*** paul_glass has joined #openstack-barbican14:50
*** stanzi has quit IRC14:51
*** stanzi has joined #openstack-barbican14:52
alee_rellerreller, ping15:15
rellerrelleralee_ pong15:15
alee_rellerreller, so what we're doing is generating a symmetric key -- wrapping that symmetric key with the traqnsport key - and then wrapping the data with the symmetric key15:16
rellerrelleralee_ How are you wrapping things?15:16
alee_rellerreller, we allow you to choose the parameters for the symmetric key wrapping - though in practice it looks like dogtag is expecting des3_cbc_pad15:17
alee_(with the client also sending over a random IV)15:17
rellerrellerOK, so the blob is simply the bytes of the encrypted data using des3_cbc_pad?15:18
*** stanzi has quit IRC15:18
rellerrelleralee_ So there are two blobs. One is the request (from client to server) that contains symmetric key and IV. The other is the response and this contains the encrypted data. Correct?15:19
alee_well the blob consists of an asn1 structure that includes 1) the wrapped session key 2) the data wrapped with the session key 3) wrapping parameters like the IV15:19
rellerrellerCan you point me to documentation on those structures and the encoding?15:20
alee_rellerreller, yeah -- getting the rfc up -- it will be whats in crmf15:21
alee_rellerreller, http://tools.ietf.org/html/rfc2511 section 6.4 (Archive Options Control()15:21
*** JeffF has joined #openstack-barbican15:21
rellerrelleralee_ Thanks!15:22
alee_rellerreller, btw - please review the cert api spec I put up yesterday as well as some of the cert ones already out there.15:23
alee_rellerreller, would like to start wrapping those up soon.15:23
rellerrelleralee_ OK, that will be tough today. I will try for tomorrow or Friday.15:24
alee_sure thanks15:28
*** rellerreller has quit IRC16:01
*** liam_ has joined #openstack-barbican16:04
*** liam_ is now known as Guest969116:04
*** Guest9691 has quit IRC16:05
*** kebray has joined #openstack-barbican16:08
*** dave-mccowan has quit IRC16:12
*** atiwari has joined #openstack-barbican16:15
*** dave-mccowan has joined #openstack-barbican16:26
openstackgerritMerged openstack/barbican: Moved secret functional tests to data driven tests  https://review.openstack.org/13508916:31
*** ametts has joined #openstack-barbican16:32
*** stanzi has joined #openstack-barbican16:36
*** stanzi has quit IRC16:37
*** stanzi has joined #openstack-barbican16:37
*** stanzi has quit IRC16:45
*** gyee has joined #openstack-barbican16:45
*** stanzi has joined #openstack-barbican16:50
*** stanzi has quit IRC16:53
*** jaosorior has quit IRC16:53
*** stanzi has joined #openstack-barbican16:53
openstackgerritDouglas Mendizábal proposed openstack/python-barbicanclient: Add Usage documentation  https://review.openstack.org/13534217:03
redrobotpykmip is on its way to merging into global requirements :) https://review.openstack.org/#/c/114037/17:04
*** stanzi has quit IRC17:07
*** stanzi has joined #openstack-barbican17:08
*** stanzi_ has joined #openstack-barbican17:19
*** stanzi has quit IRC17:22
*** stanzi has joined #openstack-barbican17:26
*** stanzi_ has quit IRC17:29
*** stanzi has quit IRC17:30
*** stanzi has joined #openstack-barbican17:31
*** stanzi has quit IRC17:46
*** stanzi has joined #openstack-barbican17:52
*** stanzi has quit IRC17:54
*** stanzi has joined #openstack-barbican17:55
*** stanzi_ has joined #openstack-barbican17:56
*** stanzi has quit IRC17:57
*** stanzi_ has quit IRC17:57
*** stanzi has joined #openstack-barbican17:57
*** stanzi_ has joined #openstack-barbican17:59
*** stanzi has quit IRC18:00
*** paul_glass has quit IRC18:00
*** kebray has quit IRC18:02
*** stanzi_ has quit IRC18:09
*** stanzi has joined #openstack-barbican18:10
*** stanzi_ has joined #openstack-barbican18:11
*** stanzi has quit IRC18:11
*** stanzi has joined #openstack-barbican18:12
*** stanzi_ has quit IRC18:12
*** stanzi has quit IRC18:14
*** stanzi has joined #openstack-barbican18:14
*** akoneru has quit IRC18:18
*** stanzi has quit IRC18:22
*** stanzi has joined #openstack-barbican18:23
*** stanzi has quit IRC18:24
*** stanzi has joined #openstack-barbican18:25
*** jaosorior has joined #openstack-barbican18:25
*** stanzi_ has joined #openstack-barbican18:26
*** dave-mccowan has quit IRC18:27
*** stanzi__ has joined #openstack-barbican18:27
*** stanzi__ has quit IRC18:28
*** stanzi__ has joined #openstack-barbican18:28
*** stanzi has quit IRC18:29
*** stanzi__ has quit IRC18:29
*** stanzi has joined #openstack-barbican18:29
*** stanzi_ has quit IRC18:30
*** stanzi has quit IRC18:30
*** stanzi has joined #openstack-barbican18:31
*** stanzi has quit IRC18:32
*** stanzi_ has joined #openstack-barbican18:33
*** stanzi__ has joined #openstack-barbican18:34
*** stanzi__ has quit IRC18:34
*** stanzi__ has joined #openstack-barbican18:35
*** stanzi_ has quit IRC18:35
*** stanzi__ has quit IRC18:35
*** stanzi has joined #openstack-barbican18:36
*** david-lyle has joined #openstack-barbican18:40
*** dave-mccowan has joined #openstack-barbican18:41
*** dave-mccowan_ has joined #openstack-barbican18:44
*** dave-mccowan has quit IRC18:45
*** dave-mccowan_ is now known as dave-mccowan18:45
*** stanzi has quit IRC18:49
*** stanzi has joined #openstack-barbican18:50
*** stanzi_ has joined #openstack-barbican18:51
*** stanzi has quit IRC18:51
*** stanzi has joined #openstack-barbican18:52
*** stanzi_ has quit IRC18:52
*** tdink has quit IRC18:53
*** stanzi has quit IRC18:53
*** stanzi_ has joined #openstack-barbican18:54
*** stanzi_ has quit IRC18:54
*** stanzi has joined #openstack-barbican18:55
*** stanzi has quit IRC18:56
*** stanzi has joined #openstack-barbican18:56
*** tdink has joined #openstack-barbican18:57
*** stanzi has quit IRC18:57
*** stanzi has joined #openstack-barbican18:57
*** stanzi has quit IRC18:58
*** stanzi_ has joined #openstack-barbican19:01
*** stanzi_ has quit IRC19:02
*** stanzi_ has joined #openstack-barbican19:02
*** stanzi_ has quit IRC19:03
*** stanzi has joined #openstack-barbican19:04
*** jorge_munoz has joined #openstack-barbican19:04
*** paul_glass has joined #openstack-barbican19:06
*** stanzi_ has joined #openstack-barbican19:06
*** stanzi_ has quit IRC19:07
*** tdink has quit IRC19:07
*** stanzi has quit IRC19:07
*** zz_dimtruck is now known as dimtruck19:07
*** stanzi_ has joined #openstack-barbican19:07
*** stanzi_ has quit IRC19:08
*** stanzi has joined #openstack-barbican19:09
*** stanzi has quit IRC19:09
*** stanzi has joined #openstack-barbican19:10
*** stanzi has quit IRC19:11
*** stanzi has joined #openstack-barbican19:11
*** stanzi has quit IRC19:12
*** stanzi has joined #openstack-barbican19:12
*** stanzi has quit IRC19:13
*** stanzi has joined #openstack-barbican19:13
*** stanzi has quit IRC19:14
*** stanzi has joined #openstack-barbican19:15
*** ryanpetrello_ has joined #openstack-barbican19:15
*** stanzi_ has joined #openstack-barbican19:16
*** dimtruck is now known as zz_dimtruck19:17
*** kebray has joined #openstack-barbican19:17
*** ryanpetrello has quit IRC19:17
*** ryanpetrello_ is now known as ryanpetrello19:17
*** stanzi__ has joined #openstack-barbican19:17
*** stanzi_ has quit IRC19:17
*** stanzi__ has quit IRC19:18
*** stanzi has quit IRC19:18
*** jorge_munoz has quit IRC19:18
*** stanzi has joined #openstack-barbican19:18
*** jorge_munoz has joined #openstack-barbican19:19
*** stanzi has quit IRC19:19
*** stanzi has joined #openstack-barbican19:19
*** stanzi has quit IRC19:20
*** stanzi has joined #openstack-barbican19:21
*** stanzi has quit IRC19:21
*** stanzi has joined #openstack-barbican19:22
*** stanzi has quit IRC19:23
*** stanzi has joined #openstack-barbican19:23
*** stanzi has quit IRC19:24
*** stanzi has joined #openstack-barbican19:24
*** stanzi has quit IRC19:25
*** stanzi_ has joined #openstack-barbican19:25
*** stanzi_ has quit IRC19:32
*** stanzi has joined #openstack-barbican19:32
woodster_atiwari, I responded to your comment on https://review.openstack.org/#/c/135158, please let me know if that is what you were referring to though....19:33
*** zz_dimtruck is now known as dimtruck19:38
jaosoriorwoodster_: I commented on that spec, what do you think?19:38
*** tdink has joined #openstack-barbican19:39
atiwariwoodster_, thanks, I am good now.19:39
*** paul_glass has quit IRC19:40
woodster_jaosorior, atiwari, redrobot, yeah I just workflow -1-ed that CR...questioning if we even need a Tenant entity anymore. If we will handle all access via access control lists on secrets/containers/orders, then why is a tenant association even needed?19:41
*** JeffF has quit IRC19:41
*** JeffF has joined #openstack-barbican19:41
jaosorioryou have a point19:42
jaosoriorbut I guess it would depend on the implementation of the ACLs19:42
*** kebray has quit IRC19:43
*** paul_glass has joined #openstack-barbican19:43
atiwariwoodster_, as suggested we can have the tenant_id (the woning one) in the ACL's default white list19:43
*** kebray has joined #openstack-barbican19:44
atiwarithat way we don't have to make any change in the secret model but we have to remove the tenant_id from Orders and Containers later.19:45
*** rtom has joined #openstack-barbican19:46
*** dimtruck is now known as zz_dimtruck19:47
chellygelalee_, im doing some research into this CMC stuff -- which CAs do you know that are accepting cmc?19:51
chellygeli know dogtag does, i have seen the docs19:51
chellygelwindows -- also, right?19:51
alee_chellygel, yup19:54
chellygelany others?19:55
alee_chellygel, I would be very surprised if symantec didn't. certainly they support simple cmc -- which is just pkcs1019:55
chellygeli sent an email off to our contact there alee_ . i mean CSRs sure19:55
alee_chellygel, but you ave the api docs19:55
chellygelalee_,  its not necessarily the source of truth for everything19:56
*** darrenmoffat has quit IRC19:56
*** darrenmoffat has joined #openstack-barbican19:56
chellygeleven the API only expects the CSR19:56
alee_well that will get you most of the way19:59
chellygelso a CSR is required for part of the CMC? alee_ ?20:06
chellygelor is there something in addition to that?20:06
alee_chellygel, simple cmc is the same as a PKCS10 Certfication Request20:08
alee_(which is a CSR)20:08
alee_chellygel, https://tools.ietf.org/html/rfc5272#section-3.2 for specification of a full cmc request20:09
*** david-lyle is now known as david-lyle_afk20:10
*** stanzi has quit IRC20:13
*** jorge_munoz has quit IRC20:16
*** jorge_munoz has joined #openstack-barbican20:18
woodster_atiwari, jaosorior, agreed about the tenant_id in the white list by default20:23
openstackgerritMerged openstack/python-barbicanclient: Add Usage documentation  https://review.openstack.org/13534220:34
rm_workreaperhulk: hey, at some point I'd like to walk through our LBaaS TLS security workflow with you -- need some feedback from people with good security experience20:35
reaperhulkrm_work: I can give you time tomorrow, how does 2pm central sound?20:38
reaperhulkthat comma should be a semicolon or somethin'20:38
rm_workreaperhulk: heh, should work, are you going to be at the castle?20:46
reaperhulkNo I am on an island, but we can hop on vidyo if you'd like20:46
rm_workheh20:46
reaperhulkotherwise we can just talk it through on IRC20:46
rm_workwas wondering if you were currently off galavanting about20:47
rm_workI have some diagrams, IRC should be ok I think20:47
reaperhulkokay, sounds good20:51
rm_workreaperhulk: sent you a meeting invite so I don't lose track of it :)21:11
openstackgerritOpenStack Proposal Bot proposed openstack/python-barbicanclient: Updated from global requirements  https://review.openstack.org/13524321:11
*** tdink has quit IRC21:23
*** paul_glass has quit IRC21:24
*** tdink has joined #openstack-barbican21:25
*** jorge_munoz has quit IRC21:25
*** gyee has quit IRC21:26
*** jorge_munoz has joined #openstack-barbican21:26
openstackgerritSteve Heyman proposed openstack/barbican-specs: Add spec to support running functional tests as different users  https://review.openstack.org/13572421:32
*** paul_glass has joined #openstack-barbican21:36
hockeynutquick link to the pretty version of the spec: http://docs-draft.openstack.org/24/135724/1/check/gate-barbican-specs-docs/3b51073/doc/build/html/specs/kilo/add-run-as-for-functional-tests.html21:42
*** jamielennox|away is now known as jamielennox21:54
*** paul_glass has quit IRC21:58
rm_workhockeynut: wait what is that site21:59
rm_workhow did you get that link21:59
redrobotrm_work you can click through on the "docs" job in Gerrit to go to the generated html21:59
redrobotrm_work works on a lot of stuff.21:59
hockeynutjust followed the link to the built docs from the job21:59
rm_workah22:00
rm_workok22:00
redrobotrm_work approved specs end up here: http://specs.openstack.org/openstack/barbican-specs/22:00
rm_workbecause we built docs.octavia.io22:00
rm_workwhich apparently is the exact same thing22:00
rm_workbecause we wanted *that*22:00
redrobotrm_work weird.... infra has a lot of stuff in place for docs22:00
rm_workwe don't have a docs gate job though T_T22:00
redrobotrm_work http://docs.openstack.org/developer/barbican/ for example22:01
rm_workyeah we wanted docs that were still in review22:01
rm_workwhich it looks like that does22:01
redrobotrm_work I just added the jobs for python-barbicanclient yesterday.  https://review.openstack.org/#/c/135449/22:01
*** rtom has quit IRC22:07
*** openstackgerrit has quit IRC22:10
*** openstackgerrit has joined #openstack-barbican22:10
openstackgerritDouglas Mendizábal proposed openstack/barbican-specs: Remove Kilo placeholder file  https://review.openstack.org/13574422:18
*** ryanpetrello has quit IRC22:39
*** david-lyle_afk is now known as david-lyle22:50
*** tdink has quit IRC22:51
*** tdink has joined #openstack-barbican22:53
*** hockeynut_ has joined #openstack-barbican22:56
*** hockeynut_ has quit IRC23:01
*** tdink has quit IRC23:02
openstackgerritMerged openstack/python-barbicanclient: Updated from global requirements  https://review.openstack.org/13524323:06
*** jaosorior has quit IRC23:33
*** tdink_ has joined #openstack-barbican23:35
openstackgerritDouglas Mendizábal proposed openstack/barbican-specs: Introduce the concept of an Active SecretStore  https://review.openstack.org/13577923:37
*** kebray has quit IRC23:39
*** kebray has joined #openstack-barbican23:39
*** tdink_ has quit IRC23:46
*** tdink_ has joined #openstack-barbican23:51
*** atiwari has quit IRC23:55
openstackgerritDouglas Mendizábal proposed openstack/barbican-specs: Introduce the concept of an Active SecretStore  https://review.openstack.org/13577923:56

Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!