<html><head><style>body{font-family:Helvetica,Arial;font-size:13px}</style></head><body style="word-wrap:break-word"><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px;color:rgba(0,0,0,1.0);margin:0px;line-height:auto">This sounds like a good idea for a package that depends on cryptography, but not in cryptography itself. If you decide to do that please let me know as I'd love to see it!</div> <div><br></div>-Paul Kehrer (reaperhulk)<br> <div id="bloop_sign_1482189389134533888" class="bloop_sign"></div> <br><p class="airmail_on">On December 19, 2016 at 3:19:08 PM, Alex Gaynor (<a href="mailto:alex.gaynor@gmail.com">alex.gaynor@gmail.com</a>) wrote:</p> <blockquote type="cite" class="clean_bq"><span><div><div></div><div>
<title></title>
<div dir="ltr">I'm opposed -- there's no benefit to this being in
cryptography itself; this API can be totally implemented outside of
it.
<div><br></div>
<div>Alex</div>
</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Mon, Dec 19, 2016 at 4:17 PM, Boris
Bobrov <span dir="ltr"><<a href="mailto:bbobrov@mirantis.com" target="_blank">bbobrov@mirantis.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hi!<br>
<br>
I work on OpenStack Keystone. We use Fernet keys for our tokens.
A<br>
token is a basically a tuple encrypted with fernet key.<br>
<br>
Fernet keys need to be rotated once in a while. Now we store them
on<br>
disk. But it is problematic to rotate them in containers,
because<br>
containers are supposed to be immutable.<br>
<br>
So idea of key storages came up. For example, we could store
the<br>
keys in a database. Or in OpenStack Barbican, which is a REST
API<br>
designed for the secure storage, provisioning and management
of<br>
secrets such as encryption keys. Or in Custodia,<br>
<a href="https://github.com/latchset/custodia" rel="noreferrer" target="_blank">https://github.com/latchset/<wbr>custodia</a><br>
<br>
However, it doesn't sound like this should be in Keystone. It
is<br>
not keystone-specific and all Fernet keys users will probably<br>
benefit of that. What do you think about adding this sort of<br>
functionality to cryptography?<br>
<br>
The idea is to define an abstract class in cryptography for a
storage.<br>
An instance of storage will be passed to MultiFernet, which
will<br>
read the keys from there, create individual instances of<br>
fernet.Fernet and perform all the usual stuff. Storage classes
can<br>
be implemented inside cryptography or outside of it.<br>
<br>
What do you think about this?<br>
______________________________<wbr>_________________<br>
Cryptography-dev mailing list<br>
<a href="mailto:Cryptography-dev@python.org">Cryptography-dev@python.org</a><br>
<a href="https://mail.python.org/mailman/listinfo/cryptography-dev" rel="noreferrer" target="_blank">https://mail.python.org/<wbr>mailman/listinfo/cryptography-<wbr>dev</a><br>
</blockquote>
</div>
<br>
<br clear="all">
<div><br></div>
--<br>
<div class="gmail_signature" data-smartmail="gmail_signature">
<div dir="ltr">
<div>
<div dir="ltr">"I disapprove of what you say, but I will defend to
the death your right to say it." -- Evelyn Beatrice Hall
(summarizing Voltaire)<br>
"The people's good is the highest law." -- Cicero</div>
<div dir="ltr">GPG Key fingerprint: D1B3 ADC0 E023 8CA6<br>
<div><br></div>
</div>
</div>
</div>
</div>
</div>
_______________________________________________
<br>Cryptography-dev mailing list
<br><a href="mailto:Cryptography-dev@python.org">Cryptography-dev@python.org</a>
<br><a href="https://mail.python.org/mailman/listinfo/cryptography-dev">https://mail.python.org/mailman/listinfo/cryptography-dev</a>
<br></div></div></span></blockquote></body></html>