{"action":"created","issue":{"url":"https://api.github.com/repos/minio/minio/issues/2692","repository_url":"https://api.github.com/repos/minio/minio","labels_url":"https://api.github.com/repos/minio/minio/issues/2692/labels{/name}","comments_url":"https://api.github.com/repos/minio/minio/issues/2692/comments","events_url":"https://api.github.com/repos/minio/minio/issues/2692/events","html_url":"https://github.com/minio/minio/issues/2692","id":176940416,"number":2692,"title":"server: Support server side encryption of objects","user":{"login":"theonewolf","id":522248,"avatar_url":"https://avatars.githubusercontent.com/u/522248?v=3","gravatar_id":"","url":"https://api.github.com/users/theonewolf","html_url":"https://github.com/theonewolf","followers_url":"https://api.github.com/users/theonewolf/followers","following_url":"https://api.github.com/users/theonewolf/following{/other_user}","gists_url":"https://api.github.com/users/theonewolf/gists{/gist_id}","starred_url":"https://api.github.com/users/theonewolf/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/theonewolf/subscriptions","organizations_url":"https://api.github.com/users/theonewolf/orgs","repos_url":"https://api.github.com/users/theonewolf/repos","events_url":"https://api.github.com/users/theonewolf/events{/privacy}","received_events_url":"https://api.github.com/users/theonewolf/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/minio/minio/labels/community","name":"community","color":"1d76db"},{"url":"https://api.github.com/repos/minio/minio/labels/low-priority","name":"low-priority","color":"c7def8"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":9,"created_at":"2016-09-14T15:33:20Z","updated_at":"2016-09-19T19:49:55Z","closed_at":null,"body":"This is a feature request.\r\n\r\nFor enterprise environments, it is crucial that storage systems have encrypted storage capabilities.\r\n\r\nMinimally you will want to use something like AES with 256-bit keys and key rotation.\r\n\r\nI **highly** suggest adding support for encrypting with Vault (https://www.vaultproject.io, https://github.com/hashicorp/vault also written in Go) which has started seeing use within enterprise environments already.\r\n\r\nVault would provide all of the cryptography, parameters, and key management.  It is critical that these things are managed centrally as well for enterprise users.  If every subsystem manages users and credentials independently, things quickly become an operational nightmare.\r\n\r\nMinio is unusable for us and others until we have strong cryptography both in flight (I think this is in progress for you guys) and at rest.\r\n\r\nHowever, Minio is one of the best storage projects I've seen in a long time.  Keep up the good work :+1:.\r\n\r\nAlso, in case you need any help, @jefferai and team are very responsive some of the best developers in industry (IMHO)."},"comment":{"url":"https://api.github.com/repos/minio/minio/issues/comments/248102958","html_url":"https://github.com/minio/minio/issues/2692#issuecomment-248102958","issue_url":"https://api.github.com/repos/minio/minio/issues/2692","id":248102958,"user":{"login":"theonewolf","id":522248,"avatar_url":"https://avatars.githubusercontent.com/u/522248?v=3","gravatar_id":"","url":"https://api.github.com/users/theonewolf","html_url":"https://github.com/theonewolf","followers_url":"https://api.github.com/users/theonewolf/followers","following_url":"https://api.github.com/users/theonewolf/following{/other_user}","gists_url":"https://api.github.com/users/theonewolf/gists{/gist_id}","starred_url":"https://api.github.com/users/theonewolf/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/theonewolf/subscriptions","organizations_url":"https://api.github.com/users/theonewolf/orgs","repos_url":"https://api.github.com/users/theonewolf/repos","events_url":"https://api.github.com/users/theonewolf/events{/privacy}","received_events_url":"https://api.github.com/users/theonewolf/received_events","type":"User","site_admin":false},"created_at":"2016-09-19T19:49:55Z","updated_at":"2016-09-19T19:49:55Z","body":"Yeah, @krishnasrinivas you're right S3 has built-in support for encryption (as does EBS and other storage services).\r\n\r\nIt's a bit philosophical, but I'm proposing that all modern storage systems should consider cryptography as a fundamental feature.  Similar to how any serious web server project must include support for HTTPS these days.\r\n\r\nHowever, I'd be willing to concede that the layer Minio is placing itself in the stack should not do cryptography.  For example, we could require the host system to implement cryptography either in the native file system (such as ZFS), or in the block layer of the host (a la dm-crypt).\r\n\r\nI wouldn't mind that, except sometimes you don't get to control the parameters of your host file system or block layer (although that could be a minority of Minio deployments).  There's still something \"nice\" about the objects being encrypted, especially if the keys are controlled by some centralized service or node such as Vault.\r\n\r\nIf Minio objects are encrypted, that means even if a Minio server is broken into, it doesn't necessarily compromise the objects on the host file system.\r\n\r\nAlso, placing the burden of cryptography into a lower-level system such as ZFS or dm-crypt does not solve the Minio multi-tenant (although I think Minio is largely single tenant right now?) case where multiple users of Minio want their objects encrypted with different keys.\r\n\r\nI suppose that's why you suggest using a proxy into Minio that encrypts objects passing through it."}}
{"actor":{"display_login":"theonewolf"}}