# Any crypto geeks lurking?

**URL:** <https://discourse.chef.io/t/any-crypto-geeks-lurking/5399>\
**Category:** Chef Infra (archive)\
**Created:** [June 11, 2014, 7:36pm UTC](https://discourse.chef.io/t/any-crypto-geeks-lurking/5399 "2014-06-11T19:36:40Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bryan\_McLellan2](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/bryan_mclellan2/32/185_2.png) [@Bryan\_McLellan2](https://discourse.chef.io/u/Bryan_McLellan2)\
**Post date:** [June 11, 2014, 7:36pm UTC](https://discourse.chef.io/t/any-crypto-geeks-lurking/5399/1 "2014-06-11T19:36:40Z")

</div>

Given the frequency of small bugs in being found in crypto  
implementations in open source projects recently, it would be great to  
get some detailed review of the encrypted data bag feature. We sort of  
built the crypto bits ourselves, albeit on top of OpenSSL. Anyone up  
for that?

Xabier has been working on a version 3 of encrypted data bags, please  
take a look if you're into this sort of thing.

> <https://github.com/chef/chef/pull/1474>

--  
Bryan McLellan | chef | software engineer  
(c) 206.607.7108 | (t) @btmspox | (www) [http://getchef.com](http://getchef.com)

---

<div class="post-metadata">

**Author:** ![Michael\_Fischer](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/michael_fischer/32/136_2.png) [@Michael\_Fischer](https://discourse.chef.io/u/Michael_Fischer)\
**Post date:** [June 11, 2014, 7:51pm UTC](https://discourse.chef.io/t/any-crypto-geeks-lurking/5399/2 "2014-06-11T19:51:54Z")

</div>

Is the analysis you're asking for limited to a crypto review of the  
encrypted data bags feature as it currently exists, or are you asking our  
opinion of secrets storage in general?

--Michael

On Wed, Jun 11, 2014 at 12:36 PM, Bryan McLellan [btm@getchef.com](mailto:btm@getchef.com) wrote:

> Given the frequency of small bugs in being found in crypto  
> implementations in open source projects recently, it would be great to  
> get some detailed review of the encrypted data bag feature. We sort of  
> built the crypto bits ourselves, albeit on top of OpenSSL. Anyone up  
> for that?
> 
> Xabier has been working on a version 3 of encrypted data bags, please  
> take a look if you're into this sort of thing.  
> [https://github.com/opscode/chef/pull/1474](https://github.com/opscode/chef/pull/1474)
> 
> --  
> Bryan McLellan | chef | software engineer  
> (c) 206.607.7108 | (t) @btmspox | (www) [http://getchef.com](http://getchef.com)

---

<div class="post-metadata">

**Author:** ![anon10447422](https://avatars.discourse-cdn.com/v4/letter/a/46a35a/32.png) [@anon10447422](https://discourse.chef.io/u/anon10447422)\
**Post date:** [June 12, 2014, 1:06am UTC](https://discourse.chef.io/t/any-crypto-geeks-lurking/5399/3 "2014-06-12T01:06:00Z")

</div>

Secrets storage is a really nuanced issue.

Noah's blog post on this issue is worth reading,

[https://coderanger.net/2014/02/data-bags/](https://coderanger.net/2014/02/data-bags/)

See section: What about encrypted data bags?

If you are an AWS user, please do consider using IAM (with MFA), S3 and  
Instance Profile and build from there.

Following pointers should help. I strongly recommend reading it.

- Chapters 19, 20, 21 of  
[Amazon.com](http://www.amazon.com/Secrets-Lies-Digital-Security-Networked/dp/0471453803)

- Part IV and Chapter 23 of  
[Amazon.com](http://www.amazon.com/Cryptography-Engineering-Principles-Practical-Applications/dp/0470474246/)

Best,  
Rajiv

On Wed, Jun 11, 2014 at 12:51 PM, Michael Fischer [mfischer@zendesk.com](mailto:mfischer@zendesk.com)  
wrote:

> Is the analysis you're asking for limited to a crypto review of the  
> encrypted data bags feature as it currently exists, or are you asking our  
> opinion of secrets storage in general?
> 
> --Michael
> 
> On Wed, Jun 11, 2014 at 12:36 PM, Bryan McLellan [btm@getchef.com](mailto:btm@getchef.com)  
> wrote:
> 
> > Given the frequency of small bugs in being found in crypto  
> > implementations in open source projects recently, it would be great  
> > to get some detailed review of the encrypted data bag feature. We  
> > sort of built the crypto bits ourselves, albeit on top of OpenSSL.  
> > Anyone up for that?
> > 
> > Xabier has been working on a version 3 of encrypted data  
> > bags, please take a look if you're into this sort of thing.  
> > [https://github.com/opscode/chef/pull/1474](https://github.com/opscode/chef/pull/1474)
> > 
> > --  
> > Bryan McLellan | chef | software engineer  
> > (c) 206.607.7108 | (t) @btmspox | (www) [http://getchef.com](http://getchef.com)

---

<div class="post-metadata">

**Author:** ![Greg\_Zapp](https://avatars.discourse-cdn.com/v4/letter/g/cab0a1/32.png) [@Greg\_Zapp](https://discourse.chef.io/u/Greg_Zapp)\
**Post date:** [June 12, 2014, 1:29am UTC](https://discourse.chef.io/t/any-crypto-geeks-lurking/5399/4 "2014-06-12T01:29:49Z")

</div>

Rajiv, thank you for posting that coderanger link. While I don't agree  
with his generalization about not storing anything in databags, I'm very  
keen on using IAM roles and S3 for storing secrets. I had also not heard  
of Barbican.

Cheers,  
-Greg

On Thu, Jun 12, 2014 at 1:06 PM, Rajiv Ranganath \<  
[rajiv.ranganath@atihita.com](mailto:rajiv.ranganath@atihita.com)\> wrote:

> Secrets storage is a really nuanced issue.
> 
> Noah's blog post on this issue is worth reading,
> 
> [Data Bags are a Code Smell – Noah Kantrowitz](https://coderanger.net/2014/02/data-bags/)
> 
> See section: What about encrypted data bags?
> 
> If you are an AWS user, please do consider using IAM (with MFA), S3 and  
> Instance Profile and build from there.
> 
> Following pointers should help. I strongly recommend reading it.
> 
> - Chapters 19, 20, 21 of
> 
> [Amazon.com](http://www.amazon.com/Secrets-Lies-Digital-Security-Networked/dp/0471453803)
> 
> - Part IV and Chapter 23 of
> 
> [http://www.amazon.com/Cryptography-Engineering-Principles-Practical-Applications/dp/0470474246/](http://www.amazon.com/Cryptography-Engineering-Principles-Practical-Applications/dp/0470474246/)
> 
> Best,  
> Rajiv
> 
> On Wed, Jun 11, 2014 at 12:51 PM, Michael Fischer [mfischer@zendesk.com](mailto:mfischer@zendesk.com)  
> wrote:
> 
> > Is the analysis you're asking for limited to a crypto review of the  
> > encrypted data bags feature as it currently exists, or are you asking our  
> > opinion of secrets storage in general?
> > 
> > --Michael
> > 
> > On Wed, Jun 11, 2014 at 12:36 PM, Bryan McLellan [btm@getchef.com](mailto:btm@getchef.com)  
> > wrote:
> > 
> > > Given the frequency of small bugs in being found in crypto  
> > > implementations in open source projects recently, it would be great  
> > > to get some detailed review of the encrypted data bag feature. We  
> > > sort of built the crypto bits ourselves, albeit on top of OpenSSL.  
> > > Anyone up for that?
> > > 
> > > Xabier has been working on a version 3 of encrypted data  
> > > bags, please take a look if you're into this sort of thing.  
> > > [[CHEF-5356] Encrypted data bags should use different HMAC key and include the IV in the HMAC by zuazo · Pull Request #1474 · chef/chef · GitHub](https://github.com/opscode/chef/pull/1474)
> > > 
> > > --  
> > > Bryan McLellan | chef | software engineer  
> > > (c) 206.607.7108 | (t) @btmspox | (www) [http://getchef.com](http://getchef.com)