The existing Fernet implementation uses a file-backed key repository for storing Fernet keys. A security optimization that can be made is to put the keys into a dedicated key manager instead of having the Fernet keys on disk.
Fernet currently doesn’t support putting the keys used for encryption anywhere except on disk. Providing a pluggable key manager would allow deployers to use dedicated key storage tools to secure Fernet encryption keys.
There is already an existing interface defined as a @property object of the keystone.token.providers.fernet.token_formatters.TokenFormatter() class. This interface could be defined through a Fernet configuration option like CONF.fernet_tokens.backend. By default the backend could be the existing file-based implementation, but an operator could specify a different backend using configuration. For example, Barbican or Castellan could be used to store Fernet keys.
Continue to store keys on disk and use all the existing management tools.
Key rotation and distribution may change depending on the implementation being used. This could be considered a security impact.
None
None
None
The key management tooling provided in keystone-manage may have to change to support other key backends.
None