KeyManager.create_key length parameter is ambiguous

[Douglas Mendizábal]

The length parameter in KeyManager.create_key is not well defined in the interface. Specifically it is not clear whether the integer value passed in is the length in bits or the length in bytes.

Because of this, there is a mismatch in the way that BarbicanKeyManager and VaultKeyManager handle them.

BarbicanKeyManager assumes the value is bits, but VaultKeyManager assumes the value is in bytes. This, in turn, could result in unexpected behavior in applications using Castellan, since they would not have any knowledge at runtime about which backend is running and whether Castellan will return bits or bytes when asked to generate keys.

For example, consider the following:

    keymgr = key_manager.API(CONF)
    keymgr.create_key(ctx, "AES", 256)

Which currently generates a 256 bit AES key when Barbican is configured, but generates a 2048 bit AES key when Vault is configured.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/638658
Committed: https://git.openstack.org/cgit/openstack/castellan/commit/?id=9ecd30081aafbd45d4d40fc927aad1a6e18aaa6c
Submitter: Zuul
Branch: master

commit 9ecd30081aafbd45d4d40fc927aad1a6e18aaa6c
Author: Moisés Guimarães de Medeiros <email address hidden>
Date: Fri Feb 22 13:49:50 2019 +0100

    Fix length usage in VaultKeyManager.create_key.

    Previous code was considering length as bytes, but the API contract
    considers the length param to be bits so that the considering `km`
    as a VaultKeyManager, the call `km.create_key(ctx, 'AES', 256)` should
    generate a 256 bit AES key and not a 2048 bit AES key instead.

    Closes-Bug: #1817248
    Change-Id: I5815cb74394e18b6058f4c5cf69b656d7cc2c43b
    Signed-off-by: Moisés Guimarães de Medeiros <email address hidden>

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/castellan 1.2.1 release.