oslo.cache should offer encryption in a similar manner to keystonemiddleware

[Matt Fischer]

Keystone middleware's caching of tokens offers HMAC validation and encryption of the tokens in the cache. This is important because memcache has literally zero authentication or protection from any user on the system. So this feature should be ported in from keystone middleware into keystone.

Encrypted caching implementation: https://opendev.org/openstack/keystonemiddleware/src/commit/0a65b1420799e7c7f8736e9f6c234f755ab5ac6b/keystonemiddleware/auth_token/_cache.py#L254-L297
Caching configuration via ksm: https://opendev.org/openstack/keystonemiddleware/src/commit/0a65b1420799e7c7f8736e9f6c234f755ab5ac6b/keystonemiddleware/auth_token/_opts.py#L113-L122

[Steve Martinelli (stevemar)]

solid RFE

[Morgan Fainberg (mdrnstm)]

This is something we should build into oslo.cache. I have moved the bug to wont fix in keystone and added oslo.cache.

[Morgan Fainberg (mdrnstm)]

This can be done as a backend or as a proxy fairly easily. Move this from keystone bug tracker as it is generally a good feature request.

[Daniel Bengtsson (damani42)]

Hi,

Do you have any update it's still relevant?

[Takashi Kajinami (kajinamit)]

I'm not too sure if we want to enable encryption for all cache data. Encryption is considered to have performance impact and if the data is not quite sensitive then encryption such data would be just redundant.

I don't block this work, but if we don't hear any other use cases where not having the common encryption mechanism causes pain and anyone is actually interested in bringing this functionality for further period, I'd close this as won't fix.