{"action":"created","issue":{"url":"https://api.github.com/repos/dotnet/orleans/issues/828","labels_url":"https://api.github.com/repos/dotnet/orleans/issues/828/labels{/name}","comments_url":"https://api.github.com/repos/dotnet/orleans/issues/828/comments","events_url":"https://api.github.com/repos/dotnet/orleans/issues/828/events","html_url":"https://github.com/dotnet/orleans/issues/828","id":107786706,"number":828,"title":"Adding optional TLS/encryption to transport channel","user":{"login":"veikkoeeva","id":5158694,"avatar_url":"https://avatars.githubusercontent.com/u/5158694?v=3","gravatar_id":"","url":"https://api.github.com/users/veikkoeeva","html_url":"https://github.com/veikkoeeva","followers_url":"https://api.github.com/users/veikkoeeva/followers","following_url":"https://api.github.com/users/veikkoeeva/following{/other_user}","gists_url":"https://api.github.com/users/veikkoeeva/gists{/gist_id}","starred_url":"https://api.github.com/users/veikkoeeva/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/veikkoeeva/subscriptions","organizations_url":"https://api.github.com/users/veikkoeeva/orgs","repos_url":"https://api.github.com/users/veikkoeeva/repos","events_url":"https://api.github.com/users/veikkoeeva/events{/privacy}","received_events_url":"https://api.github.com/users/veikkoeeva/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/dotnet/orleans/labels/enhancement","name":"enhancement","color":"84b6eb"},{"url":"https://api.github.com/repos/dotnet/orleans/labels/under-investigation","name":"under-investigation","color":"207de5"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-09-22T19:43:24Z","updated_at":"2015-09-23T07:16:23Z","closed_at":null,"body":"Adding TLS option to client-silo and inter-silo communications would make a great end-to-end encryption promise when combined with encryption between silo and storage. It looks like using TLS in socket connections involves adding a configuration option to settings and then applying it to socket connections. Encryption between silos and storage is less clear to me otherwise than that it may require more than simply changing connection string (for instance, here's background material for [Azure Table Storage](http://blogs.msdn.com/b/windowsazurestorage/archive/2015/04/28/client-side-encryption-for-microsoft-azure-storage-preview.aspx)).\r\n\r\nTo get this going, what would be needed to add encryption?\r\n\r\n1. Where and what kind of parameters should be added to configuration to support TLS on client-silo and inter-silo communications? It would feel like it's appropriate to allow different settings to apply to option between inter-silo and client-silo communications.\r\n\r\n2. Whe are in code are relevant places handling socket communications and apply encryption settings?\r\n\r\n3. Some consideration should be given on adding encryption on per-provider basis and maybe separated to their respective tickets, but I'll add here to get things going.\r\n"},"comment":{"url":"https://api.github.com/repos/dotnet/orleans/issues/comments/142517514","html_url":"https://github.com/dotnet/orleans/issues/828#issuecomment-142517514","issue_url":"https://api.github.com/repos/dotnet/orleans/issues/828","id":142517514,"user":{"login":"attilah","id":230432,"avatar_url":"https://avatars.githubusercontent.com/u/230432?v=3","gravatar_id":"","url":"https://api.github.com/users/attilah","html_url":"https://github.com/attilah","followers_url":"https://api.github.com/users/attilah/followers","following_url":"https://api.github.com/users/attilah/following{/other_user}","gists_url":"https://api.github.com/users/attilah/gists{/gist_id}","starred_url":"https://api.github.com/users/attilah/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/attilah/subscriptions","organizations_url":"https://api.github.com/users/attilah/orgs","repos_url":"https://api.github.com/users/attilah/repos","events_url":"https://api.github.com/users/attilah/events{/privacy}","received_events_url":"https://api.github.com/users/attilah/received_events","type":"User","site_admin":false},"created_at":"2015-09-23T07:16:23Z","updated_at":"2015-09-23T07:16:23Z","body":"You can wrap the connected Socket into a NetworkStream object, and then use and configure SslStream, which will has the NetworkStream object as it's inner stream.\r\n\r\nThere is an OSS project: http://www.supersocket.net/ which has every piece that we need. I don't say to make a dependency on it, but take a look it has TLS/SSL support implemented based on the above classes.\r\n\r\nI hope it helps."}}