vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Before configuring your service to send requests to Key Protect through a quantum safe enabled Key Protect service endpoint, please keep in mind the following considerations:



* The National Institute for Standards and Technology (NIST) is in the process of [standardizing quantum safe algorithms](https://csrc.nist.gov/Projects/Post-Quantum-Cryptography). NIST is currently evaluating candidate approaches to quantum safe cryptography and isn't expected to complete the standardization process until after 2023. Key Protect uses the [Kyber algorithm](https://pq-crystals.org/kyber/index.shtml), which is one of the third round candidates under evaluation. If NIST's research reveals that the Kyber algorithm is not quantum safe, the key exchange mechanism is still protected by the classic TLS algorithms when using the Kyber algorithm in hybrid mode.
* Performance results may vary from traditional key algorithms. The quantum safe algorithm uses a larger key size compared to classic public key algorithms, therefore the network bandwidth requirements will be higher. Quantum safe algorithm performance can also be affected by network profile, CPU speed, and API call rates.
* Quantum Safe TLS only protects data in transit, not at rest. The quantum safe algorithms utilized by Key Protect protect your data from breach as it travels to a Key Protect service endpoint. Imported root keys (including their associated payloads) are encrypted by TLS session keys. Data at rest encryption uses symmetric keys and AES 256 symmetric keys are safe from large quantum computer attacks.
* Key Protect only supports Quantum Safe TLS for Linux Platforms. Key Protect will provide quantum safe TLS connection support to additional operating systems in the future.
* Quantum Safe TLS is only supported through the Key Protect software development kit (SDK). Quantum safe TLS support will be added to the Key Protect command line interface (CLI) in the future. To find out more about accessing the Key Protect SDK, check out [Setting up the SDK](https://cloud.ibm.com/docs/key-protect?topic=key-protect-set-up-api).







 Using Quantum Safe TLS with Key Protect
In this way, you have control over your TLS/SSL keys and processing. As a result, security is improved and reputational risk is decreased.

TLS/SSL offloading to the Hyper Protect Crypto Services HSM enables data in transit protection for web, API, and mobile transactions by using the standard PKCS #11 API. With Hyper Protect Crypto Services, you can integrate TLS/SSL offloading with other cloud proxies.

For a tutorial on how to offload the SSL workload to a load balancer such as NGINX while managing keys by using Hyper Protect Crypto Services, see [Using IBM Cloud Hyper Protect Crypto Services to offload NGINX TLS](https://developer.ibm.com/components/ibmz/tutorials/use-hyper-protect-crypto-services-to-offload-nginx-tls/).

Zoom

![Protecting data in transit with TLS/SSL offloading](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/hs-crypto//images/ssl-offloading.svg)

Figure 7. Protecting data in transit with TLS/SSL offloading







 Using Hyper Protect Crypto Services as Enterprise PKCS 11 HSMs 

Hyper Protect Crypto Services provides the

[Enterprise PKCS #11 (EP11) API](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-grep11-api-ref). Cloud application can use this function through [gRPC](https://grpc.io).

Enterprise PKCS #11 supports stateless cryptography use cases and allows for scaling and redundancy in an enterprise environment. For some use cases around asset protection, the keys can be managed outside the cryptographic service, while all sensitive operations are executed within the HSM boundary. You can use Enterprise PKCS #11 when state handling is an issue, especially for enterprise applications that benefit from the stateless character of Enterprise PKCS #11.
These initial settings can reduce false positives by populating Security Events for further tuning. Your WAF is updated automatically to handle new vulnerabilities as they are identified. For more information, see [Using Security events capability](https://cloud.ibm.com/docs/cis?topic=cis-using-the-cis-security-events-capability).

The WAF protects you against the following types of attacks:



* SQL injection attack
* Cross-site scripting
* Cross-site forgery



The WAF contains a default rule set which includes rules to stop the most common attacks. At this time, we allow you to either enable or disable the WAF and fine-tune specific rules in the WAF rule sets. See [WAF actions and CIS rule set](https://cloud.ibm.com/docs/cis?topic=cis-waf-settingswaf-settings) document for more details on the rule set and the behavior of each rule.

For more information, see [Web Application Firewall (WAF) concepts](https://cloud.ibm.com/docs/cis?topic=cis-waf-q-and-a).





 Best practice 4: Configure your TLS settings 

IBM CIS provides some options for encrypting your traffic. As a reverse proxy, we close TLS connections at our data centers and open a new TLS connection to your origin server.

TLS offers four modes of operation:



* Off: TLS is disabled in this mode, it is not recommended.
* Client-to-edge: TLS encrypts traffic from CIS to your clients, but not from CIS to your origin server(s).
* End-to-end flexible: TLS encrypts all traffic; however, you can use a self-signed certificate to secure traffic between CIS and your origin server(s).
* End-to-end CA signed: TLS encrypts all traffic; you must use a CA-signed certificate.



Refer to [TLS options](https://cloud.ibm.com/docs/cis?topic=cis-cis-tls-options) for details.
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in Golang Go (CVE-2022-41717)](https://www.ibm.com/support/pages/node/6967677)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in Freedesktop D-Bus (CVE-2022-42010)](https://www.ibm.com/support/pages/node/6967691)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in Freedesktop D-Bus (CVE-2022-42011)](https://www.ibm.com/support/pages/node/6967693)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in Freedesktop D-Bus (CVE-2022-42012)](https://www.ibm.com/support/pages/node/6967695)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in MIT krb5 (CVE-2022-42898)](https://www.ibm.com/support/pages/node/6967697)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in libexpat (CVE-2022-43680)](https://www.ibm.com/support/pages/node/6967699)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to an arbitrary commands execution in Python (CVE-2015-20107)](https://www.ibm.com/support/pages/node/6981849)
Data security and privacy 

IBM® uses the following methods to help ensure the security and privacy of your data.



 Cryptographic protocols 



* Connections are restricted to the following strong cipher suites:



For TLS v1.2:

* TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
* TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
* TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

For TLS v1.3:

* TLS_AES_128_GCM_SHA256
* TLS_AES_256_GCM_SHA384
* TLS_CHACHA20_POLY1305_SHA256



* To be a fully supported configuration, all clients must support the following:



* TLS v1.2 or v1.3
* Elliptic curve cryptography
* TLS server name indication (SNI)



* Additionally, you must use TLS v1.2 or v1.3 in the following cases:



* To make connections to the Kafka native and REST interfaces.
* The browser that you use to access the Event Streams dashboard must support TLS v1.2 or v1.3.









 Encryption of message payloads, topic names, and consumer groups 

Message data is encrypted for transmission between Event Streams and clients as a result of TLS. Event Streams stores message data at rest and message logs on encrypted disks.

Topic names and consumer groups are encrypted for transmission between Event Streams and clients as a result of TLS. However, Event Streams does not encrypt these values at rest. Therefore, do not use confidential information in your topic names.

On the Satellite plan, all encryption is determined by the options that you specify on your chosen storage provider.
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in libexpat (CVE-2022-43680)](https://www.ibm.com/support/pages/node/6967699)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to an arbitrary commands execution in Python (CVE-2015-20107)](https://www.ibm.com/support/pages/node/6981849)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to arbitrary code execution in SQlite (CVE-2020-35527)](https://www.ibm.com/support/pages/node/6981851)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a security restrictions bypass in GNU Libtasn1 (CVE-2021-46848)](https://www.ibm.com/support/pages/node/6981853)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to arbitrary code execution in Git (CVE-2022-23521)](https://www.ibm.com/support/pages/node/6981857)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to arbitrary code execution in GnuPG Libksba (CVE-2022-3515)](https://www.ibm.com/support/pages/node/6981855)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to an arbitrary code execution in libexpat (CVE-2022-40674)](https://www.ibm.com/support/pages/node/6981859)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to arbitrary code execution in Git (CVE-2022-41903)](https://www.ibm.com/support/pages/node/6981861)
* Disable caching for responses that contain sensitive data.
* Never send confidential information with URL parameters.
* Use HTTPS for all connections from the web. HTTP connections must be refused or redirected to HTTPS.



The requirement to encrypt data in transit also applies to traffic within your VPCs. This might be traffic from one virtual server instance to another, or from one Red Hat OpenShift on IBM Cloud container to another Red Hat OpenShift on IBM Cloud container. For containers, one option to consider is that with [Service Mesh on Red Hat OpenShift on IBM Cloud](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-openshift-service-mesh) you can [enable mTLS between containers](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-openshift-service-meshopenshift-service-mesh-secure_services) without code changes.



 TLS requirements 

To be effective, TLS must be configured correctly otherwise the data in transit is vulnerable to modification or eavesdropping. The following steps are required to deploy a secure TLS connection:



* Securely generate and store a private key.
* Obtain a certificate associated with the private key, signed by the appropriate trusted certificate authority (CA).
* Configure the TLS server to use approved TLS versions (1.2 or 1.3) and approved cipher suites.
* Configure the TLS client to check certificate validity and use approved TLS versions only.
* Deploy certificate and private key to TLS server.
* Enable the TLS server.
* Replace the certificate before it expires (typically certificates expire after 1 year).





 TLS protocol requirements 



1. Only TLS versions 1.2 or 1.3 are permitted. All older versions of TLS and all version of SSL must not be used.
2. Prohibited versions of SSL/TLS must be disabled on the server to prevent downgrading to a vulnerable version of the protocol.
3. Only cipher suites that are listed under Acceptable cipher suites can be enabled. All others must be disabled.
* [HTTPS Endpoint support](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-actions_webactions_web_endpoint)
* [Altering the response content of web action](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-actions_webaction_web_alter_response)



* [Securing web actions](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-actions_webactions_web_secure)



* [Creating a secure web action](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-actions_webactions_web_secure_create)
* [Testing a secure web action with randomly generated value of X-Require-Whisk-Auth](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-actions_webactions_web_secure_test_random)
* [Testing a secure web action with custom value of X-Require-Whisk-Auth](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-actions_webactions_web_secure_test_custom)
* [Testing to see if your web action is secure](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-actions_webactions_web_secure_test)



* [Raw HTTP handling](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-actions_webactions_web_raw)



* [Enabling raw HTTP handling](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-actions_webactions_web_raw_enable)
* [Decoding binary body content from Base64](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-actions_webactions_web_decode)
To get in touch, you can join us on Slack.



1. [Request an invitation](https://cloud.ibm.com/kubernetes/slack) to the workspace by entering your email.
2. Check your email for an invitation.
3. Click Join now to go to the sign-in page.
4. Create an account by entering your name and a password.
5. When you're in, search for the channel appid-at-ibm.
6. Join the channel.



Welcome! Now that you're up and running, feel free to ask questions, give feedback, and help others.

Using the Slack channel is not a replacement for opening a support ticket. If you encounter a more serious issue, issues with IBM Cloud that don't relate to App ID, or need to share more information than you are comfortable sharing in a public forum, open a support ticket.
* Why do I need to allowlist my redirect URI?

A redirect URI is the callback endpoint of your application. When you allowlist your URI, you're giving App ID the OK to send your users to that location. At runtime, App ID validates the URI against your allowlist before it redirects the user. This process can help prevent phishing attacks and lessens the possibility that an attacker is able to gain access to your user's tokens. For more information about redirect URIs, see [Adding redirect URIs](https://cloud.ibm.com/docs/appid?topic=appid-managing-idpadd-redirect-uri).

Do not include any query parameters in your URL. They are ignored in the validation process. Example URL: http://host:[port]/path
* How does encryption work in App ID?

Check out the following table for answers to commonly asked questions about encryption.



Table 2. Frequently asked questions about how App ID handles encryption

 Question Answer 

 Why do you use encryption?
* pseudo_ipv4: Adds an IPv4 header to requests when a client is using IPv6, but the server only supports IPv4.
* response_buffering: Enable or disable buffering of responses from the origin server (Enterprise plan only).
* script_load_optimization: Improve the paint time for pages that include JavaScript.
* security_header: Enforce web security policy for your website.
* security_level: Choose the appropriate security profile for your website.
* server_side_exclude: Automatically hide specific content from suspicious visitors.
* tls_client_auth: TLS client certificate presented for authentication on origin pull (Enterprise plan only).
* true_client_ip_header: CIS will send the end user’s IP address in the True-Client-IP header (Enterprise plan only).
* waf: A Web Application Firewall (WAF) blocks requests that contain malicious content.
* websockets: Allow WebSockets connections to your origin server.
* proxy_read_timeout: Maximum time between two read operations from origin.



-v, --value
: The value set to the feature for domain. Required.



* Valid values for always_use_https are on, off.
* Valid values for automatic_https_rewrites are on, off.
* Valid values for browser_check are on, off.
* Valid values for challenge_ttl are 300, 900, 1800, 2700, 3600, 7200, 10800, 14400, 28800, 57600, 86400, 604800, 2592000, 31536000.
* Valid values for cname_flattening are flatten_at_root, flatten_all.



* flatten_at_root: Flatten CNAME at root domain. This is the default value.
* flatten_all: Flatten all CNAME records under your domain.



* Valid values for hotlink_protection are on, off.
* Valid values for email_obfuscation are on, off.
* Valid values for opportunistic_onion are on, off.
* Valid values for http2 are on, off.
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a security restrictions bypass in Apache Tomcat (CVE-2022-45143)](https://www.ibm.com/support/pages/node/6988091)
* CVE-2020-10543: Publication of the security bulletin is pending.







 29 March 2023 (Version 4.6.4) 

Version 4.6.4 is now available
: Speech to Text for IBM Cloud Pak for Data version 4.6.4 is now available. This version supports IBM Cloud Pak for Data version 4.6.x and Red Hat OpenShift versions 4.10 and 4.12. For more information, see [Watson Speech services on IBM Cloud Pak for Data](https://www.ibm.com/docs/en/cloud-paks/cp-data/4.6.x?topic=services-watson-speech).

Important: Back up your data before upgrading to version 4.6.3 or 4.6.4
: Important: Before upgrading to Watson Speech services version 4.6.3 or 4.6.4, you must make a backup of your data. Preserve the backup in a safe location. For more information about backing up your Watson Speech services data, see Backing up and restoring Watson Speech services data in [Administering Watson Speech services](https://www.ibm.com/docs/en/cloud-paks/cp-data/4.6.x?topic=services-administering). That topic also includes information about restoring your data if that becomes necessary.

Known issue: The Swedish telephony and Italian multimedia models are not yet available
: Known issue: The Swedish telephony (sv-SE_Telephony) and Italian multimedia (it-IT_Multimedia) models are not yet available. They will be made available with version 4.6.5.

Defect fix: You can now change the installed models and voices with the advanced installation options
: Defect fix: During installation, you can now specify different models or voices with the advanced installation options of the command-line interface. Previously, the service always installed the default models and voices.
* Check whether VPN for VPC has Internet Key Exchange (IKE) policy encryption that is not set to "triple_des"
* Check whether VPN for VPC has a Diffie-Hellman group set to at least group
* Check whether VPN for VPC has Internet Key Exchange (IKE) policy authentication that is set to minimum 'sha256'
* Check whether App ID redirect URIs are using HTTPS only
* Check whether Cloud Internet Services (CIS) has TLS mode set to End-to-End CA signed
* Check whether Cloud Object Storage is enabled with customer-managed encryption and Keep Your Own Key (KYOK)
* Check whether Application Load Balancer for VPC pool uses the HTTPS protocol for HTTPS listeners
* Check whether Application Load Balancer for VPC uses HTTPS (SSL & TLS) instead of HTTP
* Check whether Virtual Servers for VPC data volumes are enabled with customer-managed encryption and Keep Your Own Key (KYOK)
* Check whether data disks are encrypted with customer-managed keys
* Check whether VPN for VPC has IPsec policy encryption that is not set to "triple_des"







 NIST supplemental guidance 

Cryptography can be employed to support a variety of security solutions including, for example, the protection of classified and Controlled Unclassified Information, the provision of digital signatures, and the enforcement of information separation when authorized individuals have the necessary clearances for such information but lack the necessary formal access approvals. Cryptography can also be used to support random number generation and hash generation. Generally applicable cryptographic standards include FIPS-validated cryptography and NSA-approved cryptography. This control does not impose any requirements on organizations to use cryptography. However, if cryptography is required based on the selection of other security controls, organizations define each type of cryptographic use and the type of cryptography required (e.g., protection of classified information: NSA-approved cryptography; provision of digital signatures: FIPS-validated cryptography).
If you are asked for a 16-character passphrase, press Enter to return to the main menu. Verify the current network configuration to ensure that your changes are applied.
9. To confirm that the VM has access to the internet, ping a public IP address or website. Click Manage Network Settings > Network Diagnostic Tools > Test Inbound Ports of Another Server. Type a public website address, for example, www.ibm.com, click OK, type 80 443 for the ports (or any other ports you want to test). You must get an immediate response that shows the inbound ports with a message similar to 80 (OK) 443 (OK).
10. Repeat steps 3 - 9 for the other Entrust VM.









 Related links 



* [Entrust KeyControl overview](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-entrust-kc_considerations)
* [FAQ](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-faq-vmwaresolutions)
* [Entrust website](https://www.entrust.com/)
Setting back-end encryption 

Back-end encryption is supported to allow end-to-end data traffic encryption. Not only is the traffic between the load balancer and the client encrypted, but so is the traffic between the load balancer and the back-end server.

To enable back-end encryption:



*  If you are adding a new HTTPS protocol, set the front end and back end to HTTPS.
*  For existing HTTPS protocols, set the back end to HTTPS.
Data encryption in transit 

Data in transit must always be encrypted. Cryptographic controls must be in place in all regions and availability zones to protect the confidentiality and integrity of data. Data must be protected by at least two levels of encryption such as transport and field level or envelope level.

As an application provider, you must:



* Ensure that all traffic, tunneling, and other protection of data in transit is encrypted by using TLS 1.2 at a minimum. You must disable the SSL/TLS 1.0/TLS 1.1 protocols on all software that is deployed in your VPCs. See the following [TLS requirements](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-encryption-in-transitvpc-architecture-encryption-in-transit-tls-requirements) section for more details.
* Use Hyper Protect Crypto Services for TLS offload for all data that is requested from outside of IBM Cloud (inbound traffic to IBM Cloud) and protected by a certificate that is signed by a public certificate authority. In this scenario, you should configure any web servers to use TLS offload to set up the session so that the private key never leaves Hyper Protect Crypto Services. See [Use IBM Cloud Hyper Protect Crypto Services to offload NGINX TLS](https://developer.ibm.com/tutorials/use-hyper-protect-crypto-services-to-offload-nginx-tls/) for an example.
* Enforce encryption that uses directives like HTTP Strict Transport Security (HSTS).
* Disable caching for responses that contain sensitive data.
* Never send confidential information with URL parameters.
* Use HTTPS for all connections from the web. HTTP connections must be refused or redirected to HTTPS.



The requirement to encrypt data in transit also applies to traffic within your VPCs. This might be traffic from one virtual server instance to another, or from one Red Hat OpenShift on IBM Cloud container to another Red Hat OpenShift on IBM Cloud container.