Encryption The process of changing plaintext into ciphertext using a cryptographic algorithm and key. Hashing algorithm (or hash algorithm, hash function) An algorithm that maps a bit string of arbitrary length to a fixed length bit string. Approved hashing algorithms satisfy the following properties: 1. (One-way) It is computationally infeasible to find any input that maps to any pre-specified output, and 2. (Collision resistant) It is computationally infeasible to find any two distinct inputs that map to the same output. Integrity The property that sensitive data has not been modified or deleted in an unauthorized and undetected manner. Key derivation (derivation) A function in the lifecycle of keying material; the process by which one or more keys are derived from: 1) Either a shared secret from a key agreement computation or a cryptographic key, and 2) Other information. Key management The activities involving the handling of cryptographic keys and other related security parameters (e.g., IVs and passwords) during the entire life cycle of the keys, including their generation, storage, establishment, entry and output, and destruction. Key wrapping (wrapping) A method of encrypting and/or MACing/signing keys. Message Authentication Code (MAC) A cryptographic checksum on data that uses a symmetric key to detect both accidental and intentional modifications of data. PGP Key A RFC 4880-compliant container of cryptographic keys and associated metadata. Usually text-based (in PGP-parlance, ASCII-armored). Private key A cryptographic key used with a public key cryptographic algorithm that is uniquely associated with an entity and is not made public. The private key is associated with a public key. Depending on the algorithm, the private key MAY be used to: 1. Compute the corresponding public key, 2. Compute a digital signature that can be verified by the corresponding public key, 3. Decrypt data that was encrypted by the corresponding public key, or 4. Compute a piece of common shared data, together with other information. Profile A specification of objects, attributes, operations, message elements and authentication methods to be used in specific contexts of key management server and client interactions (see [KMIP-Prof]).
Object Encoding REQUIRED Credential Value Structure Nonce Structure, see 2.1.14 Yes Attestation Type Enumeration, see 9.1.3.2.36 Yes Attestation Measurement Byte String No Attestation Assertion Byte String No Table : Credential Value Structure for the Attestation Credential Key Block A Key Block object is a structure (see Table 7) used to encapsulate all of the information that is closely associated with a cryptographic key. It contains a Key Value of one of the following Key Format Types: Raw – This is a key that contains only cryptographic key material, encoded as a string of bytes. Opaque – This is an encoded key for which the encoding is unknown to the key management system. It is encoded as a string of bytes. PKCS1 – This is an encoded private key, expressed as a DER-encoded ASN.1 PKCS#1 object. PKCS8 – This is an encoded private key, expressed as a DER-encoded ASN.1 PKCS#8 object, supporting both the RSAPrivateKey syntax and EncryptedPrivateKey. X.509 – This is an encoded object, expressed as a DER-encoded ASN.1 X.509 object. ECPrivateKey – This is an ASN.1 encoded elliptic curve private key. Several Transparent Key types – These are algorithm-specific structures containing defined values for the various key types, as defined in Section 2.1.7. Extensions – These are vendor-specific extensions to allow for proprietary or legacy key formats. The Key Block MAY contain the Key Compression Type, which indicates the format of the elliptic curve public key. By default, the public key is uncompressed. The Key Block also has the Cryptographic Algorithm and the Cryptographic Length of the key contained in the Key Value field. Some example values are: RSA keys are typically 1024, 2048 or 3072 bits in length. 3DES keys are typically from 112 to 192 bits (depending upon key length and the presence of parity bits). keys are 128, 192 or 256 bits in length. The Key Block SHALL contain a Key Wrapping Data structure if the key in the Key Value field is wrapped (i.e., encrypted, or MACed/signed, or both).
Attribute Action Private Key Unique Identifier, see 3.1 New value generated Public Key Unique Identifier, see 3.1 New value generated Name, see 3.2 Set to the name(s) of the existing public/private keys; all name attributes of the existing public/private keys are removed. Digest, see 3.17 Recomputed for both replacement public and private keys from the new public and private key values Usage Limits, see 3.21 The Total Bytes/Total Objects value is copied from the existing key pair, while the Byte Count/Object Count values are set to the Total Bytes/Total Objects. State, see Error! Reference source not found. Set based on attributes values, such as dates, as shown in Table 176. Initial Date, see 3.23 Set to the current time Destroy Date, see 3.28 Not set Compromise Occurrence Date, see 3.29 Not set Compromise Date, see 3.30 Not set Revocation Reason, see 3.31 Not set Link, see 3.35 Set to point to the existing public/private keys as the replaced public/private keys Last Change Date, see 3.38 Set to current time Random Number Generator, see 3.44 Set to the random number generator used for creating the new managed object. Not copied from the original object. Table : Re-key Key Pair Attribute Requirements
Message Contents The messages in the protocol consist of a message header, one or more batch items (which contain OPTIONAL message payloads), and OPTIONAL message extensions. The message headers contain fields whose presence is determined by the protocol features used (e.g., asynchronous responses). The field contents are also determined by whether the message is a request or a response. The message payload is determined by the specific operation being requested or to which is being replied. The message headers are structures that contain some of the following objects. Protocol Version This field contains the version number of the protocol, ensuring that the protocol is fully understood by both communicating parties. The version number SHALL be specified in two parts, major and minor. Servers and clients SHALL support backward compatibility with versions of the protocol with the same major version. Support for backward compatibility with different major versions is OPTIONAL. Object Encoding Protocol Version Structure Protocol Version Major Integer Protocol Version Minor Integer Table : Protocol Version Structure in Message Header Operation This field indicates the operation being requested or the operation for which the response is being returned. The operations are defined in Sections 4 and 5. Object Encoding Operation Enumeration, see 9.1.3.2.27 Table : Operation in Batch Item Maximum Response Size This is an OPTIONAL field contained in a request message, and is used to indicate the maximum size of a response, in bytes, that the requester SHALL be able to handle. It SHOULD only be sent in requests that possibly return large replies. Object Encoding Maximum Response Size Integer Table : Maximum Response Size in Message Request Header Unique Batch Item ID This is an OPTIONAL field contained in a request, and is used for correlation between requests and responses. If a request has a Unique Batch Item ID, then responses to that request SHALL have the same Unique Batch Item ID.
Certificate Type Name Value X.509 00000001 PGP 00000002 (deprecated) Extensions 8XXXXXXX Table : Certificate Type Enumeration Digital Signature Algorithm Enumeration Digital Signature Algorithm Name Value MD2 with RSA Encryption (PKCS#1 v1.5) 00000001 MD5 with RSA Encryption (PKCS#1 v1.5) 00000002 SHA-1 with RSA Encryption (PKCS#1 v1.5) 00000003 SHA-224 with RSA Encryption (PKCS#1 v1.5) 00000004 SHA-256 with RSA Encryption (PKCS#1 v1.5) 00000005 SHA-384 with RSA Encryption (PKCS#1 v1.5) 00000006 SHA-512 with RSA Encryption (PKCS#1 v1.5) 00000007 RSASSA-PSS (PKCS#1 v2.1) 00000008 DSA with SHA-1 00000009 DSA with SHA224 0000000A DSA with SHA256 0000000B ECDSA with SHA-1 0000000C ECDSA with SHA224 0000000D ECDSA with SHA256 0000000E ECDSA with SHA384 0000000F ECDSA with SHA512 00000010 SHA3-256 with RSA Encryption 00000011 SHA3-384 with RSA Encryption 00000012 SHA3-512 with RSA Encryption 00000013 Extensions 8XXXXXXX Table : Digital Signature Algorithm Enumeration
Re-key Error Definition Result Status Result Reason No object with the specified Unique Identifier exists Operation Failed Item Not Found Object specified is not able to be Operation Failed Permission Denied Offset field is not permitted to be specified at the same time as any of the Activation Date, Process Start Date, Protect Stop Date, or Deactivation Date attributes Operation Failed Invalid Message Cryptographic error during re-key Operation Failed Cryptographic Failure The particular Application Namespace is not supported, and Application Data cannot be generated if it was omitted from the client request Operation Failed Application Namespace Not Supported Object is archived Operation Failed Object Archived An offset cannot be used to specify new Process Start, Protect Stop and/or Deactivation Date attribute values since no Activation Date has been specified for the existing key Operation Failed Illegal Operation The Key Value is not present on the server Operation Failed Key Value Not Present Table : Re-key Errors
Re-key Key Pair Error Definition Result Status Result Reason No object with the specified Unique Identifier exists Operation Failed Item Not Found Object specified is not able to be Operation Failed Permission Denied Offset field is not permitted to be specified at the same time as any of the Activation Date or Deactivation Date attributes Operation Failed Invalid Message Cryptographic error during re-key Operation Failed Cryptographic Failure The particular Application Namespace is not supported, and Application Data cannot be generated if it was omitted from the client request Operation Failed Application Namespace Not Supported Object is archived Operation Failed Object Archived An offset cannot be used to specify new Process Start, Protect Stop and/or Deactivation Date attribute values since no Activation Date has been specified for the existing key Operation Failed Illegal Operation The Key Value is not present on the server Operation Failed Key Value Not Present Table : Re-key Key Pair Errors
Certify Error Definition Result Status Result Reason No object with the specified Unique Identifier exists Operation Failed Item Not Found Object specified is not able to be certified Operation Failed Permission Denied The Certificate Request does not contain a signed certificate request of the specified Certificate Request Type Operation Failed Invalid Field The particular Application Namespace is not supported, and Application Data cannot be generated if it was omitted from the client request Operation Failed Application Namespace Not Supported Object is archived Operation Failed Object Archived Table : Certify Errors Re-certify Error Definition Result Status Result Reason No object with the specified Unique Identifier exists Operation Failed Item Not Found Object specified is not able to be certified Operation Failed Permission Denied The Certificate Request does not contain a signed certificate request of the specified Certificate Request Type Operation Failed Invalid Field Offset field is not permitted to be specified at the same time as any of the Activation Date or Deactivation Date attributes Operation Failed Invalid Message The particular Application Namespace is not supported, and Application Data cannot be generated if it was omitted from the client request Operation Failed Application Namespace Not Supported Object is archived Operation Failed Object Archived Table : Re-certify Errors
Sign Error Definition Result Status Result Reason No object with the specified Unique Identifier exists Operation Failed Item Not Found Object specified is not able to be used for signing Operation Failed Permission Denied Cryptographic error during signing Operation Failed Cryptographic Failure Object is archived Operation Failed Object Archived The Key Value is not present on the server Operation Failed Key Value Not Present No outstanding operation with the specified Correlation Value exists Operation Failed Item Not Found Table : Sign Errors Signature Verify Error Definition Result Status Result Reason No object with the specified Unique Identifier exists Operation Failed Item Not Found Object specified is not able to be used for signature verification Operation Failed Permission Denied Cryptographic error during signature verification Operation Failed Cryptographic Failure Object is archived Operation Failed Object Archived The Key Value is not present on the server Operation Failed Key Value Not Present No outstanding operation with the specified Correlation Value exists Operation Failed Item Not Found Table : Signature Verify Errors
Error Definition Action Result Reason Processing of batch item fails with Batch Error Continuation Option set to Stop Batch item fails and Result Status is set to Operation Failed. Responses to batch items that have already been processed are returned normally. Responses to batch items that have not been processed are not returned. See tables above, referring to the operation being performed in the batch item that failed Processing of batch item fails with Batch Error Continuation Option set to Continue Batch item fails and Result Status is set to Operation Failed. Responses to other batch items are returned normally. See tables above, referring to the operation being performed in the batch item that failed Processing of batch item fails with Batch Error Continuation Option set to Undo Batch item fails and Result Status is set to Operation Failed. Batch items that had been processed have been undone and their responses are returned with Undone result status. See tables above, referring to the operation being performed in the batch item that failed Table : Batch Items Errors
Offset 4.4, 4.8 Interval Opaque Data Type 2.2.8, 9.1.3.2.10 Enumeration Opaque Data Value 2.2.8 Byte String Opaque Object 2.2.8 Structure Operation 6.2, 9.1.3.2.27 Enumeration Operation Policy Name 3.18 Text String P 2.1.7 Big Integer Password 2.1.2 Text String Padding Method 3.6, 9.1.3.2.15 Enumeration Prime Exponent P 2.1.7 Big Integer Prime Exponent Q 2.1.7 Big Integer Prime Field Size 2.2.5 Big Integer Private Exponent 2.1.7 Big Integer Private Key 2.2.4 Structure Private Key Template-Attribute 2.1.8 Structure Private Key Unique Identifier 4.2 Text String Process Start Date 3.25 Date-Time Protect Stop Date 3.26 Date-Time Protocol Version 6.1 Structure Protocol Version Major 6.1 Integer Protocol Version Minor 6.1 Integer Public Exponent 2.1.7 Big Integer Public Key 2.2.3 Structure Public Key Template-Attribute 2.1.8 Structure Public Key Unique Identifier 4.2 Text String Put Function 5.2, 9.1.3.2.26 Enumeration Q 2.1.7 Big Integer Q String 2.1.7 Byte String Qlength 3.7 Integer Query Function 4.25, 9.1.3.2.24 Enumeration Recommended Curve 2.1.7, 3.7, 9.1.3.2.5 Enumeration Replaced Unique Identifier 5.2 Text String Request Header 7.2 Structure Request Message 7.1 Structure Request Payload 4, 5, 7.2 Structure Response Header 7.2 Structure Response Message 7.1 Structure Response Payload 4, 7.2 Structure