Object Encoding REQUIRED Credential Value Structure Nonce Structure, see 2.1.14 Yes Attestation Type Enumeration, see 9.1.3.2.36 Yes Attestation Measurement Byte String No Attestation Assertion Byte String No Table 6: Credential Value Structure for the Attestation Credential Key Block A Key Block object is a structure (see Table 7) used to encapsulate all of the information that is closely associated with a cryptographic key. It contains a Key Value of one of the following Key Format Types: Raw – This is a key that contains only cryptographic key material, encoded as a string of bytes. Opaque – This is an encoded key for which the encoding is unknown to the key management system. It is encoded as a string of bytes. PKCS1 – This is an encoded private key, expressed as a DER-encoded ASN.1 PKCS#1 object. PKCS8 – This is an encoded private key, expressed as a DER-encoded ASN.1 PKCS#8 object, supporting both the RSAPrivateKey syntax and EncryptedPrivateKey. X.509 – This is an encoded object, expressed as a DER-encoded ASN.1 X.509 object. ECPrivateKey – This is an ASN.1 encoded elliptic curve private key. Several Transparent Key types – These are algorithm-specific structures containing defined values for the various key types, as defined in Section 2.1.7. Extensions – These are vendor-specific extensions to allow for proprietary or legacy key formats. The Key Block MAY contain the Key Compression Type, which indicates the format of the elliptic curve public key. By default, the public key is uncompressed. The Key Block also has the Cryptographic Algorithm and the Cryptographic Length of the key contained in the Key Value field. Some example values are: RSA keys are typically 1024, 2048 or 3072 bits in length. 3DES keys are typically from 112 to 192 bits (depending upon key length and the presence of parity bits). keys are 128, 192 or 256 bits in length. The Key Block SHALL contain a Key Wrapping Data structure if the key in the Key Value field is wrapped (i.e., encrypted, or MACed/signed, or both).
Response Payload Object REQUIRED Description Unique Identifier, see 3.1 Yes, MAY be repeated The list of Unique Identifiers of the newly created objects. Template-Attribute, see 2.1.7.14 No An OPTIONAL list of object attributes with values that were not specified in the request, but have been implicitly set by the key management system. Table 232: Create Split Key Response Payload Join Split Key This operation requests the server to combine a list of Split Keys into a single Managed Cryptographic Object. The number of Unique Identifiers in the request SHALL be at least the value of the Split Key Threshold defined in the Split Keys. The request contains the Object Type of the Managed Cryptographic Object that the client requests the Split Key Objects be combined to form. If the Object Type formed is Secret Data, the client MAY include the Secret Data Type in the request. The response contains the Unique Identifier of the object obtained by combining the Split Keys. The server SHALL copy the Unique Identifier returned by this operation into the ID Placeholder variable. Request Payload Object REQUIRED Description Object Type, see 3.3 Yes Determines the type of object to be created. Unique Identifier, see 3.1 Yes, MAY be repeated Determines the Split Keys to be combined to form the object returned by the server. The minimum number of identifiers is specified by the Split Key Threshold field in each of the Split Keys. Secret Data Type No Determines which Secret Data type the Split Keys form. Template-Attribute, see 2.1.7.14 No Specifies desired object attributes using templates and/or individual attributes. Table 233: Join Split Key Request Payload Response Payload Object REQUIRED Description Unique Identifier, see 3.1 Yes The Unique Identifier of the object obtained by combining the Split Keys. Template-Attribute, see 2.1.7.14 No An OPTIONAL list of object attributes with values that were not specified in
Certify Error Definition Result Status Result Reason No object with the specified Unique Identifier exists Operation Failed Item Not Found Object specified is not able to be certified Operation Failed Permission Denied The Certificate Request does not contain a signed certificate request of the specified Certificate Request Type Operation Failed Invalid Field The particular Application Namespace is not supported, and Application Data cannot be generated if it was omitted from the client request Operation Failed Application Namespace Not Supported Object is archived Operation Failed Object Archived Table 312: Certify Errors Re-certify Error Definition Result Status Result Reason No object with the specified Unique Identifier exists Operation Failed Item Not Found Object specified is not able to be certified Operation Failed Permission Denied The Certificate Request does not contain a signed certificate request of the specified Certificate Request Type Operation Failed Invalid Field Offset field is not permitted to be specified at the same time as any of the Activation Date or Deactivation Date attributes Operation Failed Invalid Message The particular Application Namespace is not supported, and Application Data cannot be generated if it was omitted from the client request Operation Failed Application Namespace Not Supported Object is archived Operation Failed Object Archived Table 313: Re-certify Errors Locate Error Definition Result Status Result Reason Non-existing attributes, attributes that the server does not understand or templates that do not exist are given in the request Operation Failed Invalid Field
processed are returned normally. Responses to batch items that have not been processed are not returned. that failed Processing of batch item fails with Batch Error Continuation Option set to Continue Batch item fails and Result Status is set to Operation Failed. Responses to other batch items are returned normally. See tables above, referring to the operation being performed in the batch item that failed Processing of batch item fails with Batch Error Continuation Option set to Undo Batch item fails and Result Status is set to Operation Failed. Batch items that had been processed have been undone and their responses are returned with Undone result status. See tables above, referring to the operation being performed in the batch item that failed Table 342: Batch Items Errors