Credential A Credential is a structure (see Table 3) used for client identification purposes and is not managed by the key management system (e.g., user id/password pairs, Kerberos tokens, etc.). It MAY be used for authentication purposes as indicated in [KMIP-Prof]. Object Encoding REQUIRED Credential Structure Credential Type Enumeration, see 9.1.3.2.1 Yes Credential Value Varies based on Credential Type. Yes Table 3: Credential Object Structure If the Credential Type in the Credential is Username and Password, then Credential Value is a structure as shown in Table 4. The Username field identifies the client, and the Password field is a secret that authenticates the client. Object Encoding REQUIRED Credential Value Structure Username Text String Yes Password Text String No Table 4: Credential Value Structure for the Username and Password Credential If the Credential Type in the Credential is Device, then Credential Value is a structure as shown in Table 5. One or a combination of the Device Serial Number, Network Identifier, Machine Identifier, and Media Identifier SHALL be unique. Server implementations MAY enforce policies on uniqueness for individual fields. A shared secret or password MAY also be used to authenticate the client. The client SHALL provide at least one field. Object Encoding REQUIRED Credential Value Structure Device Serial Number Text String No Password Text String No Device Identifier Text String No Network Identifier Text String No Machine Identifier Text String No Media Identifier Text String No Table 5: Credential Value Structure for the Device Credential If the Credential Type in the Credential is Attestation, then Credential Value is a structure as shown in Table 6. The Nonce Value is obtained from the key management server in a Nonce Object. The Attestation Credential Object can contain a measurement from the client or an assertion from a third party if the server is not capable or willing to verify the attestation data from the client. Neither type of attestation data (Attestation Measurement or Attestation Assertion) is necessary to allow the server to accept either. However, the client SHALL provide attestation data in either the Attestation Measurement or Attestation Assertion fields.
Request Payload Object REQUIRED Description Protocol Version, see 6.1 No, MAY be Repeated The list of protocol versions supported by the client ordered in decreasing order of preference. Table 224: Discover Versions Request Payload Response Payload Object REQUIRED Description Protocol Version, see 6.1 No, MAY be repeated The list of protocol versions supported by the server ordered in decreasing order of preference. Table 225: Discover Versions Response Payload Cancel This operation requests the server to cancel an outstanding asynchronous operation. The correlation value (see Section 6.8) of the original operation SHALL be specified in the request. The server SHALL respond with a Cancellation Result that contains one of the following values: Canceled – The cancel operation succeeded in canceling the pending operation. Unable To Cancel – The cancel operation is unable to cancel the pending operation. Completed – The pending operation completed successfully before the cancellation operation was able to cancel it. Failed – The pending operation completed with a failure before the cancellation operation was able to cancel it. Unavailable – The specified correlation value did not match any recently pending or completed asynchronous operations. The response to this operation is not able to be asynchronous. Request Payload Object REQUIRED Description Asynchronous Correlation Value, see 6.8 Yes Specifies the request being canceled. Table 226: Cancel Request Payload Response Payload Object REQUIRED Description Asynchronous Correlation Value, see 6.8 Yes Specified in the request. Cancellation Result, see 9.1.3.2.25 Yes Enumeration indicating the result of the cancellation. Table 227: Cancel Response Payload
Digital Signature Algorithm Enumeration Digital Signature Algorithm Name Value MD2 with RSA Encryption (PKCS#1 v1.5) 00000001 MD5 with RSA Encryption (PKCS#1 v1.5) 00000002 SHA-1 with RSA Encryption (PKCS#1 v1.5) 00000003 SHA-224 with RSA Encryption (PKCS#1 v1.5) 00000004 SHA-256 with RSA Encryption (PKCS#1 v1.5) 00000005 SHA-384 with RSA Encryption (PKCS#1 v1.5) 00000006 SHA-512 with RSA Encryption (PKCS#1 v1.5) 00000007 RSASSA-PSS (PKCS#1 v2.1) 00000008 DSA with SHA-1 00000009 DSA with SHA224 0000000A DSA with SHA256 0000000B ECDSA with SHA-1 0000000C ECDSA with SHA224 0000000D ECDSA with SHA256 0000000E ECDSA with SHA384 0000000F ECDSA with SHA512 00000010 Extensions 8XXXXXXX Table 295: Digital Signature Algorithm Enumeration Split Key Method Enumeration Split Key Method Name Value XOR 00000001 Polynomial Sharing GF (216) 00000002 Polynomial Sharing Prime Field 00000003 Polynomial Sharing GF (28) 00000004 Extensions 8XXXXXXX Table 296: Split Key Method Enumeration
Batch Error Continuation Option Enumeration Batch Error Continuation Name Value Continue 00000001 Stop 00000002 Undo 00000003 Extensions 8XXXXXXX Table 318: Batch Error Continuation Option Enumeration Usage Limits Unit Enumeration Usage Limits Unit Name Value Byte 00000001 Object 00000002 Extensions 8XXXXXXX Table 319: Usage Limits Unit Enumeration Encoding Option Enumeration Encoding Option Name Value No Encoding 00000001 TTLV Encoding 00000002 Extensions 8XXXXXXX Table 320: Encoding Option Enumeration Object Group Member Enumeration Object Group Member Option Name Value Group Member Fresh 00000001 Group Member Default 00000002 Extensions 8XXXXXXX Table 321: Object Group Member Enumeration Alternative Name Type Enumeration Alternative Name Type Name Value Uninterpreted Text String 00000001 URI 00000002
RNG Cryptographic Server KMIP v1.4 0000008A Basic Symmetric Key Foundry Client KMIP v1.4 0000008B Intermediate Symmetric Key Foundry Client KMIP v1.4 0000008C Advanced Symmetric Key Foundry Client KMIP v1.4 0000008D Symmetric Key Foundry Server KMIP v1.4 0000008E Opaque Managed Object Store Client KMIP v1.4 0000008F Opaque Managed Object Store Server KMIP v1.4 00000090 Suite B minLOS_128 Client KMIP v1.4 00000091 Suite B minLOS_128 Server KMIP v1.4 00000092 Suite B minLOS_192 Client KMIP v1.4 00000093 Suite B minLOS_192 Server KMIP v1.4 00000094 Storage Array with Self Encrypting Drive Client KMIP v1.4 00000095 Storage Array with Self Encrypting Drive Server KMIP v1.4 00000096 HTTPS Client KMIP v1.4 00000097 HTTPS Server KMIP v1.4 00000098 JSON Client KMIP v1.4 00000099 JSON Server KMIP v1.4 0000009A XML Client KMIP v1.4 0000009B XML Server KMIP v1.4 0000009C Extensions 8XXXXXXX Unwrap Mode Enumeration Unwrap Mode Name Value Unspecified 00000001 Processed 00000002 Not Processed 00000003 Extensions 8XXXXXXX
Create Key Pair Error Definition Result Status Result Reason Templates that do not exist are given in request Operation Failed Item Not Found Incorrect attribute value(s) specified Operation Failed Invalid Field Error creating cryptographic object Operation Failed Cryptographic Failure Trying to create a new object with the same Name attribute value as an existing object Operation Failed Invalid Field Trying to set more instances than the server supports of an attribute that MAY have multiple instances Operation Failed Index Out of Bounds REQUIRED field(s) missing Operation Failed Invalid Message The particular Application Namespace is not supported, and Application Data cannot be generated if it was omitted from the client request Operation Failed Application Namespace Not Supported Template object is archived Operation Failed Object Archived Table 329: Create Key Pair Errors
Re-key Error Definition Result Status Result Reason No object with the specified Unique Identifier exists Operation Failed Item Not Found Object specified is not able to be Operation Failed Permission Denied Offset field is not permitted to be specified at the same time as any of the Activation Date, Process Start Date, Protect Stop Date, or Deactivation Date attributes Operation Failed Invalid Message Cryptographic error during re-key Operation Failed Cryptographic Failure The particular Application Namespace is not supported, and Application Data cannot be generated if it was omitted from the client request Operation Failed Application Namespace Not Supported Object is archived Operation Failed Object Archived An offset cannot be used to specify new Process Start, Protect Stop and/or Deactivation Date attribute values since no Activation Date has been specified for the existing key Operation Failed Illegal Operation The Key Value is not present on the server Operation Failed Key Value Not Present Table 331: Re-key Errors
Derive Key Error Definition Result Status Result Reason One or more of the objects specified do not exist Operation Failed Item Not Found One or more of the objects specified are not of the correct type Operation Failed Invalid Field Templates that do not exist are given in request Operation Failed Item Not Found Invalid Derivation Method Operation Failed Invalid Field Invalid Derivation Parameters Operation Failed Invalid Field Ambiguous derivation data provided both with Derivation Data and Secret Data object. Operation Failed Invalid Message Incorrect attribute value(s) specified Operation Failed Invalid Field One or more of the specified objects are not able to be used to derive a new key Operation Failed Invalid Field Trying to derive a new key with the same Name attribute value as an existing object Operation Failed Invalid Field The particular Application Namespace is not supported, and Application Data cannot be generated if it was omitted from the client request Operation Failed Application Namespace Not Supported One or more of the objects is archived Operation Failed Object Archived The specified length exceeds the output of the derivation method or other cryptographic error during derivation. Operation Failed Cryptographic Failure The Key Value is not present on the server Operation Failed Key Value Not Present Table 333: Derive Key Errors-
Get Error Definition Result Status Result Reason Object does not exist Operation Failed Item Not Found Wrapping key does not exist Operation Failed Item Not Found Object with Encryption Key Information exists, but it is not a key Operation Failed Illegal Operation Object with Encryption Key Information exists, but it is not able to be used for wrapping Operation Failed Permission Denied Object with MAC/Signature Key Information exists, but it is not a key Operation Failed Illegal Operation Object with MAC/Signature Key Information exists, but it is not able to be used for MACing/signing Operation Failed Permission Denied Object exists but cannot be provided in the desired Key Format Type and/or Key Compression Type Operation Failed Key Format Type and/or Key Compression Type Not Supported Object exists and is not a Template, but the server only has attributes for this object Operation Failed Illegal Operation Cryptographic Parameters associated with the object do not exist or do not match those provided in the Encryption Key Information and/or Signature Key Information Operation Failed Item Not Found Object is archived Operation Failed Object Archived Object exists but cannot be provided in the desired Encoding Option Operation Failed Encoding Option Error Encoding Option not permitted when Key Wrapping Specification contains attribute names Operation Failed Encoding Option Error Key Wrap Type is not supported by the server. Operation Failed Not Supported. Object is Sensitive Operation Failed Sensitive Object is not Extractable Operation Failed Not Extractble Table 338: Get Errors
Modify Attribute Error Definition Result Status Result Reason No object with the specified Unique Identifier exists Operation Failed Item Not Found A specified attribute does not exist (i.e., it needs to first be added) Operation Failed Invalid Field No matching attribute instance exists Operation Failed Item Not Found The specified attribute is read-only Operation Failed Permission Denied Trying to set the Name attribute value to a value already used by another object Operation Failed Illegal Operation The particular Application Namespace is not supported, and Application Data cannot be generated if it was omitted from the client request Operation Failed Application Namespace Not Supported Object is archived Operation Failed Object Archived Table 342: Modify Attribute Errors Delete Attribute Error Definition Result Status Result Reason No object with the specified Unique Identifier exists Operation Failed Item Not Found Attempt to delete a attribute Operation Failed Permission Denied No matching attribute instance exists Operation Failed Item Not Found No attribute with the specified name exists Operation Failed Item Not Found Object is archived Operation Failed Object Archived Table 343: Delete Attribute Errors Obtain Lease Error Definition Result Status Result Reason No object with the specified Unique Identifier exists Operation Failed Item Not Found The server determines that a new lease is not permitted to be issued for the specified cryptographic object Operation Failed Permission Denied Object is archived Operation Failed Object Archived Table 344: Obtain Lease Errors
Cancel N/A Poll Error Definition Result Status Result Reason No outstanding operation with the specified Asynchronous Correlation Value exists Operation Failed Item Not Found Table 352: Poll Errors Encrypt Error Definition Result Status Result Reason No object with the specified Unique Identifier exists Operation Failed Item Not Found Object specified is not able to be used for encryption Operation Failed Permission Denied Cryptographic error during encryption Operation Failed Cryptographic Failure Object is archived Operation Failed Object Archived The Key Value is not present on the server Operation Failed Key Value Not Present No outstanding operation with the specified Correlation Value exists Operation Failed Item Not Found Table 353: Encrypt Errors Decrypt Error Definition Result Status Result Reason No object with the specified Unique Identifier exists Operation Failed Item Not Found Object specified is not able to be used for decryption Operation Failed Permission Denied Cryptographic error during decryption Operation Failed Cryptographic Failure Object is archived Operation Failed Object Archived The Key Value is not present on the server Operation Failed Key Value Not Present No outstanding operation with the specified Correlation Value exists Operation Failed Item Not Found Table 354: Decrypt Errors
Error Definition Action Result Reason Processing of batch item fails with Batch Error Continuation Option set to Stop Batch item fails and Result Status is set to Operation Failed. Responses to batch items that have already been processed are returned normally. Responses to batch items that have not been processed are not returned. See tables above, referring to the operation being performed in the batch item that failed Processing of batch item fails with Batch Error Continuation Option set to Continue Batch item fails and Result Status is set to Operation Failed. Responses to other batch items are returned normally. See tables above, referring to the operation being performed in the batch item that failed Processing of batch item fails with Batch Error Continuation Option set to Undo Batch item fails and Result Status is set to Operation Failed. Batch items that had been processed have been undone and their responses are returned with Undone result status. See tables above, referring to the operation being performed in the batch item that failed Table 366: Batch Items Errors