Transparent EC Public Key If the Key Format Type in the Key Block is Transparent EC Public Key, then Key Material is a structure as shown in Table 28. Object Encoding REQUIRED Key Material Structure Recommended Curve Enumeration, see 9.1.3.2.5 Yes Q String Byte String Yes Table 28: Key Material Object Structure for Transparent EC Public Keys Template-Attribute Structures The Template Managed Object is deprecated as of version 1.3 of this specification and MAY be removed from subsequent versions of the specification. Individual Attributes SHOULD be used in operations which currently support use of a Name within a Template-Attribute to reference a Template. These structures are used in various operations to provide the desired attribute values and/or template names in the request and to return the actual attribute values in the response. The Template-Attribute, Common Template-Attribute, Private Key Template-Attribute, and Public Key Template-Attribute structures are defined identically as follows: Object Encoding REQUIRED Template-Attribute, Common Template-Attribute, Private Key Public Key Template-Attribute Structure Name Structure, see 3.2 No, MAY be repeated. (deprecated) Attribute Attribute Object, see 2.1.1 No, MAY be repeated Table 29: Template-Attribute Object Structure Name is the Name attribute of the Template object defined in Section . Extension Information An Extension Information object is a structure (see Table 30) describing Objects with Item Tag values in the Extensions range. The Extension Name is a Text String that is used to name the Object (first column of Table 288). The Extension Tag is the Item Tag Value of the Object (see Table 288). The Extension Type is the Item Type Value of the Object (see Table 286). Object Encoding REQUIRED Extension Information Structure Extension Name Text String Yes Extension Tag Integer No Extension Type Integer No Table 30: Extension Information Structure Attribute,
Validation Information The Validation Information base object is a structure that contains details of a formal validation. Specific fields MAY pertain only to certain types of validations. Object Encoding REQUIRED Validation Information Structure Validation Authority Type Enumeration, see 9.1.3.2.40 Yes Validation Authority Country Text String No Validation Authority URI Text String No Validation Version Major Integer Yes Validation Version Minor Integer No Validation Type Enumeration, see 0 Yes Validation Level Integer Yes Validation Certificate Identifier Text String No Validation Certificate URI Text String No Validation Vendor URI Text String No Validation Profile Text String (MAY be repeated) No Table 41: Validation Information Structure The Validation Authority along with the Validation Version Major, Validation Type and Validation Level SHALL be provided to uniquely identify a validation for a given validation authority. If the Validation Certificate URI is not provided the server SHOULD include a Validation Vendor URI from which information related to the validation is available. The Validation Authority Country is the two letter ISO country code. Capability Information The Capability Information base object is a structure that contains details of the supported capabilities.
Object Encoding REQUIRED Capability Information Structure Streaming Capability Boolean No Asynchronous Capability Boolean No Attestation Capability Boolean No Batch Undo Capability Boolean No Batch Capability Boolean No Unwrap Mode Enumeration, see 9.1.3.2.43 No Destroy Action Enumeration, see 9.1.3.2.44 No Shredding Algorithm Enumeration, see 9.1.3.2.45 No RNG Mode Enumeration, see 9.1.3.2.46 No Table 42: Capability Information Structure Authenticated Encryption Additional Data The Authenticated Encryption Additional Data object is used in authenticated encryption and decryption operations that require the optional additional data to be provided by the client. Object Encoding REQUIRED Authenticated Encryption Additional Data Byte String No Table 43 Authenticated Encryption Additional Data Authenticated Encryption Tag The Authenticated Encryption Tag object is used to validate the integrity of the data encrypted and decrypted in Authenticated Encryption modes. It is an output from the encryption process and an input to the decryption process. See [SP800-38D]. Object Encoding REQUIRED Authenticated Encryption Tag Byte String No Table 44 Authenticated Encryption Tag Managed Objects Managed Objects are objects that are the subjects of key management operations, which are described in Sections 4 and 5. Managed Cryptographic Objects are the subset of Managed Objects that contain cryptographic material (e.g., certificates, keys, and secret data).
Object Encoding REQUIRED Cryptographic Parameters Structure Block Cipher Mode Enumeration, see 9.1.3.2.14 No Padding Method Enumeration, see 9.1.3.2.15 No Hashing Algorithm Enumeration, see 9.1.3.2.16 No Key Role Type Enumeration, see 9.1.3.2.17 No Digital Signature Algorithm Enumeration, see 9.1.3.2.7 No Cryptographic Algorithm Enumeration, see 9.1.3.2.13 No Random IV Boolean No IV Length Integer No unless Block Cipher Mode supports variable IV lengths Tag Length Integer No unless Block Cipher Mode is GCM Fixed Field Length Integer No Invocation Field Length Integer No Counter Length Integer No Initial Counter Value Integer No Salt Length Integer No (if omitted, defaults to the block size of the Mask Generator Hashing Algorithm) Mask Generator Enumeration, see 9.1.3.2.49 No (if omitted defaults to MFG1). Mask Generator Hashing Algorithm Enumeration, see 9.1.3.2.16 No. (if omitted defaults to P Source Byte String No (if omitted, defaults to an empty byte string for encoding input P in OAEP padding) Trailer Field Integer No (if omitted, defaults to the standard one-byte trailer in PSS padding) Table 65: Cryptographic Parameters Attribute Structure
Object Encoding Asynchronous Correlation Value Byte String Table 268: Asynchronous Correlation Value in Response Batch Item Result Status This is sent in a response message and indicates the success or failure of a request. The following values MAY be set in this field: Success – The requested operation completed successfully. Operation Pending – The requested operation is in progress, and it is necessary to obtain the actual result via asynchronous polling. The asynchronous correlation value SHALL be used for the subsequent polling of the result status. Operation Undone – The requested operation was performed, but had to be undone (i.e., due to a failure in a batch for which the Error Continuation Option (see 6.13 and 7.2) was set to Undo). Operation Failed – The requested operation failed. Object Encoding Result Status Enumeration, see 9.1.3.2.28 Table 269: Result Status in Response Batch Item Result Reason This field indicates a reason for failure or a modifier for a partially successful operation and SHALL be present in responses that return a Result Status of Failure. In such a case, the Result Reason SHALL be set as specified in Section 11. It is OPTIONAL in any response that returns a Result Status of Success. The following defined values are defined for this field: Item not found – A requested object was not found or did not exist. Response too large – The response to a request would exceed the Maximum Response Size in the request. Authentication not successful – The authentication information in the request could not be validated, or was not found. Invalid message – The request message was not understood by the server. Operation not supported – The operation requested by the request message is not supported by the server. Missing data – The operation REQUIRED additional information in the request, which was not present. Invalid field – Some data item in the request has an invalid value. Feature not supported – An OPTIONAL feature specified in the request is not supported. Operation canceled by requester – The operation was asynchronous, and the operation was canceled by the Cancel operation before it completed successfully. Cryptographic failure – The operation failed due to a cryptographic error. Illegal operation – The client requested an operation that was not able to be performed with the specified parameters. Permission denied – The client does not have permission to perform the requested operation.
Error Definition Action Result Reason Protocol major version mismatch Response message containing a header and a Batch Item without Operation, but with the Result Status field set to Operation Failed Invalid Message Error parsing batch item or payload within batch item Batch item fails; Result Status is Operation Failed Invalid Message The same field is contained in a header/batch item/payload more than once Result Status is Operation Failed Invalid Message Same major version, different minor versions; unknown fields/fields the server does not understand Ignore unknown fields, process rest normally N/A Same major & minor version, unknown field Result Status is Operation Failed Invalid Field Client is not allowed to perform the specified operation Result Status is Operation Failed Permission Denied Maximum Response Size has been exceeded Result Status is Operation Failed Response Too Large Server does not support operation Result Status is Operation Failed Operation Not Supported The Criticality Indicator in a Message Extension structure is set to True, but the server does not understand the extension Result Status is Operation Failed Feature Not Supported Message cannot be parsed Response message containing a header and a Batch Item without Operation, but with the Result Status field set to Operation Failed Invalid Message Operation requires attestation data which was not provided by the client, and the client has set the Attestation Capable indicator to True Result Status is Operation Failed Attestation Required Operation requires attestation data which was not provided by the client, and the client has set the Attestation Capable indicator to False Result Status is Operation Failed Permission Denied
Re-key Key Pair Error Definition Result Status Result Reason No object with the specified Unique Identifier exists Operation Failed Item Not Found Object specified is not able to be Operation Failed Permission Denied Offset field is not permitted to be specified at the same time as any of the Activation Date or Deactivation Date attributes Operation Failed Invalid Message Cryptographic error during re-key Operation Failed Cryptographic Failure The particular Application Namespace is not supported, and Application Data cannot be generated if it was omitted from the client request Operation Failed Application Namespace Not Supported Object is archived Operation Failed Object Archived An offset cannot be used to specify new Process Start, Protect Stop and/or Deactivation Date attribute values since no Activation Date has been specified for the existing key Operation Failed Illegal Operation The Key Value is not present on the server Operation Failed Key Value Not Present Table 332: Re-key Key Pair Errors
Cancel N/A Poll Error Definition Result Status Result Reason No outstanding operation with the specified Asynchronous Correlation Value exists Operation Failed Item Not Found Table 352: Poll Errors Encrypt Error Definition Result Status Result Reason No object with the specified Unique Identifier exists Operation Failed Item Not Found Object specified is not able to be used for encryption Operation Failed Permission Denied Cryptographic error during encryption Operation Failed Cryptographic Failure Object is archived Operation Failed Object Archived The Key Value is not present on the server Operation Failed Key Value Not Present No outstanding operation with the specified Correlation Value exists Operation Failed Item Not Found Table 353: Encrypt Errors Decrypt Error Definition Result Status Result Reason No object with the specified Unique Identifier exists Operation Failed Item Not Found Object specified is not able to be used for decryption Operation Failed Permission Denied Cryptographic error during decryption Operation Failed Cryptographic Failure Object is archived Operation Failed Object Archived The Key Value is not present on the server Operation Failed Key Value Not Present No outstanding operation with the specified Correlation Value exists Operation Failed Item Not Found Table 354: Decrypt Errors
Error Definition Action Result Reason Processing of batch item fails with Batch Error Continuation Option set to Stop Batch item fails and Result Status is set to Operation Failed. Responses to batch items that have already been processed are returned normally. Responses to batch items that have not been processed are not returned. See tables above, referring to the operation being performed in the batch item that failed Processing of batch item fails with Batch Error Continuation Option set to Continue Batch item fails and Result Status is set to Operation Failed. Responses to other batch items are returned normally. See tables above, referring to the operation being performed in the batch item that failed Processing of batch item fails with Batch Error Continuation Option set to Undo Batch item fails and Result Status is set to Operation Failed. Batch items that had been processed have been undone and their responses are returned with Undone result status. See tables above, referring to the operation being performed in the batch item that failed Table 366: Batch Items Errors