Request Payload Object REQUIRED Description Unique Identifier, see 3.1 No The Unique Identifier of the Public Key being certified. If omitted, then the ID Placeholder value is used by the server as the Unique Identifier. Certificate Request Type, see 9.1.3.2.22 No An Enumeration object specifying the type of certificate request. It is REQUIRED if the Certificate Request is present. Certificate Request No A Byte String object with the certificate request. Template-Attribute, see 2.1.7.14 No Specifies desired object attributes using templates and/or individual attributes. The Template Managed Object is deprecated as of version 1.3 of this specification and MAY be removed from subsequent versions of the specification. Individual Attributes SHOULD be used in operations which currently support use of a Name within a Template-Attribute to reference a Template. Table : Certify Request Payload Response Payload Object REQUIRED Description Unique Identifier, see 3.1 Yes The Unique Identifier of the generated Certificate object. Template-Attribute, see 2.1.7.14 No An OPTIONAL list of object attributes with values that were not specified in the request, but have been implicitly set by the key management server. The Template Managed Object is deprecated as of version 1.3 of this specification and MAY be removed from subsequent versions of the specification. Individual Attributes SHOULD be used in operations which currently support use of a Name within a Template-Attribute to reference a Template. Table : Certify Response Payload Re-certify This request is used to renew an existing certificate for the same key pair. Only a single certificate SHALL be renewed at a time. Server support for this operation is OPTIONAL. If the server does not support this operation, an error SHALL be returned.
Response Payload Object REQUIRED Description Data Yes for single-part. No for The hashed data (as a Byte String). Correlation Value, see 2.1.15 No Specifies the stream or by-parts value to be provided in subsequent calls to this operation for performing cryptographic operations. Table : Hash Response Payload Create Split Key This operation requests the server to generate a new split key and register all the splits as individual new Managed Cryptographic Objects. The request contains attributes to be assigned to the objects (e.g., Split Key Parts, Split Key Threshold, Split Key Method, Cryptographic Algorithm, Cryptographic Length, etc.). The request MAY contain the Unique Identifier of an existing cryptographic object that the client requests be split by the server. If the attributes supplied in the request do not match those of the key supplied, the attributes of the key take precedence. The response contains the Unique Identifiers of all created objects. The ID Placeholder value SHALL be set to the Unique Identifier of the split whose Key Part Identifier is 1. Request Payload Object REQUIRED Description Object Type, see 3.3 Yes Determines the type of object to be created. Unique Identifier, see 3.1 No The Unique Identifier of the key to be split (if applicable). Split Key Parts Yes The total number of parts. Split Key Threshold Yes The minimum number of parts needed to reconstruct the entire key. Split Key Method Yes Prime Field Size No Template-Attribute, see 2.1.7.14 Yes Specifies desired object attributes using templates and/or individual attributes. Table : Create Split Key Request Payload
Digital Signature Algorithm Enumeration Digital Signature Algorithm Name Value MD2 with RSA Encryption (PKCS#1 v1.5) 00000001 MD5 with RSA Encryption (PKCS#1 v1.5) 00000002 SHA-1 with RSA Encryption (PKCS#1 v1.5) 00000003 SHA-224 with RSA Encryption (PKCS#1 v1.5) 00000004 SHA-256 with RSA Encryption (PKCS#1 v1.5) 00000005 SHA-384 with RSA Encryption (PKCS#1 v1.5) 00000006 SHA-512 with RSA Encryption (PKCS#1 v1.5) 00000007 RSASSA-PSS (PKCS#1 v2.1) 00000008 DSA with SHA-1 00000009 DSA with SHA224 0000000A DSA with SHA256 0000000B ECDSA with SHA-1 0000000C ECDSA with SHA224 0000000D ECDSA with SHA256 0000000E ECDSA with SHA384 0000000F ECDSA with SHA512 00000010 Extensions 8XXXXXXX Table : Digital Signature Algorithm Enumeration Split Key Method Enumeration Split Key Method Name Value XOR 00000001 Polynomial Sharing GF (216) 00000002 Polynomial Sharing Prime Field 00000003 Polynomial Sharing GF (28) 00000004 Extensions 8XXXXXXX Table : Split Key Method Enumeration
Trying to set more instances than the server supports of an attribute that MAY have multiple instances Operation Failed Index Out of Bounds REQUIRED field(s) missing Operation Failed Invalid Message The particular Application Namespace is not supported, and Application Data cannot be generated if it was omitted from the client request Operation Failed Application Namespace Not Supported Template object is archived Operation Failed Object Archived Table : Create Key Pair Errors Register Error Definition Result Status Result Reason Object Type is not recognized Operation Failed Invalid Field Object Type does not match type of cryptographic object provided Operation Failed Invalid Field Templates that do not exist are given in request Operation Failed Item Not Found Incorrect attribute value(s) specified Operation Failed Invalid Field Trying to register a new Template object containing a Name attribute with the Template structure Operation Failed Invalid Field Trying to register a new object with the same Name attribute value as an existing object Operation Failed Invalid Field Trying to set more instances than the server supports of an attribute that MAY have multiple instances Operation Failed Index Out of Bounds The particular Application Namespace is not supported, and Application Data cannot be generated if it was omitted from the client request Operation Failed Application Namespace Not Supported Template object is archived Operation Failed Object Archived Encoding Option not permitted when Key Wrapping Specification contains attribute names Operation Failed Encoding Option Error Table : Register Errors
Certify Error Definition Result Status Result Reason No object with the specified Unique Identifier exists Operation Failed Item Not Found Object specified is not able to be certified Operation Failed Permission Denied The Certificate Request does not contain a signed certificate request of the specified Certificate Request Type Operation Failed Invalid Field The particular Application Namespace is not supported, and Application Data cannot be generated if it was omitted from the client request Operation Failed Application Namespace Not Supported Object is archived Operation Failed Object Archived Table : Certify Errors Re-certify Error Definition Result Status Result Reason No object with the specified Unique Identifier exists Operation Failed Item Not Found Object specified is not able to be certified Operation Failed Permission Denied The Certificate Request does not contain a signed certificate request of the specified Certificate Request Type Operation Failed Invalid Field Offset field is not permitted to be specified at the same time as any of the Activation Date or Deactivation Date attributes Operation Failed Invalid Message The particular Application Namespace is not supported, and Application Data cannot be generated if it was omitted from the client request Operation Failed Application Namespace Not Supported Object is archived Operation Failed Object Archived Table : Re-certify Errors Locate Error Definition Result Status Result Reason Non-existing attributes, attributes that the server does not understand or templates that do not exist are given in the request Operation Failed Invalid Field
Key Wrapping Specification contains attribute names Table : Get Errors Get Attributes Error Definition Result Status Result Reason No object with the specified Unique Identifier exists Operation Failed Item Not Found The same Attribute Name is present more than once Operation Failed Invalid Message Object is archived Operation Failed Object Archived Table : Get Attributes Errors Get Attribute List Error Definition Result Status Result Reason No object with the specified Unique Identifier exists Operation Failed Item Not Found Object is archived Operation Failed Object Archived Table : Get Attribute List Errors Add Attribute Error Definition Result Status Result Reason No object with the specified Unique Identifier exists Operation Failed Item Not Found Attempt to add a read-only attribute Operation Failed Permission Denied Attempt to add an attribute that is not supported for this object Operation Failed Permission Denied The specified attribute already exists Operation Failed Illegal Operation New attribute contains Attribute Index Operation Failed Invalid Field Trying to add a Name attribute with the same value that another object already has Operation Failed Illegal Operation Trying to add a new instance to an attribute with multiple instances but the server limit on instances has been reached Operation Failed Index Out of Bounds The particular Application Namespace is not supported, and Application Data cannot be generated if it was omitted from the client request Operation Failed Application Namespace Not Supported
Object is archived Operation Failed Object Archived Table : Add Attribute Errors Modify Attribute Error Definition Result Status Result Reason No object with the specified Unique Identifier exists Operation Failed Item Not Found A specified attribute does not exist (i.e., it needs to first be added) Operation Failed Invalid Field No matching attribute instance exists Operation Failed Item Not Found The specified attribute is read-only Operation Failed Permission Denied Trying to set the Name attribute value to a value already used by another object Operation Failed Illegal Operation The particular Application Namespace is not supported, and Application Data cannot be generated if it was omitted from the client request Operation Failed Application Namespace Not Supported Object is archived Operation Failed Object Archived Table : Modify Attribute Errors Delete Attribute Error Definition Result Status Result Reason No object with the specified Unique Identifier exists Operation Failed Item Not Found Attempt to delete a attribute Operation Failed Permission Denied No matching attribute instance exists Operation Failed Item Not Found No attribute with the specified name exists Operation Failed Item Not Found Object is archived Operation Failed Object Archived Table : Delete Attribute Errors
a certificate list One or more of the objects is archived Operation Failed Object Archived Table : Validate Errors Query N/A Discover Versions N/A Cancel N/A Poll Error Definition Result Status Result Reason No outstanding operation with the specified Asynchronous Correlation Value exists Operation Failed Item Not Found Table : Poll Errors Encrypt Error Definition Result Status Result Reason No object with the specified Unique Identifier exists Operation Failed Item Not Found Object specified is not able to be used for encryption Operation Failed Permission Denied Cryptographic error during encryption Operation Failed Cryptographic Failure Object is archived Operation Failed Object Archived The Key Value is not present on the server Operation Failed Key Value Not Present No outstanding operation with the specified Correlation Value exists Operation Failed Item Not Found Table : Encrypt Errors Decrypt
server No outstanding operation with the specified Correlation Value exists Operation Failed Item Not Found Table : Signature Verify Errors MAC Error Definition Result Status Result Reason No object with the specified Unique Identifier exists Operation Failed Item Not Found Object specified is not able to be used for MACing Operation Failed Permission Denied Cryptographic error during MACing Operation Failed Cryptographic Failure Object is archived Operation Failed Object Archived The Key Value is not present on the server Operation Failed Key Value Not Present No outstanding operation with the specified Correlation Value exists Operation Failed Item Not Found Table : MAC Errors MAC Verify Error Definition Result Status Result Reason No object with the specified Unique Identifier exists Operation Failed Item Not Found Object specified is not able to be used for MAC verification Operation Failed Permission Denied Cryptographic error during MAC verification Operation Failed Cryptographic Failure Object is archived Operation Failed Object Archived The Key Value is not present on the server Operation Failed Key Value Not Present No outstanding operation with the specified Correlation Value exists Operation Failed Item Not Found Table : MAC Verify Errors RNG Retrieve
processed are returned normally. Responses to batch items that have not been processed are not returned. that failed Processing of batch item fails with Batch Error Continuation Option set to Continue Batch item fails and Result Status is set to Operation Failed. Responses to other batch items are returned normally. See tables above, referring to the operation being performed in the batch item that failed Processing of batch item fails with Batch Error Continuation Option set to Undo Batch item fails and Result Status is set to Operation Failed. Batch items that had been processed have been undone and their responses are returned with Undone result status. See tables above, referring to the operation being performed in the batch item that failed Table : Batch Items Errors