operation that is being performed across multiple requests. Note: the server decides which operations are supported for multi-part usage. A server-generated correlation value SHALL be specified in any subsequent cryptographic operations that pertain to the original operation. Object Encoding Correlation Value Byte String Table : Correlation Value Structure Init Indicator The Init Indicator is used in requests in cryptographic operations that support multi-part (streaming) operations. This is provided in the first request with a value of True to an operation that is being performed across multiple requests. Object Encoding Init Indicator Boolean Table : Init Indicator Structure Final Indicator The Final Indicator is used in requests in cryptographic operations that support multi-part (streaming) operations. This is provided in the final (last) request with a value of True to an operation that is being performed across multiple requests. Object Encoding Final Indicator Boolean Table : Final Indicator Structure
Response Payload Object REQUIRED Description Object Type, see 3.3 Yes Type of object created. Unique Identifier, see 3.1 Yes The Unique Identifier of the newly created object. Template-Attribute, see 2.1.8 No An OPTIONAL list of object attributes with values that were not specified in the request, but have been implicitly set by the key management server. The Template Managed Object is deprecated as of version 1.3 of this specification and MAY be removed from subsequent versions of the specification. Individual Attributes SHOULD be used in operations which currently support use of a Name within a Template-Attribute to reference a Template. Table : Create Response Payload Table 165 indicates which attributes SHALL be included in the Create request using the object. Attribute REQUIRED Cryptographic Algorithm, see 3.4 Yes Cryptographic Usage Mask, see 3.19 Yes Table : Create Attribute Requirements Create Key Pair This operation requests the server to generate a new public/private key pair and register the two corresponding new Managed Cryptographic Objects. The request contains attributes to be assigned to the objects (e.g., Cryptographic Algorithm, Cryptographic Length, etc.). Attributes and Template Names MAY be specified for both keys at the same time by specifying a Common Template-Attribute object in the request. Attributes not common to both keys (e.g., Name, Cryptographic Usage Mask) MAY be specified using the Private Key Template-Attribute and Public Key Template-Attribute objects in the request, which take precedence over the Common Template-Attribute object. The Template Managed Object is deprecated as of version 1.3 of this specification and MAY be removed from subsequent versions of the specification. Individual Attributes SHOULD be used in operations which currently support use of a Name within a Template-Attribute to reference a Template. For the Private Key, the server SHALL create a Link attribute of Link Type Public Key pointing to the Public Key. For the Public Key, the server SHALL create a Link attribute of Link Type Private Key pointing to the Private Key. The response contains the Unique Identifiers of both created objects. The ID Placeholder value SHALL be set to the Unique Identifier of the Private Key.
Response Payload Object REQUIRED Description Unique Identifier, see 3.1 Yes The Unique Identifier of the Managed Cryptographic Object that is the key used for the verification operation. Validity Indicator, see 9.1.3.2.23 Yes An Enumeration object indicating whether the signature is valid, invalid, or unknown. Data No The OPTIONAL recovered data (as a Byte String) for those signature algorithms where data recovery from the signature is supported. Correlation Value, see 2.1.15 No Specifies the stream or by-parts value to be provided in subsequent calls to this operation for performing cryptographic operations. Table : Signature Verify Response Payload MAC This operation requests the server to perform message authentication code (MAC) operation on the provided data using a Managed Cryptographic Object as the key for the MAC operation. The request contains information about the cryptographic parameters (cryptographic algorithm) and the data to be MACed. The cryptographic parameters MAY be omitted from the request as they can be specified as associated attributes of the Managed Cryptographic Object. The response contains the Unique Identifier of the Managed Cryptographic Object used as the key and the result of the MAC operation. The success or failure of the operation is indicated by the Result Status (and if failure the Result Reason) in the response header.
Extensions 8XXXXXXX Table : Credential Type Enumeration Key Compression Type Enumeration Key Compression Type Name Value EC Public Key Type Uncompressed 00000001 EC Public Key Type X9.62 Compressed Prime 00000002 EC Public Key Type X9.62 Compressed Char2 00000003 EC Public Key Type X9.62 Hybrid 00000004 Extensions 8XXXXXXX Table : Key Compression Type Enumeration Key Format Type Enumeration Key Format Type Name Value Raw 00000001 Opaque 00000002 PKCS#1 00000003 PKCS#8 00000004 X.509 00000005 ECPrivateKey 00000006 Transparent Symmetric Key 00000007 Transparent DSA Private Key 00000008 Transparent DSA Public Key 00000009 Transparent RSA Private Key 0000000A Transparent RSA Public Key 0000000B Transparent DH Private Key 0000000C Transparent DH Public Key 0000000D Transparent ECDSA Private Key 0000000E (deprecated) Transparent ECDSA Public Key 0000000F (deprecated) Transparent ECDH Private Key 00000010 (deprecated) Transparent ECDH Public Key 00000011 (deprecated) Transparent ECMQV Private Key 00000012 (deprecated)
Padding Method Enumeration Padding Method Name Value None 00000001 OAEP 00000002 PKCS5 00000003 SSL3 00000004 Zeros 00000005 ANSI X9.23 00000006 ISO 10126 00000007 PKCS1 v1.5 00000008 X9.31 00000009 PSS 0000000A Extensions 8XXXXXXX Table : Padding Method Enumeration Hashing Algorithm Enumeration Hashing Algorithm Name Value MD2 00000001 MD4 00000002 MD5 00000003 SHA-1 00000004 SHA-224 00000005 SHA-256 00000006 SHA-384 00000007 SHA-512 00000008 RIPEMD-160 00000009 Tiger 0000000A Whirlpool 0000000B SHA-512/224 0000000C SHA-512/256 0000000D SHA-3-224 0000000E SHA-3-256 0000000F SHA-3-384 00000010 SHA-3-512 00000011 Extensions 8XXXXXXX Table : Hashing Algorithm Enumeration
Get Attributes Error Definition Result Status Result Reason No object with the specified Unique Identifier exists Operation Failed Item Not Found The same Attribute Name is present more than once Operation Failed Invalid Message Object is archived Operation Failed Object Archived Table : Get Attributes Errors Get Attribute List Error Definition Result Status Result Reason No object with the specified Unique Identifier exists Operation Failed Item Not Found Object is archived Operation Failed Object Archived Table : Get Attribute List Errors Add Attribute Error Definition Result Status Result Reason No object with the specified Unique Identifier exists Operation Failed Item Not Found Attempt to add a read-only attribute Operation Failed Permission Denied Attempt to add an attribute that is not supported for this object Operation Failed Permission Denied The specified attribute already exists Operation Failed Illegal Operation New attribute contains Attribute Index Operation Failed Invalid Field Trying to add a Name attribute with the same value that another object already has Operation Failed Illegal Operation Trying to add a new instance to an attribute with multiple instances but the server limit on instances has been reached Operation Failed Index Out of Bounds The particular Application Namespace is not supported, and Application Data cannot be generated if it was omitted from the client request Operation Failed Application Namespace Not Supported Object is archived Operation Failed Object Archived Table : Add Attribute Errors
Sign Error Definition Result Status Result Reason No object with the specified Unique Identifier exists Operation Failed Item Not Found Object specified is not able to be used for signing Operation Failed Permission Denied Cryptographic error during signing Operation Failed Cryptographic Failure Object is archived Operation Failed Object Archived The Key Value is not present on the server Operation Failed Key Value Not Present No outstanding operation with the specified Correlation Value exists Operation Failed Item Not Found Table : Sign Errors Signature Verify Error Definition Result Status Result Reason No object with the specified Unique Identifier exists Operation Failed Item Not Found Object specified is not able to be used for signature verification Operation Failed Permission Denied Cryptographic error during signature verification Operation Failed Cryptographic Failure Object is archived Operation Failed Object Archived The Key Value is not present on the server Operation Failed Key Value Not Present No outstanding operation with the specified Correlation Value exists Operation Failed Item Not Found Table : Signature Verify Errors
MAC Error Definition Result Status Result Reason No object with the specified Unique Identifier exists Operation Failed Item Not Found Object specified is not able to be used for MACing Operation Failed Permission Denied Cryptographic error during MACing Operation Failed Cryptographic Failure Object is archived Operation Failed Object Archived The Key Value is not present on the server Operation Failed Key Value Not Present No outstanding operation with the specified Correlation Value exists Operation Failed Item Not Found Table : MAC Errors MAC Verify Error Definition Result Status Result Reason No object with the specified Unique Identifier exists Operation Failed Item Not Found Object specified is not able to be used for MAC verification Operation Failed Permission Denied Cryptographic error during MAC verification Operation Failed Cryptographic Failure Object is archived Operation Failed Object Archived The Key Value is not present on the server Operation Failed Key Value Not Present No outstanding operation with the specified Correlation Value exists Operation Failed Item Not Found Table : MAC Verify Errors RNG Retrieve Error Definition Result Status Result Reason Cryptographic error during RNG Retrieve Operation Failed Cryptographic Failure Table : RNG Retrieve Errors RNG Seed Error Definition Result Status Result Reason Cryptographic error during RNG Seed Operation Failed Cryptographic Failure Table : RNG Seed Errors
Error Definition Action Result Reason Processing of batch item fails with Batch Error Continuation Option set to Stop Batch item fails and Result Status is set to Operation Failed. Responses to batch items that have already been processed are returned normally. Responses to batch items that have not been processed are not returned. See tables above, referring to the operation being performed in the batch item that failed Processing of batch item fails with Batch Error Continuation Option set to Continue Batch item fails and Result Status is set to Operation Failed. Responses to other batch items are returned normally. See tables above, referring to the operation being performed in the batch item that failed Processing of batch item fails with Batch Error Continuation Option set to Undo Batch item fails and Result Status is set to Operation Failed. Batch items that had been processed have been undone and their responses are returned with Undone result status. See tables above, referring to the operation being performed in the batch item that failed Table : Batch Items Errors