2.1.1 Table : Template Object Structure Secret Data A Managed Cryptographic Object containing a shared secret value that is not a key or certificate (e.g., a password). The Key Block of the Secret Data object contains a Key Value of the Secret Data Type. The Key Value MAY be wrapped. Object Encoding REQUIRED Secret Data Structure Secret Data Type Enumeration, see 9.1.3.2.9 Yes Key Block Structure, see 2.1.3 Yes Table : Secret Data Object Structure Opaque Object A Managed Object that the key management server is possibly not able to interpret. The context information for this object MAY be stored and retrieved using Custom Attributes. Object Encoding REQUIRED Opaque Object Structure Opaque Data Type Enumeration, see 9.1.3.2.10 Yes Opaque Data Value Byte String Yes Table : Opaque Object Structure PGP Key A Managed Cryptographic Object that is a text-based representation of a PGP key. The Key Block field, indicated below, will contain the ASCII-armored export of a PGP key in the format as specified in RFC 4880. It MAY contain only a public key block, or both a public and private key block. Two different versions of PGP keys, version 3 and version 4, MAY be stored in this Managed Cryptographic Object. KMIP implementers SHOULD treat the Key Block field as an opaque blob. PGP-aware KMIP clients SHOULD take on the responsibility of decomposing the Key Block into other Managed Cryptographic Objects (Public Keys, Private Keys, etc.). Object Encoding REQUIRED PGP Key Structure PGP Key Version Integer Yes Key Block Structure, see 2.1.3 Yes Table : PGP Key Object Structure
SHALL always have a value All Managed Objects that are of the Object Types for which this attribute applies, SHALL always have this attribute set once the object has been created or registered, up until the object has been destroyed. Initially set by Who is permitted to initially set the value of the attribute (if the attribute has never been set, or if all the attribute values have been deleted)? Modifiable by server Is the server allowed to change an existing value of the attribute without receiving a request from a client? Modifiable by client Is the client able to change an existing value of the attribute value once it has been set? Deletable by client Is the client able to delete an instance of the attribute? Multiple instances permitted Are multiple instances of the attribute permitted? When implicitly set Which operations MAY cause this attribute to be set even if the attribute is not specified in the operation request itself? Applies to Object Types Which Managed Objects MAY have this attribute set? Table : Attribute Rules Unique Identifier The Unique Identifier is generated by the key management system to uniquely identify a Managed Object. It is only REQUIRED to be unique within the identifier space managed by a single key management system, however this identifier SHOULD be globally unique in order to allow for a key management domain export of such objects. This attribute SHALL be assigned by the key management system at creation or registration time, and then SHALL NOT be changed or deleted before the object is destroyed. Object Encoding Unique Identifier Text String Table : Unique Identifier Attribute
Key Role Type 420083 Salt 420084 Secret Data 420085 Secret Data Type 420086 Serial Number 420087 (deprecated as of version 1.1) Server Information 420088 Split Key 420089 Split Key Method 42008A Split Key Parts 42008B Split Key Threshold 42008C State 42008D Storage Status Mask 42008E Symmetric Key 42008F Template 420090 Template-Attribute 420091 Time Stamp 420092 Unique Batch Item ID 420093 Unique Identifier 420094 Usage Limits 420095 Usage Limits Count 420096 Usage Limits Total 420097 Usage Limits Unit 420098 Username 420099 Validity Date 42009A Validity Indicator 42009B Vendor Extension 42009C Vendor Identification 42009D Wrapping Method 42009E X 42009F Y 4200A0 Password 4200A1 Device Identifier 4200A2 Encoding Option 4200A3 Extension Information 4200A4 Extension Name 4200A5 Extension Tag 4200A6
Error Handling This section details the specific Result Reasons that SHALL be returned for errors detected. General These errors MAY occur when any protocol message is received by the server or client (in response to server-to-client operations). Error Definition Action Result Reason Protocol major version mismatch Response message containing a header and a Batch Item without Operation, but with the Result Status field set to Operation Failed Invalid Message Error parsing batch item or payload within batch item Batch item fails; Result Status is Operation Failed Invalid Message The same field is contained in a header/batch item/payload more than once Result Status is Operation Failed Invalid Message Same major version, different minor versions; unknown fields/fields the server does not understand Ignore unknown fields, process rest normally N/A Same major & minor version, unknown field Result Status is Operation Failed Invalid Field Client is not allowed to perform the specified operation Result Status is Operation Failed Permission Denied Maximum Response Size has been exceeded Result Status is Operation Failed Response Too Large Server does not support operation Result Status is Operation Failed Operation Not Supported The Criticality Indicator in a Message Extension structure is set to True, but the server does not understand the extension Result Status is Operation Failed Feature Not Supported Message cannot be parsed Response message containing a header and a Batch Item without Operation, but with the Result Status field set to Operation Failed Invalid Message Operation requires attestation data which was not provided by the client, and the client has set the Attestation Result Status is Operation Failed Attestation Required
processed are returned normally. Responses to batch items that have not been processed are not returned. that failed Processing of batch item fails with Batch Error Continuation Option set to Continue Batch item fails and Result Status is set to Operation Failed. Responses to other batch items are returned normally. See tables above, referring to the operation being performed in the batch item that failed Processing of batch item fails with Batch Error Continuation Option set to Undo Batch item fails and Result Status is set to Operation Failed. Batch items that had been processed have been undone and their responses are returned with Undone result status. See tables above, referring to the operation being performed in the batch item that failed Table : Batch Items Errors
Poll N/A N/A N/A N/A N/A N/A N/A N/A N/A Notify N/A N/A N/A N/A N/A N/A N/A N/A N/A Put Y Y Y Y Y Y Y Y Y Discover Versions N/A N/A N/A N/A N/A N/A N/A N/A N/A Table : Operation and Object Cross-reference
Revision History Revision Date Editor Changes Made 3b Dec 2, 2015 Tony Cox Editorial changes to Table 179 Added PGP Key Removed “Cryptographic” 3a Nov 19, 2015 Tony Cox Kiran K Thota Updated based on feedback wd03 feedback Error corrections 3 Nov 19, 2015 Tony Cox Kiran K Thota Incorporated TC wording feedback as minuted. Rolled in pending errata Corrected various section ordering issues. Addressed outstanding comments from previous draft. 2 Feb 13, 2015 Kiran K Thota Incorporate Mark’s proposal to add operations: Query Server Information (for Query). Discover Versions 1 Jan 26, 2015 Kiran K Thota, Tony Cox Import KMIP Specification 1.2 COS into 1.3 template. Add the following proposals: Extend Locate to support Offset + Limit Add generic Transparent EC key format type Add OneTimePad Cryptographic Algorithm Query Extensions Query RNGs Query Validations Query Profiles Query Capabilities Query Client Registration Method Query – Server to Client (copy of Client to Server Query with adjustments) RNG Attribute Deprecate Templates Deprecate Operational Policy Deprecate algorithm-specific Transparent EC Key Types