· Key Management Interoperability Protocol Profiles Version 2.1. Edited by Tim Hudson and Robert Lockhart. OASIS Standard. Latest stage: https://docs.oasis-open.org/kmip/kmip-profiles/v2.1/kmip-profiles-v2.1.html

This specification is related to:

· Key Management Interoperability Protocol Specification Version 3.0. Edited by Greg Scott and Charles White. Latest stage: https://docs.oasis-open.org/kmip/kmip-spec/v3.0/kmip-spec-v3.0.html

· Key Management Interoperability Protocol Test Cases Version 3.0: Work in Progress.

· Key Management Interoperability Protocol Usage Guide Version 3.0: Work in Progress.

Abstract:

This document is intended for developers and architects who wish to design systems and applications that interoperate using the Key Management Interoperability Protocol Specification.

Status:

This document was last revised or approved by the OASIS Key Management Interoperability Protocol (KMIP) TC on the above date. The level of approval is also listed above. Check the “Latest stage” location noted above for possible later revisions of this document. Any other numbered Versions and other technical work produced by the Technical Committee (TC) are listed at https://www.oasis-open.org/committees/tc_home.php?wg_abbrev=kmip#technical.

TC members should send comments on this specification to the TC’s email list. Others should send comments to the TC’s public comment list, after subscribing to it by following the instructions at the “Send A Comment” button on the TC’s web page at https://www.oasis-open.org/committees/kmip/.

This specification is provided under the RF on RAND Terms Mode of the OASIS IPR Policy, the mode chosen when the Technical Committee was established. For information on whether any patents have been disclosed that may be essential to implementing this specification, and any offers of patent licensing terms, please refer to the Intellectual Property Rights section of the TC’s web page (https://www.oasis-open.org/committees/kmip/ipr.php).

Note that any machine-readable content (Computer Language Definitions) declared Normative for this Work Product is provided in separate plain text files. In the event of a discrepancy between any such plain text file and display content in the Work Product's prose narrative document(s), the content in the separate plain text file prevails.

Citation format:

When referencing this specification the following citation format should be used:

[kmip-profiles-v3.0]

Key Management Interoperability Protocol Profiles Version 3.0. Edited by Tim Chevalier and Tim Hudson. 30 November 2023. Committee Specification Draft 01. https://docs.oasis-open.org/kmip/kmip-profiles/v3.0/csd01/kmip-profiles-v3.0-csd01.html. Latest stage: https://docs.oasis-open.org/kmip/kmip-profiles/v3.0/kmip-profiles-v3.0.html.

Table of Contents

1 Introduction. 10

1.1 IPR Policy. 10

1.2 Terminology. 10

1.3 Normative References. 10

1.4 Non-Normative References. 11

2 Profiles. 12

2.1 Profile Requirements. 12

2.2 Guidelines for other Profiles. 12

3 Authentication Suites. 13

3.1 Basic Authentication Suite. 13

3.1.1 Basic Authentication Protocols. 13

3.1.2 Basic Authentication Cipher Suites. 13

3.1.3 Basic Authentication Client Authenticity. 14

3.1.4 Basic Authentication KMIP Port Number 14

3.2 HTTPS Authentication Suite. 14

3.2.1 HTTPS Protocols. 15

3.2.2 HTTPS Cipher Suites. 15

3.2.3 HTTPS Authenticity. 15

3.2.4 HTTPS KMIP Port Number 15

4 Conformance Test Cases. 16

4.1 Permitted Test Case Variations. 16

4.1.1 Variable Items. 16

4.1.2 Variable behavior 18

5 Base Profiles. 19

5.1 Base Profiles. 19

5.1.1 Baseline Client 19

5.1.2 Baseline Server 19

5.1.3 Baseline Mandatory Test Cases KMIP v3.0. 22

5.1.3.1 BL-M-1-21. 22

5.1.3.2 BL-M-2-30. 22

5.1.3.3 BL-M-3-30. 23

5.1.3.4 BL-M-4-30. 23

5.1.3.5 BL-M-5-30. 23

5.1.3.6 BL-M-6-30. 23

5.1.3.7 BL-M-7-30. 23

5.1.3.8 BL-M-8-30. 23

5.1.3.9 BL-M-9-30. 23

5.1.3.10 BL-M-10-30. 23

5.1.3.11 BL-M-11-30. 23

5.1.3.12 BL-M-12-30. 23

5.1.3.13 BL-M-13-30. 23

5.1.3.14 BL-M-14-30. 23

5.1.3.15 BL-M-15-30. 23

5.1.3.16 BL-M-16-30. 23

5.1.3.17 BL-M-17-30. 23

5.1.3.18 BL-M-18-30. 24

5.1.3.19 BL-M-19-30. 24

5.1.3.20 See test-cases/kmip-v3.0/mandatory/BL-M-19-30.xml.BL-M-20-30. 24

5.1.3.21 BL-M-21-30. 24

5.2 Complete Server Profile. 24

5.3 HTTPS Profiles. 24

5.3.1 HTTPS Client 24

5.3.2 HTTPS Server 25

5.3.3 HTTPS Mandatory Test Cases KMIP v3.0. 25

5.3.3.1 MSGENC-HTTPS-M-1-30. 25

5.4 XML Profiles. 27

5.4.1 XML Encoding. 27

5.4.1.1 Normalizing Names. 27

5.4.1.2 Hex representations. 28

5.4.1.3 Tags. 28

5.4.1.4 Type. 28

5.4.1.5 Value. 28

5.4.1.6 XML Element Encoding. 28

5.4.1.6.1 Tags. 29

5.4.1.6.2 Structure. 29

5.4.1.6.3 Integer 29

5.4.1.6.4 Integer - Special case for Masks. 29

5.4.1.6.5 Long Integer 30

5.4.1.6.6 Big Integer 30

5.4.1.6.7 Enumeration. 30

5.4.1.6.8 Boolean. 30

5.4.1.6.9 Text String. 30

5.4.1.6.10 Byte String. 30

5.4.1.6.11 Date-Time. 30

5.4.1.6.12 Interval 30

5.4.1.6.13 Date-Time Extended. 30

5.4.1.6.14 Identifier 30

5.4.1.6.15 Reference. 31

5.4.1.6.16 Name Reference. 31

5.4.2 XML Client 31

5.4.3 XML Server 31

5.4.4 XML Mandatory Test Cases KMIP v3.0. 31

5.4.4.1 MSGENC-XML-M-1-30. 31

5.5 JSON Profiles. 31

5.5.1 JSON Encoding. 32

5.5.1.1 Normalizing Names. 32

5.5.1.2 Hex representations. 32

5.5.1.3 Tags. 32

5.5.1.4 Type. 32

5.5.1.5 Value. 33

5.5.1.6 JSON Object 33

5.5.1.6.1 Tags. 33

5.5.1.6.2 Structure. 33

5.5.1.6.3 Integer 33

5.5.1.6.4 Integer - Special case for Masks. 33

5.5.1.6.5 Long Integer 34

5.5.1.6.6 Big Integer 34

5.5.1.6.7 Enumeration. 34

5.5.1.6.8 Boolean. 34

5.5.1.6.9 Text String. 34

5.5.1.6.10 Byte String. 34

5.5.1.6.11 Date-Time. 34

5.5.1.6.12 Interval 35

5.5.1.6.13 Date Time Extended. 35

5.5.1.6.14 Identifier 35

5.5.1.6.15 Reference. 35

5.5.1.6.16 Name Reference. 35

5.5.2 JSON Client 35

5.5.3 JSON Server 35

5.5.4 JSON Mandatory Test Cases KMIP v3.0. 36

5.5.4.1 MSGENC-JSON-M-1-30. 36

5.6 Symmetric Key Lifecycle Profiles. 38

5.6.1 Symmetric Key Lifecycle Client 38

5.6.2 Symmetric Key Lifecycle Server 38

5.6.3 Symmetric Key Lifecycle Mandatory Test Cases KMIP v3.0. 39

5.6.3.1 SKLC-M-1-30. 39

5.6.3.2 SKLC-M-2-30. 39

5.6.3.3 SKLC-M-3-30. 39

5.6.4 Symmetric Key Lifecycle Optional Test Cases KMIP v3.0. 39

5.6.4.1 SKLC-O-1-30. 39

5.7 Symmetric Key Foundry for FIPS 140 Profiles. 39

5.7.1 Basic Symmetric Key Foundry Client 39

5.7.2 Intermediate Symmetric Key Foundry Client 39

5.7.3 Advanced Symmetric Key Foundry Client 39

5.7.4 Symmetric Key Foundry Server 40

5.7.5 Basic Symmetric Key Foundry Mandatory Test Cases KMIP v3.0. 40

5.7.5.1 SKFF-M-1-30. 40

5.7.5.2 SKFF-M-2-30. 40

5.7.5.3 SKFF-M-3-30. 40

5.7.5.4 SKFF-M-4-30. 40

5.7.6 Intermediate Symmetric Key Foundry Mandatory Test Cases KMIP v3.0. 41

5.7.6.1 SKFF-M-5-30. 41

5.7.6.2 SKFF-M-6-30. 41

5.7.6.3 SKFF-M-7-30. 41

5.7.6.4 SKFF-M-8-30. 41

5.7.7 Advanced Symmetric Key Foundry Mandatory Test Cases KMIP v3.0. 41

5.7.7.1 SKFF-M-9-30. 41

5.7.7.2 SKFF-M-10-30. 41

5.7.7.3 SKFF-M-11-30. 41

5.7.7.4 SKFF-M-12-30. 41

5.8 Asymmetric Key Lifecycle Profiles. 41

5.8.1 Asymmetric Key Lifecycle Client 41

5.8.2 Asymmetric Key Lifecycle Server 41

5.8.3 Asymmetric Key Lifecycle Mandatory Test Cases KMIP v3.0. 42

5.8.3.1 AKLC-M-1-30. 42

5.8.3.2 AKLC-M-2-30. 42

5.8.3.3 AKLC-M-3-30. 42

5.8.4 Asymmetric Key Lifecycle Optional Test Cases KMIP v3.0. 42

5.8.4.1 AKLC-O-1-30. 42

5.9 Cryptographic Profiles. 42

5.9.1 Basic Cryptographic Client 43

5.9.2 Advanced Cryptographic Client 43

5.9.3 RNG Cryptographic Client 43

5.9.4 Basic Cryptographic Server 43

5.9.5 Advanced Cryptographic Server 44

5.9.6 RNG Cryptographic Server 44

5.9.7 Basic Cryptographic Mandatory Test Cases KMIP v3.0. 44

5.9.7.1 CS-BC-M-1-30. 44

5.9.7.2 CS-BC-M-2-30. 44

5.9.7.3 CS-BC-M-3-30. 45

5.9.7.4 CS-BC-M-4-30. 45

5.9.7.5 CS-BC-M-5-30. 45

5.9.7.6 CS-BC-M-6-30. 45

5.9.7.7 CS-BC-M-7-30. 45

5.9.7.8 CS-BC-M-8-30. 45

5.9.7.9 CS-BC-M-9-30. 45

5.9.7.10 CS-BC-M-10-30. 45

5.9.7.11 CS-BC-M-11-30. 45

5.9.7.12 CS-BC-M-12-30. 45

5.9.7.13 CS-BC-M-13-30. 45

5.9.7.14 CS-BC-M-14-30. 45

5.9.7.15 CS-BC-M-GCM-1-30. 45

5.9.7.16 CS-BC-M-GCM-2-30. 45

5.9.7.17 CS-BC-M-GCM-3-30. 45

5.9.7.18 CS-BC-M-CHACHA20-1-30. 46

5.9.7.19 CS-BC-M-CHACHA20-2-30. 46

5.9.7.20 CS-BC-M-CHACHA20-3-30. 46

5.9.7.21 CS-BC-M-CHACHA20-4-30. 46

5.9.7.22 CS-BC-M-CHACHA20POLY1305-1-30. 46

5.9.8 Advanced Cryptographic Mandatory Test Cases KMIP v3.0. 46

5.9.8.1 CS-AC-M-1-30. 46

5.9.8.2 CS-AC-M-2-30. 46

5.9.8.3 CS-AC-M-3-30. 46

5.9.8.4 CS-AC-M-4-30. 46

5.9.8.5 CS-AC-M-5-30. 46

5.9.8.6 CS-AC-M-6-30. 46

5.9.8.7 CS-AC-M-7-30. 46

5.9.8.8 CS-AC-M-8-30. 46

5.9.8.9 CS-AC-M-OAEP-1-30. 46

5.9.8.10 CS-AC-M-OAEP-2-30. 47

5.9.8.11 CS-AC-M-OAEP-3-30. 47

5.9.8.12 CS-AC-M-OAEP-4-30. 47

5.9.8.13 CS-AC-M-OAEP-5-30. 47

5.9.8.14 CS-AC-M-OAEP-6-30. 47

5.9.8.15 CS-AC-M-OAEP-7-30. 47

5.9.8.16 CS-AC-M-OAEP-8-30. 47

5.9.8.17 CS-AC-M-OAEP-9-30. 47

5.9.8.18 CS-AC-M-OAEP-10-30. 47

5.9.9 RNG Cryptographic Mandatory Test Cases KMIP v3.0. 47

5.9.9.1 CS-RNG-M-1-30. 47

5.9.10 RNG Cryptographic Optional Test Cases KMIP v3.0. 47

5.9.10.1 CS-RNG-O-1-30. 47

5.9.10.2 CS-RNG-O-2-30. 47

5.9.10.3 CS-RNG-O-3-30. 47

5.9.10.4 CS-RNG-O-4-30. 47

5.10 Opaque Managed Object Store Profiles. 48

5.10.1 Opaque Managed Object Store Client 48

5.10.2 Opaque Managed Object Store Server 48

5.10.3 Opaque Managed Object Mandatory Test Cases KMIP v3.0. 48

5.10.3.1 OMOS-M-1-30. 48

5.10.4 Opaque Managed Object Optional Test Cases KMIP v3.0. 48

5.10.4.1 OMOS-O-1-30. 48

5.11 Storage Array with Self-Encrypting Drives Profiles. 48

5.11.1 Storage Array with Self-Encrypting Drives Client 49

5.11.2 Storage Array with Self-Encrypting Drives Server 49

5.11.3 Storage Array with Self-Encrypting Drives Mandatory Test Cases KMIP v3.0. 49

5.11.3.1 SASED-M-1-30. 49

5.11.3.2 SASED-M-2-30. 50

5.11.3.3 SASED-M-3-30. 50

5.12 Tape Library Profiles. 50

5.12.1 Tape Library Profiles Terminology. 50

5.12.2 Tape Library Application Specific Information. 50

5.12.3 Tape Library Alternative Name. 52

5.12.4 Tape Library Client 52

5.12.5 Tape Library Server 52

5.12.6 Tape Library Mandatory Test Cases KMIP v3.0. 53

5.12.6.1 TL-M-1-30. 53

5.12.6.2 TL-M-2-30. 54

5.12.6.3 TL-M-3-30. 54

5.13 AES XTS Profiles. 54

5.13.1 AES XTS Client 54

5.13.2 AES XTS Server 55

5.13.3 AES XTS Mandatory Test Cases KMIP v3.0. 55

5.13.3.1 AX-M-1-30. 55

5.13.3.2 AX-M-2-30. 55

5.14 Quantum Safe Profiles. 55

5.15 Quantum Safe Client 55

5.16 Quantum Safe Server 56

5.17 Mandatory Quantum Safe Test Cases KMIP v3.0. 57

5.17.1 QS-M-1-12 - Query. 57

5.17.2 QS-M-2-21 - Create. 57

5.18 PKCS#11 Profiles. 57

5.18.1 PKCS#11 Encoding. 58

5.18.2 PKCS#11 XML Encoding. 59

5.18.3 PKCS#11 Examples. 59

5.18.3.1 PKCS#11 Initialization. 59

5.18.3.2 PKCS#11 C_Encrypt 62

5.18.3.3 PKCS#11 C_GetAttributeValue. 64

5.18.4 PKCS#11 Client 65

5.18.5 PKCS#11 Server 65

5.18.6 PKCS#11 Mandatory Test Cases KMIP v3.0. 66

5.18.6.1 PKCS11-M-1-30. 66

6 Conformance. 67

6.1 Baseline Client Basic KMIP v3.0 Profile Conformance. 67

6.2 Baseline Server Basic KMIP v3.0 Profile Conformance. 67

6.3 Complete Server Basic KMIP v3.0 Profile Conformance. 67

6.4 HTTPS Client KMIP v3.0 Profile Conformance. 67

6.5 HTTPS Server KMIP v3.0 Profile Conformance. 67

6.6 XML Client KMIP v3.0 Profile Conformance. 68

6.7 XML Server KMIP v3.0 Profile Conformance. 68

6.8 JSON Client KMIP v3.0 Profile Conformance. 68

6.9 JSON Server KMIP v3.0 Profile Conformance. 68

6.10 Symmetric Key Lifecycle Client KMIP v3.0 Profile Conformance. 68

6.11 Symmetric Key Lifecycle Server KMIP v3.0 Profile Conformance. 69

6.12 Basic Symmetric Key Foundry Client KMIP v3.0 Profile Conformance. 69

6.13 Intermediate Symmetric Key Foundry Client KMIP v3.0 Profile Conformance. 69

6.14 Advanced Symmetric Key Foundry Client KMIP v3.0 Profile Conformance. 69

6.15 Symmetric Key Foundry Server KMIP v3.0 Profile Conformance. 69

6.16 Asymmetric Key Lifecycle Client KMIP v3.0 Profile Conformance. 70

6.17 Asymmetric Key Lifecycle Server KMIP v3.0 Profile Conformance. 70

6.18 Basic Cryptographic Client KMIP v3.0 Profile Conformance. 70

6.19 Advanced Cryptographic Client KMIP v3.0 Profile Conformance. 70

6.20 RNG Cryptographic Client KMIP v3.0 Profile Conformance. 71

6.21 Basic Cryptographic Server KMIP v3.0 Profile Conformance. 71

6.22 Advanced Cryptographic Server KMIP v3.0 Profile Conformance. 71

6.23 RNG Cryptographic Server KMIP v3.0 Profile Conformance. 71

6.24 Opaque Managed Object Client KMIP v3.0 Profile Conformance. 71

6.25 Opaque Managed Object Server KMIP v3.0 Profile Conformance. 71

6.26 Storage Array with Self-Encrypting Drives Client KMIP v3.0 Profile Conformance. 72

6.27 Storage Array with Self-Encrypting Drives Server KMIP v3.0 Profile Conformance. 72

6.28 Tape Library Client KMIP v3.0 Profile Conformance. 72

6.29 Tape Library Server KMIP v3.0 Profile Conformance. 72

6.30 AES XTS Client KMIP v3.0 Profile Conformance. 73

6.31 AES XTS Server KMIP v3.0 Profile Conformance. 73

6.32 Quantum Safe Client KMIP v3.0 Profile Conformance. 73

6.33 Quantum Safe Server KMIP v3.0 Profile Conformance. 73

6.34 PKCS#11 Client KMIP v3.0 Profile Conformance. 73

6.35 PKCS#11 Server KMIP v3.0 Profile Conformance. 74

Appendix A. Acknowledgments. 75

Appendix B. Revision History. 76

Appendix C. Notices. 77

1 Introduction

This document specifies conformance clauses in accordance with the OASIS TC Process ([TC-PROC] section 2.2.6 for the KMIP Specification [KMIP-SPEC] for a KMIP server or KMIP client through profiles that define the use of KMIP objects, attributes, operations, message elements and authentication methods within specific contexts of KMIP server and client interaction.

These profiles define a set of normative constraints for employing KMIP within a particular environment or context of use. They may, optionally, require the use of specific KMIP functionality or in other respects define the processing rules to be followed by profile actors.

1.1 IPR Policy

1.2 Terminology

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119] and [RFC8174] when, and only when, they appear in all capitals, as shown here.

1.3 Normative References

[KMIP-SPEC] Key Management Interoperability Protocol Specification Version 3.0. Edited by Greg Scott and Charles White. Latest version: <-v3.0https://docs.oasis-open.org/kmip/kmip-spec/v3.0/kmip-spec-v3.0.html>.

[PKCS11-PROF] PKCS #11 Cryptographic Token Interface Profiles Version 3.1. Edited by Tim Hudson. Latest version: <https://docs.oasis-open.org/pkcs11/pkcs11-profiles/v3.1/pkcs11-profiles-v3.1-os.html>.

[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, <http://www.rfc-editor.org/info/rfc2119>.

[RFC2818] E. Rescorla, HTTP over TLS, IETF RFC 2818, May 2000,<http://www.rfc-editor.org/info/rfc2818>.

[RFC5246] T. Dierks & E. Rescorla, The Transport Layer Security (TLS) Protocol, Version 1.2, IETF RFC 5246, August 2008, <http://www.rfc-editor.org/info/rfc5246>.

[RFC7159] Bray, T., Ed., The JavaScript Object Notation (JSON) Data Interchange Format, RFC 7159, March 2014, <http://www.rfc-editor.org/info/rfc7159>.

[RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, May 2017, <http://www.rfc-editor.org/info/rfc8174>.

[RFC8446] E. Rescorla, The Transport Layer Security (TLS) Protocol Version 1.3, IETF RFC 8446, August 2018, <http://www.rfc-editor.org/info/rfc8446>.

[XML] Bray, Tim, et.al. eds, Extensible Markup Language (XML) 1.0 (Fifth Edition), W3C Recommendation 26 November 2008, <http://www.w3.org/TR/2008/REC-xml-20081126>.

1.4 Non-Normative References

[RFC2246] T. Dierks & C. Allen, The TLS Protocol, Version 1.0, IETF RFC 2246, January 1999, <http://www.rfc-editor.org/info/rfc2246>.

[RFC4346] T. Dierks & E. Rescorla, The Transport Layer Security (TLS) Protocol, Version 1.1, IETF RFC 4346, April 2006, <http:www.rfc-editor.org/info/rfc4346>.

[TC-PROC] OASIS TC Process. 1 July 2017. OASIS Process, <https://www.oasis-open.org/policies-guidelines/tc-process>.

[XML-SCHEMA] Paul V. Biron, Ashok Malhotra, XML Schema Part 2: Datatypes Second Edition, W3C Recommendation 26 November 2008, <https://www.w3.org/TR/2004/REC-xmlschema-2-20041028>.

2 Profiles

This document defines a list of KMIP Profiles. A profile may be standalone or may be specified in terms of changes relative to another profile.

2.1 Profile Requirements

The following items SHALL be addressed by each profile.

1. Specify the versions of the KMIP specification (protocol versions) that SHALL be supported if versions other than [KMIP-SPEC] are supported

2. Specify the list of Objects that SHALL be supported

3. Specify the list of Authentication Suites that SHALL be supported

4. Specify the list of Object Attributes that SHALL be supported

5. Specify the list of Operations that SHALL be supported

6. Specify any other requirements that SHALL be supported

7. Specify the mandatory test cases that SHALL be supported by conforming implementations

Specify the optional test cases that MAY be supported by conforming implementations

2.2 Guidelines for other Profiles

Any vendor or organization, such as other standards bodies, MAY create a KMIP Profile and publish it.

1. The profile SHALL be publicly available.

2. The KMIP Technical Committee SHALL be formally advised of the availability of the profile and the location of the published profile.

3. The profile SHALL meet all the requirements of section 2.1

4. The KMIP Technical Committee SHOULD review the profile prior to final publication.

3 Authentication Suites

This section contains the list of the channel security, channel options, and server and client authentication requirements for a KMIP profile. Other Authentication Suites MAY be defined for other KMIP Profiles.

An Authentication Suite provides at least the following:

1. All communication over the security channel SHALL provide confidentiality and integrity

2. All communication over the security channel SHALL provide assurance of server authenticity

3. All communication over the security channel SHALL provide assurance of client authenticity

4. All options such as channel protocol version and cipher suites for the secuity channel SHALL be specified

When using automated client provisioning, the assurance of server authenticity and client authenticity MAY be provided via means outside of the security channel protocol.

3.1 Basic Authentication Suite

This authentication suite stipulates that a profile conforming to the Basic Authentication Suite SHALL use TLS to negotiate a secure channel.

3.1.1 Basic Authentication Protocols

Conformant KMIP servers SHALL support:

· TLS v1.3 [RFC8446]

Conformant KMIP clients SHOULD support:

· TLS v1.3 [RFC8446]

Conformant KMIP servers SHOULD support:

· TLS v1.2 [RFC5246]

Conformant KMIP clients MAY support:

· TLS v1.2 [RFC5246]

Conformant KMIP clients or servers SHALL NOT support:

· TLS v1.1 [RFC4346]

· TLS v1.0 [RFC2246]

· Any version of the SSL protocol

3.1.2 Basic Authentication Cipher Suites

Conformant KMIP servers SHALL support all of the following cipher suites for TLSv1.3 if TLSv1.3 is supported:

TLS13-CHACHA20-POLY1305-SHA256
TLS13-AES-256-GCM-SHA384

Conformant KMIP clients SHALL support at least one of the following cipher suites for TLSv1.3 if TLSv1.3 is supported:

TLS13-CHACHA20-POLY1305-SHA256
TLS13-AES-256-GCM-SHA384

Conformant KMIP clients or servers SHALL support the following cipher suites for TLSv1.2 if TLSv1.2 is supported:

· TLS_RSA_WITH_AES_256_CBC_SHA256

· TLS_RSA_WITH_AES_128_CBC_SHA256

Conformant KMIP clients or servers MAY support the following cipher suites for TLSv1.2 if TLSv1.2 is supported:

· TLS_RSA_WITH_AES_128_CBC_SHA

· TLS_RSA_WITH_AES_256_CBC_SHA

· TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA

· TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256

· TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384

· TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA

· TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256

· TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384

· TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256

· TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384

· TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA

· TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256

· TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384

· TLS_PSK_WITH_AES_128_CBC_SHA