Key Management Interoperability Protocol Profiles Version 3.0
Committee Specification Draft 01
30 November 2023
This stage:
https://docs.oasis-open.org/kmip/kmip-profiles/v3.0/csd01/kmip-profiles-v3.0-csd01.docx (Authoritative)
https://docs.oasis-open.org/kmip/kmip-profiles/v3.0/csd01/kmip-profiles-v3.0-csd01.html
https://docs.oasis-open.org/kmip/kmip-profiles/v3.0/csd01/kmip-profiles-v3.0-csd01.pdf
Previous stage:
N/A
Latest stage:
https://docs.oasis-open.org/kmip/kmip-profiles/v3.0/kmip-profiles-v3.0.docx (Authoritative)
https://docs.oasis-open.org/kmip/kmip-profiles/v3.0/kmip-profiles-v3.0.html
https://docs.oasis-open.org/kmip/kmip-profiles/v3.0/kmip-profiles-v3.0.pdf
Technical Committee:
OASIS Key Management Interoperability Protocol (KMIP) TC
Chairs:
Greg Scott (greg.scott@cryptsoft.com),
Cryptsoft Pty Ltd.
Judith Furlong (Judith.Furlong@dell.com), Dell
Editors:
Tim Chevalier (Tim.Chevalier@netapp.com), NetApp
Tim Hudson (tjh@cryptsoft.com), Cryptsoft Pty Ltd.
This prose specification is one component of a Work Product that also includes:
Related work:
This specification replaces or supersedes:
This specification is related to:
Abstract:
This document is intended for developers and architects who wish to design systems and applications that interoperate using the Key Management Interoperability Protocol Specification.
Status:
This document was last revised or approved by the OASIS Key Management Interoperability Protocol (KMIP) TC on the above date. The level of approval is also listed above. Check the “Latest stage” location noted above for possible later revisions of this document. Any other numbered Versions and other technical work produced by the Technical Committee (TC) are listed at https://www.oasis-open.org/committees/tc_home.php?wg_abbrev=kmip#technical.
TC members should send comments on
this specification to the TC’s email list. Others should send comments to the TC’s
public comment list, after subscribing to it by following the instructions at
the “Send
A Comment” button on the TC’s web page at https://www.oasis-open.org/committees/kmip/.
This specification is provided under the RF on RAND Terms Mode of the OASIS IPR Policy, the mode chosen when the Technical Committee was established. For information on whether any patents have been disclosed that may be essential to implementing this specification, and any offers of patent licensing terms, please refer to the Intellectual Property Rights section of the TC’s web page (https://www.oasis-open.org/committees/kmip/ipr.php).
Note that any machine-readable content (Computer Language Definitions) declared Normative for this Work Product is provided in separate plain text files. In the event of a discrepancy between any such plain text file and display content in the Work Product's prose narrative document(s), the content in the separate plain text file prevails.
Citation format:
When referencing this specification the following citation format should be used:
[kmip-profiles-v3.0]
Key Management Interoperability Protocol Profiles Version 3.0. Edited by Tim Chevalier and Tim Hudson. 30 November 2023. Committee Specification Draft 01. https://docs.oasis-open.org/kmip/kmip-profiles/v3.0/csd01/kmip-profiles-v3.0-csd01.html. Latest stage: https://docs.oasis-open.org/kmip/kmip-profiles/v3.0/kmip-profiles-v3.0.html.
Table of Contents
2.2
Guidelines for other Profiles
3.1
Basic Authentication Suite
3.1.1
Basic Authentication Protocols.
3.1.2
Basic Authentication Cipher Suites
3.1.3
Basic Authentication Client Authenticity
3.1.4
Basic Authentication KMIP Port Number
3.2
HTTPS Authentication Suite
4.1
Permitted Test Case Variations.
5.1.3
Baseline Mandatory Test Cases KMIP v3.0
5.1.3.20
See test-cases/kmip-v3.0/mandatory/BL-M-19-30.xml.BL-M-20-30
5.3.3
HTTPS Mandatory Test Cases KMIP v3.0
5.4.1.6.4 Integer - Special case for Masks
5.4.4
XML Mandatory Test Cases KMIP v3.0
5.5.1.6.4 Integer - Special case for Masks
5.5.4
JSON Mandatory Test Cases KMIP v3.0
5.6
Symmetric Key Lifecycle Profiles
5.6.1
Symmetric Key Lifecycle Client
5.6.2
Symmetric Key Lifecycle Server
5.6.3
Symmetric Key Lifecycle Mandatory Test Cases KMIP v3.0
5.6.4
Symmetric Key Lifecycle Optional Test Cases KMIP v3.0
5.7
Symmetric Key Foundry for FIPS 140 Profiles
5.7.1
Basic Symmetric Key Foundry Client
5.7.2
Intermediate Symmetric Key Foundry Client
5.7.3
Advanced Symmetric Key Foundry Client
5.7.4
Symmetric Key Foundry Server
5.7.5
Basic Symmetric Key Foundry Mandatory Test Cases KMIP v3.0
5.7.6
Intermediate Symmetric Key Foundry Mandatory Test Cases KMIP v3.0
5.7.7
Advanced Symmetric Key Foundry Mandatory Test Cases KMIP v3.0
5.8
Asymmetric Key Lifecycle Profiles
5.8.1
Asymmetric Key Lifecycle Client
5.8.2
Asymmetric Key Lifecycle Server
5.8.3
Asymmetric Key Lifecycle Mandatory Test Cases KMIP v3.0
5.8.4
Asymmetric Key Lifecycle Optional Test Cases KMIP v3.0
5.9.1
Basic Cryptographic Client
5.9.2
Advanced Cryptographic Client
5.9.3
RNG Cryptographic Client
5.9.4
Basic Cryptographic Server
5.9.5
Advanced Cryptographic Server
5.9.6
RNG Cryptographic Server
5.9.7
Basic Cryptographic Mandatory Test Cases KMIP v3.0
5.9.7.18
CS-BC-M-CHACHA20-1-30
5.9.7.19
CS-BC-M-CHACHA20-2-30
5.9.7.20
CS-BC-M-CHACHA20-3-30
5.9.7.21
CS-BC-M-CHACHA20-4-30
5.9.7.22
CS-BC-M-CHACHA20POLY1305-1-30
5.9.8
Advanced Cryptographic Mandatory Test Cases KMIP v3.0
5.9.9
RNG Cryptographic Mandatory Test Cases KMIP v3.0
5.9.10
RNG Cryptographic Optional Test Cases KMIP v3.0
5.10
Opaque Managed Object Store Profiles
5.10.1
Opaque Managed Object Store Client
5.10.2
Opaque Managed Object Store Server
5.10.3
Opaque Managed Object Mandatory Test Cases KMIP v3.0
5.10.4
Opaque Managed Object Optional Test Cases KMIP v3.0
5.11
Storage Array with Self-Encrypting Drives Profiles
5.11.1
Storage Array with Self-Encrypting Drives Client
5.11.2
Storage Array with Self-Encrypting Drives Server
5.11.3
Storage Array with Self-Encrypting Drives Mandatory Test Cases KMIP v3.0
5.12.1
Tape Library Profiles Terminology
5.12.2
Tape Library Application Specific Information
5.12.3
Tape Library Alternative Name
5.12.6
Tape Library Mandatory Test Cases KMIP v3.0
5.13.3
AES XTS Mandatory Test Cases KMIP v3.0
5.17
Mandatory Quantum Safe Test Cases KMIP v3.0
5.18.3.1
PKCS#11 Initialization
5.18.3.3
PKCS#11 C_GetAttributeValue
5.18.6
PKCS#11 Mandatory Test Cases KMIP v3.0
6.1
Baseline Client Basic KMIP v3.0 Profile Conformance
6.2
Baseline Server Basic KMIP v3.0 Profile Conformance
6.3
Complete Server Basic KMIP v3.0 Profile Conformance
6.4
HTTPS Client KMIP v3.0 Profile Conformance
6.5
HTTPS Server KMIP v3.0 Profile Conformance
6.6
XML Client KMIP v3.0 Profile Conformance
6.7
XML Server KMIP v3.0 Profile Conformance
6.8
JSON Client KMIP v3.0 Profile Conformance
6.9
JSON Server KMIP v3.0 Profile Conformance
6.10
Symmetric Key Lifecycle Client KMIP v3.0 Profile Conformance
6.11
Symmetric Key Lifecycle Server KMIP v3.0 Profile Conformance
6.12
Basic Symmetric Key Foundry Client KMIP v3.0 Profile Conformance
6.13
Intermediate Symmetric Key Foundry Client KMIP v3.0 Profile Conformance
6.14
Advanced Symmetric Key Foundry Client KMIP v3.0 Profile Conformance
6.15
Symmetric Key Foundry Server KMIP v3.0 Profile Conformance
6.16
Asymmetric Key Lifecycle Client KMIP v3.0 Profile Conformance
6.17
Asymmetric Key Lifecycle Server KMIP v3.0 Profile Conformance
6.18
Basic Cryptographic Client KMIP v3.0 Profile Conformance
6.19
Advanced Cryptographic Client KMIP v3.0 Profile Conformance
6.20
RNG Cryptographic Client KMIP v3.0 Profile Conformance
6.21
Basic Cryptographic Server KMIP v3.0 Profile Conformance
6.22
Advanced Cryptographic Server KMIP v3.0 Profile Conformance
6.23
RNG Cryptographic Server KMIP v3.0 Profile Conformance
6.24
Opaque Managed Object Client KMIP v3.0 Profile Conformance
6.25
Opaque Managed Object Server KMIP v3.0 Profile Conformance
6.26
Storage Array with Self-Encrypting Drives Client KMIP v3.0 Profile Conformance
6.27
Storage Array with Self-Encrypting Drives Server KMIP v3.0 Profile Conformance
6.28
Tape Library Client KMIP v3.0 Profile Conformance
6.29
Tape Library Server KMIP v3.0 Profile Conformance
6.30
AES XTS Client KMIP v3.0 Profile Conformance
6.31
AES XTS Server KMIP v3.0 Profile Conformance
6.32
Quantum Safe Client KMIP v3.0 Profile Conformance
6.33
Quantum Safe Server KMIP v3.0 Profile Conformance
6.34
PKCS#11 Client KMIP v3.0 Profile Conformance
6.35
PKCS#11 Server KMIP v3.0 Profile Conformance
This document specifies conformance clauses in accordance with the OASIS TC Process ([TC-PROC] section 2.2.6 for the KMIP Specification [KMIP-SPEC] for a KMIP server or KMIP client through profiles that define the use of KMIP objects, attributes, operations, message elements and authentication methods within specific contexts of KMIP server and client interaction.
These profiles define a set of normative constraints for employing KMIP within a particular environment or context of use. They may, optionally, require the use of specific KMIP functionality or in other respects define the processing rules to be followed by profile actors.
This specification is provided under the RF on RAND Terms Mode of the OASIS IPR Policy, the mode chosen when the Technical Committee was established. For information on whether any patents have been disclosed that may be essential to implementing this specification, and any offers of patent licensing terms, please refer to the Intellectual Property Rights section of the TC’s web page (https://www.oasis-open.org/committees/kmip/ipr.php).
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119] and [RFC8174] when, and only when, they appear in all capitals, as shown here.
[KMIP-SPEC] Key
Management Interoperability Protocol Specification Version 3.0. Edited by Greg
Scott and Charles White. Latest version: <-v3.0https://docs.oasis-open.org/kmip/kmip-spec/v3.0/kmip-spec-v3.0.html>.
[PKCS11-PROF] PKCS #11 Cryptographic Token
Interface Profiles Version 3.1. Edited by Tim Hudson. Latest version: <https://docs.oasis-open.org/pkcs11/pkcs11-profiles/v3.1/pkcs11-profiles-v3.1-os.html>.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, <http://www.rfc-editor.org/info/rfc2119>.
[RFC2818] E. Rescorla, HTTP over TLS, IETF RFC 2818, May 2000,<http://www.rfc-editor.org/info/rfc2818>.
[RFC5246] T. Dierks & E. Rescorla, The Transport Layer Security (TLS) Protocol, Version 1.2, IETF RFC 5246, August 2008, <http://www.rfc-editor.org/info/rfc5246>.
[RFC7159] Bray, T., Ed., The JavaScript Object Notation (JSON) Data Interchange Format, RFC 7159, March 2014, <http://www.rfc-editor.org/info/rfc7159>.
[RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, May 2017, <http://www.rfc-editor.org/info/rfc8174>.
[RFC8446] E. Rescorla, The Transport Layer Security (TLS) Protocol Version 1.3, IETF RFC 8446, August 2018, <http://www.rfc-editor.org/info/rfc8446>.
[XML] Bray, Tim, et.al. eds, Extensible Markup Language (XML) 1.0 (Fifth Edition), W3C Recommendation 26 November 2008, <http://www.w3.org/TR/2008/REC-xml-20081126>.
[RFC2246] T. Dierks & C. Allen, The TLS Protocol, Version 1.0, IETF RFC 2246, January 1999, <http://www.rfc-editor.org/info/rfc2246>.
[RFC4346] T. Dierks & E. Rescorla, The Transport Layer Security (TLS) Protocol, Version 1.1, IETF RFC 4346, April 2006, <http:www.rfc-editor.org/info/rfc4346>.
[TC-PROC] OASIS TC Process. 1 July 2017. OASIS Process,
<https://www.oasis-open.org/policies-guidelines/tc-process>.
[XML-SCHEMA] Paul V. Biron, Ashok Malhotra, XML Schema Part 2: Datatypes Second Edition, W3C Recommendation 26 November 2008, <https://www.w3.org/TR/2004/REC-xmlschema-2-20041028>.
This document defines a list of KMIP Profiles. A profile may be standalone or may be specified in terms of changes relative to another profile.
The following items SHALL be addressed by each profile.
1. Specify the versions of the KMIP specification (protocol versions) that SHALL be supported if versions other than [KMIP-SPEC] are supported
2. Specify the list of Objects that SHALL be supported
3. Specify the list of Authentication Suites that SHALL be supported
4. Specify the list of Object Attributes that SHALL be supported
5. Specify the list of Operations that SHALL be supported
6. Specify any other requirements that SHALL be supported
7. Specify the mandatory test cases that SHALL be supported by conforming implementations
Specify the optional test cases that MAY be supported by conforming implementations
Any vendor or organization, such as other standards bodies, MAY create a KMIP Profile and publish it.
1.
The profile SHALL be publicly available.
2.
The KMIP Technical Committee SHALL be
formally advised of the availability of the profile and the location of the
published profile.
3.
The profile SHALL meet all the
requirements of section 2.1
4.
The KMIP Technical Committee SHOULD review
the profile prior to final publication.
This section contains the list of the channel security, channel options, and server and client authentication requirements for a KMIP profile. Other Authentication Suites MAY be defined for other KMIP Profiles.
An Authentication Suite provides at least the following:
1.
All communication over the security
channel SHALL provide confidentiality and integrity
2.
All communication over the security
channel SHALL provide assurance of server authenticity
3.
All communication over the security
channel SHALL provide assurance of client authenticity
4.
All options such as channel protocol
version and cipher suites for the secuity channel SHALL be specified
When using
automated client provisioning, the assurance of server authenticity and client
authenticity MAY be provided via means outside of the security channel
protocol.
This authentication suite stipulates that a profile conforming to the Basic Authentication Suite SHALL use TLS to negotiate a secure channel.
Conformant KMIP servers SHALL support:
·
TLS v1.3 [RFC8446]
Conformant KMIP clients SHOULD support:
·
TLS v1.3
[RFC8446]
Conformant KMIP servers SHOULD support:
·
TLS v1.2
[RFC5246]
Conformant KMIP clients MAY support:
·
TLS v1.2
[RFC5246]
Conformant KMIP clients or servers SHALL NOT support:
·
TLS v1.1
[RFC4346]
·
TLS v1.0
[RFC2246]
·
Any
version of the SSL protocol
Conformant KMIP servers SHALL support all of the following cipher suites for TLSv1.3 if TLSv1.3 is supported:
Conformant KMIP clients SHALL support at least one of the following cipher suites for TLSv1.3 if TLSv1.3 is supported:
Conformant KMIP clients or servers SHALL support the following cipher suites for TLSv1.2 if TLSv1.2 is supported:
·
TLS_RSA_WITH_AES_256_CBC_SHA256
·
TLS_RSA_WITH_AES_128_CBC_SHA256
Conformant KMIP clients or servers MAY support the following cipher suites for TLSv1.2 if TLSv1.2 is supported:
·
TLS_RSA_WITH_AES_128_CBC_SHA
·
TLS_RSA_WITH_AES_256_CBC_SHA
·
TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
·
TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256
·
TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384
·
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
·
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
·
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
·
TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256
·
TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384
·
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
·
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
·
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
·
TLS_PSK_WITH_AES_128_CBC_SHA