Key Management Interoperability Protocol Specification Version 3.0

Committee Specification Draft 01

23 August 2024

This stage:

https://docs.oasis-open.org/kmip/kmip-spec/v3.0/csd01/kmip-spec-v3.0-csd01.docx (Authoritative)

https://docs.oasis-open.org/kmip/kmip-spec/v3.0/csd01/kmip-spec-v3.0-csd01.html

https://docs.oasis-open.org/kmip/kmip-spec/v3.0/csd01/kmip-spec-v3.0-csd01.pdf

Previous stage:

N/A

 

This stage:

https://docs.oasis-open.org/kmip/kmip-spec/v3.0/kmip-spec-v3.0.docx  (Authoritative)

https://docs.oasis-open.org/kmip/kmip-spec/v3.0/kmip-spec-v3.0.html

https://docs.oasis-open.org/kmip/kmip-spec/v3.0/kmip-spec-v3.0.pdf

Technical Committee:

OASIS Key Management Interoperability Protocol (KMIP) TC

Chairs:

Greg Scott (greg.scott@cryptsoft.com), Cryptsoft Pty Ltd.

Judith Furlong (Judith.Furlong@dell.com), Dell

Editors:

Greg Scott (greg.scott@cryptsoft.com), Cryptsoft Pty Ltd.

Tony Cox (tony.cox@tclogic.com.au), TC Logic

Related work:

This specification replaces or supersedes:

·       Key Management Interoperability Protocol Specification Version 2.1. Edited by Tony Cox and Charles White. OASIS Standard. Latest stage: https://docs.oasis-open.org/kmip/kmip-spec/v2.1/kmip-spec-v2.1.html

This specification is related to:

·       Key Management Interoperability Protocol Profiles Version 3.0. Edited by Tim Chevalier and Tim Hudson. Latest stage: https://docs.oasis-open.org/kmip/kmip-profiles/v3.0/kmip-profiles-v3.0.html

·       Key Management Interoperability Protocol Test Cases Version 3.0. Work in Progress.

·       Key Management Interoperability Protocol Usage Guide Version 3.0. Work in Progress.

Abstract:

This document is intended for developers and architects who wish to design systems and applications that interoperate using the Key Management Interoperability Protocol Specification.

Status:

This document was last revised or approved by the OASIS Key Management Interoperability Protocol (KMIP) TC on the above date. The level of approval is also listed above. Check the “Latest stage” location noted above for possible later revisions of this document. Any other numbered Versions and other technical work produced by the Technical Committee (TC) are listed at https://www.oasis-open.org/committees/tc_home.php?wg_abbrev=kmip#technical.

Comments from TC members should be sent directly to the TC's mailing list. Comments may be submitted to the project by any other person through the use of the project’s Comment Facility: https://groups.oasis-open.org/communities/community-home?CommunityKey=2b5e5c66-cc41-4aa5-92ee-018f5aa7dfc4

This specification is provided under the RF on RAND Terms Mode of the OASIS IPR Policy, the mode chosen when the Technical Committee was established. For information on whether any patents have been disclosed that may be essential to implementing this specification, and any offers of patent licensing terms, please refer to the Intellectual Property Rights section of the TC’s web page (https://www.oasis-open.org/committees/kmip/ipr.php).

Key words:

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] and [RFC8174] when, and only when, they appear in all capitals, as shown here.

 

Note that any machine-readable content (Computer Language Definitions) declared Normative for this Work Product is provided in separate plain text files. In the event of a discrepancy between any such plain text file and display content in the Work Product's prose narrative document(s), the content in the separate plain text file prevails.

Citation format:

When referencing this specification, the following citation format should be used:

[kmip-spec-v3.0]

Key Management Interoperability Protocol Specification Version 3.0. Edited by Greg Scott and Tony Cox. 23 August 2024. Committee Specification Draft 01. https://docs.oasis-open.org/kmip/kmip-spec/v3.0/csd01/kmip-spec-v3.0-csd01.html. Latest Stage: https://docs.oasis-open.org/kmip/kmip-spec/v3.0/kmip-spec-v3.0.html.

 

Notices:

Copyright © OASIS Open 2024. All Rights Reserved.

Distributed under the terms of the OASIS IPR Policy, [https://www.oasis-open.org/policies-guidelines/ipr/]. For complete copyright information please see the full Notices section in an Appendix below.

 

Notices

Copyright © OASIS Open 2024. All Rights Reserved.

All capitalized terms in the following text have the meanings assigned to them in the OASIS Intellectual Property Rights Policy (the "OASIS IPR Policy"). The full Policy may be found at the OASIS website.

This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published, and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice and this section are included on all such copies and derivative works. However, this document itself may not be modified in any way, including by removing the copyright notice or references to OASIS, except as needed for the purpose of developing any document or deliverable produced by an OASIS Technical Committee (in which case the rules applicable to copyrights, as set forth in the OASIS IPR Policy, must be followed) or as required to translate it into languages other than English.

The limited permissions granted above are perpetual and will not be revoked by OASIS or its successors or assigns.

This document and the information contained herein is provided on an "AS IS" basis and OASIS DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY OWNERSHIP RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

OASIS requests that any OASIS Party or any other party that believes it has patent claims that would necessarily be infringed by implementations of this OASIS Committee Specification or OASIS Standard, to notify OASIS TC Administrator and provide an indication of its willingness to grant patent licenses to such patent claims in a manner consistent with the IPR Mode of the OASIS Technical Committee that produced this specification.

OASIS invites any party to contact the OASIS TC Administrator if it is aware of a claim of ownership of any patent claims that would necessarily be infringed by implementations of this specification by a patent holder that is not willing to provide a license to such patent claims in a manner consistent with the IPR Mode of the OASIS Technical Committee that produced this specification. OASIS may include such claims on its website, but disclaims any obligation to do so.

OASIS takes no position regarding the validity or scope of any intellectual property or other rights that might be claimed to pertain to the implementation or use of the technology described in this document or the extent to which any license under such rights might or might not be available; neither does it represent that it has made any effort to identify any such rights. Information on OASIS' procedures with respect to rights in any document or deliverable produced by an OASIS Technical Committee can be found on the OASIS website. Copies of claims of rights made available for publication and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementers or users of this OASIS Committee Specification or OASIS Standard, can be obtained from the OASIS TC Administrator. OASIS makes no representation that any information or list of intellectual property rights will at any time be complete, or that any claims in such list are, in fact, Essential Claims.

The name "OASIS" is a trademark of OASIS, the owner and developer of this specification, and should be used only to refer to the organization and its official outputs. OASIS welcomes reference to, and implementation and use of, specifications, while reserving the right to enforce its marks against misleading uses. Please see https://www.oasis-open.org/policies-guidelines/trademark for above guidance.

Table of Contents

1      Introduction. 13

1.1 IPR Policy. 13

1.2 Terminology. 13

1.3 Normative References. 16

1.4 Non-Normative References. 19

1.5 Item Data Types. 20

2      Objects. 21

2.1 System Objects. 21

2.1.1 User 21

2.1.2 Group. 21

2.1.3 Credentials. 22

2.2 User Objects. 24

2.2.1 Certificate. 24

2.2.2 Certificate Request 25

2.2.3 Opaque Object 25

2.2.4 PGP Key. 26

2.2.5 Private Key. 27

2.2.6 Public Key. 27

2.2.7 Secret Data. 27

2.2.8 Split Key. 28

2.2.9 Symmetric Key. 29

3      Object Data Structures. 30

3.1 Key Block. 30

3.2 Key Value. 31

3.3 Key Wrapping Data. 31

3.4 Transparent Symmetric Key. 33

3.5 Transparent DSA Private Key. 33

3.6 Transparent DSA Public Key. 33

3.7 Transparent RSA Private Key. 33

3.8 Transparent RSA Public Key. 34

3.9 Transparent DH Private Key. 34

3.10 Transparent DH Public Key. 34

3.11 Transparent EC Private Key. 35

3.12 Transparent EC Public Key. 35

4      Object Attributes. 36

4.1 Activation Date. 37

4.2 Alternative Name. 38

4.3 Always Sensitive. 38

4.4 Application Specific Information. 39

4.5 Archive Date. 40

4.6 Certificate Attributes. 40

4.7 Certificate Type. 41

4.8 Certificate Length. 42

4.9 Comment 42

4.10 Compromise Date. 43

4.11 Compromise Occurrence Date. 43

4.12 Contact Information. 44

4.13 Counters. 44

4.13.1 Certify Counter 44

4.13.2 Decrypt Counter 45

4.13.3 Encrypt Counter 45

4.13.4 Sign Counter 46

4.13.5 Signature Verify Counter 46

4.14 Credential Type. 47

4.15 Cryptographic Algorithm.. 47

4.16 Cryptographic Domain Parameters. 48

4.17 Cryptographic Length. 49

4.18 Cryptographic Parameters. 49

4.19 Cryptographic Usage Mask. 51

4.20 Deactivation Date. 51

4.21 Deactivation Reason. 52

4.22 Description. 53

4.23 Destroy Date. 53

4.24 Digest 53

4.25 Digital Signature Algorithm.. 54

4.26 Extractable. 55

4.27 Fresh. 55

4.28 Initial Date. 56

4.29 Key Format Type. 56

4.30 Key Part Identifier 57

4.31 Key Value Location. 58

4.32 Key Value Present 58

4.33 Last Change Date. 59

4.34 Lease Time. 59

4.35 Links. 60

4.35.1 Certificate Link. 61

4.35.2 Certificate Request Link. 61

4.35.3 Child Link. 62

4.35.4 Credential Link. 62

4.35.5 Derivation Base Object Link. 63

4.35.6 Derived Object Link. 63

4.35.7 Group Link. 64

4.35.8 Joined Split Key Parts Link. 64

4.35.9 Next Link. 65

4.35.10 Parent Link. 65

4.35.11 Password Link. 66

4.35.12 PKCS#12 Certificate Link. 67

4.35.13 PKCS#12 Password Link. 67

4.35.14 Previous Link. 68

4.35.15 Private Key Link. 68

4.35.16 Public Key Link. 69

4.35.17 Replaced Object Link. 69

4.35.18 Replacement Object Link. 70

4.35.19 Split Key Base Link. 70

4.35.20 Wrapping Key Link. 71

4.36 Name. 71

4.37 Never Extractable. 72

4.38 NIST Key Type. 72

4.39 NIST Security Category. 73

4.40 Object Class. 73

4.41 Object Type. 74

4.42 Opaque Data Type. 74

4.43 Original Creation Date. 75

4.44 OTP Counter 75

4.45 PKCS#12 Friendly Name. 76

4.46 Process Start Date. 76

4.47 Protect Stop Date. 77

4.48 Protection Level 78

4.49 Protection Period. 78

4.50 Protection Storage Mask. 78

4.51 Quantum Safe. 79

4.52 Random Number Generator 79

4.53 Revocation Reason. 80

4.54 Rotate Automatic. 81

4.55 Rotate Date. 81

4.56 Rotate Generation. 82

4.57 Rotate Interval 82

4.58 Rotate Latest 83

4.59 Rotate Name. 83

4.60 Rotate Offset 84

4.61 Sensitive. 84

4.62 Short Unique Identifier 85

4.63 Split Key Polynomial 85

4.64 Split Key Method. 86

4.65 Split Key Parts. 86

4.66 Split Key Threshold. 87

4.67 State. 87

4.68 Unique Identifier 90

4.69 Usage Limits. 92

4.70 Vendor Attribute. 92

4.71 X.509 Certificate Identifier 93

4.72 X.509 Certificate Issuer 94

4.73 X.509 Certificate Subject 94

5      Attribute Data Structures. 96

5.1 Attributes. 96

5.2 Common Attributes. 96

5.3 Private Key Attributes. 96

5.4 Public Key Attributes. 96

5.5 Attribute Reference. 97

5.6 Current Attribute. 97

5.7 New Attribute. 97

6      Operations. 98

6.1 Client-to-Server Operations. 98

6.1.1 Activate. 99

6.1.2 Add Attribute. 99

6.1.3 Adjust Attribute. 100

6.1.4 Archive. 101

6.1.5 Cancel 102

6.1.6 Certify. 102

6.1.7 Check. 103

6.1.8 Create. 105

6.1.9 Create Credential 106

6.1.10 Create Group. 107

6.1.11 Create Key Pair 108

6.1.12 Create Split Key. 110

6.1.13 Create User 111

6.1.14 Deactivate. 112

6.1.15 Decrypt 113

6.1.16 Delegated Login. 115

6.1.17 Delete Attribute. 115

6.1.18 Derive Key. 116

6.1.19 Destroy. 118

6.1.20 Discover Versions. 118

6.1.21 Encrypt 119

6.1.22 Export 121

6.1.23 Get 122

6.1.24 Get Attributes. 123

6.1.25 Get Attribute List 124

6.1.26 Get Constraints. 125

6.1.27 Get Usage Allocation. 126

6.1.28 Hash. 126

6.1.29 Import 127

6.1.30 Interop. 129

6.1.31 Join Split Key. 129

6.1.32 Locate. 130

6.1.33 Log. 133

6.1.34 Login. 133

6.1.35 Logout 134

6.1.36 MAC. 135

6.1.37 MAC Verify. 136

6.1.38 Modify Attribute. 138

6.1.39 Obliterate. 139

6.1.40 Obtain Lease. 139

6.1.41 Ping. 140

6.1.42 PKCS#11. 141

6.1.43 Poll 142

6.1.44 Process. 142

6.1.45 Query. 143

6.1.46 Query Asynchronous Requests. 146

6.1.47 Recover 147

6.1.48 Register 147

6.1.49 Revoke. 149

6.1.50 Re-certify. 150

6.1.51 Re-key. 151

6.1.52 Re-key Key Pair 153

6.1.53 Re-Provision. 156

6.1.54 RNG Retrieve. 157

6.1.55 RNG Seed. 157

6.1.56 Set Attribute. 158

6.1.57 Set Constraints. 159

6.1.58 Set Defaults. 159

6.1.59 Set Endpoint Role. 160

6.1.60 Sign. 161

6.1.61 Signature Verify. 162

6.1.62 Validate. 164

6.2 Server-to-Client Operations. 165

6.2.1 Discover Versions. 165

6.2.2 Notify. 166

6.2.3 Put 167

6.2.4 Query. 168

6.2.5 Set Endpoint Role. 170

7      Operations Data Structures. 171

7.1 Asynchronous Correlation Values. 171

7.2 Asynchronous Request 171

7.3 Authenticated Encryption Additional Data. 171

7.4 Authenticated Encryption Tag. 171

7.5 Capability Information. 172

7.6 Constraint 172

7.7 Constraints. 172

7.8 Correlation Value. 173

7.9 Credential Information. 173

7.10 Data. 173

7.11 Data Length. 173

7.12 Defaults Information. 174

7.13 Derivation Parameters. 174

7.14 Extension Information. 175

7.15 Final Indicator 175

7.16 Interop Function. 175

7.17 Interop Identifier 176

7.18 Init Indicator 176

7.19 Key Wrapping Specification. 176

7.20 Log Message. 177

7.21 MAC Data. 177

7.22 Objects. 177

7.23 Object Defaults. 177

7.24 Object Groups. 178

7.25 Object Types. 178

7.26 Operations. 178

7.27 PKCS#11 Function. 178

7.28 PKCS#11 Input Parameters. 179

7.29 PKCS#11 Interface. 179

7.30 PKCS#11 Output Parameters. 179

7.31 PKCS#11 Return Code. 179

7.32 Profile Information. 179

7.33 Profile Version. 180

7.34 Protection Storage Masks. 180

7.35 Right 180

7.36 Rights. 181

7.37 RNG Parameters. 181

7.38 Server Information. 182

7.39 Signature Data. 182

7.40 Ticket 182

7.41 Usage Limits. 182

7.42 Validation Information. 183

8      Messages. 184

8.1 Requests. 184

8.1.1 Request Message. 184

8.1.2 Request Header 184

8.1.3 Request Batch Item.. 185

8.2 Responses. 185

8.2.1 Response Message. 185

8.2.2 Response Header 185

8.2.3 Response Batch Item.. 186

9      Message Data Structures. 187

9.1 Asynchronous Correlation Value. 187

9.2 Asynchronous Indicator 187

9.3 Attestation Capable Indicator 187

9.4 Authentication. 187

9.5 Batch Error Continuation Option. 188

9.6 Batch Item.. 188

9.7 Correlation Value (Client) 188

9.8 Correlation Value (Server) 188

9.9 Credential 189