The Key Management Interoperability Protocol (KMIP) is an extensible communication protocol that defines message formats for the manipulation of cryptographic keys on a key management server. This facilitates data encryption by simplifying encryption key management. Keys may be created on a server and then retrieved, possibly wrapped by other keys. Both symmetric and asymmetric keys are supported, including the ability to sign certificates. KMIP also allows for clients to ask a server to encrypt or decrypt data, without needing direct access to the key. The KMIP standard was first released in 2010. Clients and servers are commercially available from multiple vendors. The KMIP standard effort is governed by the OASIS standards body. Technical details can also be found on the official KMIP page and kmip wiki.
Description A KMIP server stores and controls Managed Objects like symmetric and asymmetric keys, certificates, and user defined objects. Clients then use the protocol for accessing these objects subject to a security model that is implemented by the servers. Operations are provided to create, locate, use, retrieve and update managed objects. Each managed object comprises an immutable Value like a key-block containing a cryptographic-key. These objects also have mutable Attributes which can be used for storing metadata about their keys. Some attributes are derived directly from the Value, like the cryptographic-algorithm and key-length. Other attributes are defined in the specification for the management of objects like the Application-Specific Identifier which is usually derived from tape-identification data. Additional identifiers can be defined by the server or client per application need. Each object is identified by a unique and immutable object-identifier generated by the server and is used for getting object-values. Managed-objects may also be given a number of mutable yet globally unique Name attribute which can be used for Locating objects.
Objects The types of managed-objects being managed by KMIP include:
Symmetric-Keys used for algorithms like AES. Public and Private Keys used for asymmetric-algorithms like RSA, DSA and ECDH. Separate objects are used for storing the public and private key, thus a user may have permission to access one but not the other. Related objects usually contain Link attributes containing the other object's unique identifier. Certificates and PGP Keys. Split Keys, with each split being a distinct object that can be managed independently from the other splits. Secret Data, such as passwords. Opaque Data for client and server defined extensions. Certificate Signing Requests.
Operations The operations provided by KMIP include:
Create: creating a new managed object such as a symmetric key, and return the identifier. Create Key Pair: creating two objects that represent asymmetric keys. Get: retrieving an object's value given its unique identifier. The returned value may be wrapped (encrypted) with another key that is on the server for additional security. Register: storing an externally generated key value. Add Attributes, Get Attributes, Modify Attributes and Set Attribute: These can be used to manipulate mutable attributes of a managed object. Locate: retrieving a list of objects based on a predicates. Re-Key, Re-Key-Key-Pair: creating a new key that can replace an existing key. There are also attributes that can be used to have the server automatically rotate keys after a given period or number of uses. The Name is moved to the new key and is normally used to retrieve a key for protection operations such as encrypt and sign. The old key can also be retrieved using the Unique Identifier for process operations such as decryption and signature verification. (Re-)Certify - certifies a certificate. Split and Join N of M keys. Encrypt, Decrypt, MAC etc.: Cryptographic operations performed on the key management server. A key itself can be marked being not-Extractable, in which case its value never leaves the server. Export, Import: Move keys to and from other KMIP servers. Activate, Deactivate etc.: Operations to implement the NIST key life cycle. Encapsulate, Decapsulate: Post Quantum algorithm support.
Key life cycle Each key has a cryptographic state defined by the National Institute of Standards and Technology (NIST). Keys are created in an Initial state, and must be Activated before they can be used. Keys may then be Deactivated and eventually Destroyed. A key may also be marked being Compromised. Operations are provided for manipulating Key-state in conformance with the NIST life-cycle guidelines. A Key-state may be interrogated using the State attribute or the attributes that record dates of each transformation such as Activation Date. Dates can be specified into the future thus keys automatically become unavailable for specified operations when they expire.
Message structure KMIP is a stateless protocol in which messages are sent from a client to a server and then the client normally awaits on a reply. Each request may contain many operations thus enables the protocol to efficiently handle large numbers of keys. There are also advanced features for processing requests asynchronously. The KMIP protocol specifies several different types of encodings. The main one is a type–length–value encoding of messages, called TTLV (Tag, Type, Length, Value). Nested TTLV structures allow for encoding of complex, multi-operation messages in a single binary message. There are also well defined XML and JSON encodings of the protocol for environments where binary is not appropriate. All of these protocols are expected to be transmitted using TLS protocol in order to ensure integrity and security. However, it is also possible to register and retrieve keys that are wrapped (encrypted) using another key on the server, which provides an additional level of security.
… excerpt ends here. Continue reading the full article.
