Key Management Interoperability Protocol Specification Version 1.1
Key Management Interoperability Protocol Specification Version 1.1
Key Management Interoperability Protocol Specification Version 1.1
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
123456789101112131415161718192021222324252627282930313233341 IntroductionThis document is intended as a specification of the protocol used for the communication between clientsand servers to perform certain management operations on objects stored and maintained by a keymanagement system. These objects are referred to as Managed Objects in this specification. Theyinclude symmetric and asymmetric cryptographic keys, digital certificates, and templates used to simplifythe creation of objects and control their use. Managed Objects are managed with operations that includethe ability to generate cryptographic keys, register objects with the key management system, obtainobjects from the system, destroy objects from the system, and search for objects maintained by thesystem. Managed Objects also have associated attributes, which are named values stored by the keymanagement system and are obtained from the system via operations. Certain attributes are added,modified, or deleted by operations.The protocol specified in this document includes several certificate-related functions for which there are anumber of existing protocols – namely Validate (e.g., SCVP or XKMS), Certify (e.g. CMP, CMC, SCEP)and Re-certify (e.g. CMP, CMC, SCEP). The protocol does not attempt to define a comprehensivecertificate management protocol, such as would be needed for a certification authority. However, it doesinclude functions that are needed to allow a key server to provide a proxy for certificate managementfunctions.In addition to the normative definitions for managed objects, operations and attributes, this specificationalso includes normative definitions for the following aspects of the protocol: The expected behavior of the server and client as a result of operations, Message contents and formats, Message encoding (including enumerations), and Error handling.This specification is complemented by three other documents. The Usage Guide [KMIP-UG] providesillustrative information on using the protocol. The KMIP Profiles <strong>Specification</strong> [KMIP-Prof] provides aselected set of conformance profiles and authentication suites. The Test <strong>Specification</strong> [KMIP-TC]provides samples of protocol messages corresponding to a set of defined test cases.This specification defines the KMIP protocol version major 1 and minor 1 (see 6.1).<strong>1.1</strong> TerminologyThe key words “MUST”, “MUST NOT”, “REQUIRED”, “SHALL”, “SHALL NOT”, “SHOULD”, “SHOULDNOT”, “RECOMMENDED”, “MAY”, and “OPTIONAL” in this document are to be interpreted as describedin [RFC2119].For acronyms used in this document, see Appendix E. For definitions not found in this document, see[SP800-57-1].ArchiveAsymmetric key pair(key pair)AuthenticationAuthentication codeAuthorizationTo place information not accessed frequently into long-term storage.A public key and its corresponding private key; a key pair is used with apublic key algorithm.A process that establishes the origin of information, or determines anentity’s identity.A cryptographic checksum based on a security function (also known as aMessage Authentication Code).Access privileges that are granted to an entity; conveying an “official”kmip-spec-v<strong>1.1</strong>-cos01 21 September 2012Standards Track Work Product Copyright © OASIS Open 2012. All Rights Reserved. Page 8 of 164
Change language