KMIP Managed Operations

Here is the list of KMIP managed operations.

• Add Attribute - Adds a new attribute instance or application specific information instance to a managed object and sets its value.

• Create - Generate a new symmetric key. Our implementation of the create operation supports application specific information, custom attributes, and aliases.

• Create Key Pair- Generate a new asymmetric key pair. Our implementation of the create key pair operation supports application specific information, custom attributes, and aliases.

• Certify/Recertify - Generate or renew a Certificate object for a public key. The certify method creates a new Certificate Managed Object on the server.

• Modify Attribute: Modifies an attribute associated with a managed object. The object is specified by its unique identifier. Attributes are specified by their name.

• Delete Attribute: Deletes an attribute associated with a managed object. The object is specified by its unique identifier. Attributes are specified by their name. Any attribute that is required cannot be deleted. Our implementation of the DeleteAttribute operation supports application specific information and custom attributes.

• Destroy: Requests that the key material for a managed object be destroyed. Our implementation of KMIP does not retain metadata. Once the managed object is destroyed, its metadata is erased, too. Because our KMIP implementation does not support object state, there is no state requirement when destroying objects - cryptographic objects can be destroyed regardless of their state.

• Get: Requests that the server return the managed object specified by its unique identifier. Only a single object is returned. The response contains the object’s unique identifier and the object itself. Compression is not supported.

• Get Attributes: Requests one or more attributes of a managed object. The object is specified by its unique identifier. Attributes are specified by their name. If the specified attribute has multiple instances, then all instances are returned. If a specified attribute does not exist, then it is not present in the returned response. If none of the attributes exist, the response consists only of the unique identifier. If no attribute name is specified in the request, the server will act as if all attributes match the request.

• Get Attribute List: Requests a list of the attribute names associated with the managed object. The object is specified by its unique identifier. This request supports application specific information, custom attributes, and aliases.

• Locate: Requests that the server search for one or more managed objects. We recommend limiting searches to return no more than 1000 items. Otherwise, the response may be delayed, or the server may close the connection. Wild cards are not supported. The server supports only online objects, so if the storage-status mask excludes online object, the search returns empty. All supported attributes are valid. Date matching is supported.

• Modify Attribute: Modifies the value of an existing attribute instance associated with a managed object. The object is specified by its unique identifier. The operation request contains the attribute name to be modified, the attribute index (optional), and the new value. Only existing values may be changed. If an attribute has multiple instances, only the specified instance of the attribute is modified. If the attribute has multiple instances, and not index is specified, the index is assumed to 0. If the attribute does not support multiple instances, then an index can not be specified.

• Query - Requests information about the server’s capabilities and/or protocol mechanisms. The server vendor identification is Thales . The KMIPSession.query() is passed a java.util.Set of one or more enumeration values from com.ingrian security.nae.KMIPQueryFunction.Query

  • Query.QueryOperations: KMIP Operations supported

  • Query.QueryObjects: KMIP Managed Objects handled by the server

  • Query.QueryServerInformation: KMIP Server information

  • Query.QueryApplicationNamespaces: Application Namespaces defined on the NAE Server

  • Query.QueryVendorIdentification: KMIP Server-specific identification

  Each query type may return one or more values as a string. KMIPSession.query retrieves information into a map > indexed by the original Query Operations submitted. See the KMIPQuerySample.java for usage.

• Register - Requests that the server register a managed object that was created by the client or obtained by the client through some other means. This request adds templates, Asymmetric Key or Secret data to the server from a template definition or key data on the client.