And is it okay for the server – if it has a policy that requires key wrapping for certain keys – to return the requested key wrapped when the client omits the Key Wrapping Specification from the Get request? Or would/should the server reject such a request?
John
From:
Mathias Bjoerkqvist1 [mailto:]
Sent: Friday, 10 June 2011 1:30 AM
To: Pochuev,Denis
Cc:
Subject: [kmip-interop-tech] Key wrapping use case
Hi Denis,
To retrieve a key wrapped (encrypted and/or MAC/Signed), the Key Wrapping Key Specification must be specified in the Get request. However, the Cryptographic Parameters may be omitted from the Key Wrapping Specification, in which case the Cryptographic Parameters attribute instance with the lowest index value for the Encryption Key and/or MAC/Signature key is used. For the proposed key wrapping use case, the Get response would look the same even if the Cryptographic Parameters were omitted from the Key Wrapping Specification in the Get request.
If the whole Key Wrapping Specification is omitted from the Get request, then the key that is retrieved will be in cleartext and unwrapped. I can add another Get to the use case to make this clear.
For this and possible future key wrapping use cases, I would suggest also adding a reference to Section 3.21 in the Usage Guide which addresses key wrapping.
Thanks,
Mathias
