Bruce -
I think we are in agreement. Although you have been
able to assess what the implications are for you; I haven't gotten there
yet.
- Peter
From: Bruce Rich [mailto:]
Sent: 2009-05-14 10:17 AM
To: Zelechoski,
Peter
Cc:
Subject: RE: [kmip]
question regarding conformance statement for KMIP
Peter,
I agree that conformance needs to mean something. I
was merely looking at the current specification to see if it says anything that
reads on the current discussion point. It seems to indicate that all
managed objects are optional.
If we
want KMIP conformance claims to be meaningful, it may mean that we either change
the specification, or that we introduce profiles over the top of the
specification. (This was basically the approach used with the Web Services
specs, where WS-I introduced profiles of the specs that had meaningful,
interoperable subsets).
<possibleRatHole>
I would
love it if KMIPv1 did not require support of Key Wrapping Specification (as not
needed over SSL-protected session), but if I say that I support any
ManagedObject on the Query Objects call, then it looks like I need to (with some
set of CryptographicParameters). The current Query doesn't seem to allow
me to tell clients not to ask for or to send wrapped keys.
I would also love it if KMIPv1 did not require support of
the Derive Key operation (with 7 defined derivation mechanisms), but if I say
that I support SymmetricKey on the Query Objects call, then it looks like I need
to, as Query doesn't have a way for me to report this either. This would
simply be a matter of adding Derive Key to the optional operations list that
Query Operations can report on.
</possibleRatHole>
Bruce A Rich
brich at-sign us dot ibm dot
com
From:
"Zelechoski, Peter"
<>
To:
Bruce Rich/Austin/IBM@IBMUS
Cc:
<>,
<>
Date:
05/14/2009 08:38 AM
Subject:
RE: [kmip] question regarding conformance
statement for KMIP
Bruce -
OK, I understand
what you are saying. However, I wonder about a standard with no required
exchanges for claiming conformance. There should be something the system
must handle to claim conformance. If you can answer "not supported" to
every object and still say you are conformant, you have delivered nothing of
value and that waters down the claims of truly conformant systems.
-
Peter
From: Bruce Rich [mailto:]
Sent: 2009-05-14 8:27 AM
To: Zelechoski,
Peter
Cc: ;
Subject: RE: [kmip] question regarding
conformance statement for KMIP
Peter,
I'm not sure what you meant by "mandatory object".
It would seem that all objects are optional, as the server's response to a
Query Objects operation specifies those objects that the server supports, and
all the managed objects are potential entries in that list. So if a server does
not wish to support registration of SplitKey, then it would simply omit SplitKey
from the list of objects that it claims it will support (if the client bothers
to ask via Query Objects).
Bruce A Rich
brich at-sign us dot ibm dot com
From:
"Zelechoski, Peter"
<>
To:
<>
Cc:
<>
Date:
05/13/2009 08:57 PM
Subject:
RE: [kmip] question regarding conformance
statement for KMIP
Robert -
My opinion is
that an implementation that wants to claim compliance to
the standard would
be required to respond accurately to all
required/mandatory objects. A
response of "not supported" would only be
appropriate for an optional
object.
- Peter
