kmip-interop-tech — archive

RE: [kmip-interop-tech] Key wrapping use case

From: John Leiseboer
To: [email protected]
Date: Thu, 09 Jun 2011 15:41:00 -0000

And is it okay for the server – if it has a policy that requires key wrapping for certain keys – to return the requested key wrapped when the client omits the Key Wrapping Specification from the Get request? Or would/should the server reject such a request? John From: Mathias Bjoerkqvist1 [mailto:[email protected]] Sent: Friday, 10 June 2011 1:30 AM To: Pochuev,Denis Cc: [email protected] Subject: [kmip-interop-tech] Key wrapping use case Hi Denis, To retrieve a key wrapped (encrypted and/or MAC/Signed), the Key Wrapping Key Specification must be specified in the Get request. However, the Cryptographic Parameters may be omitted from the Key Wrapping Specification, in which case the Cryptographic Parameters attribute instance with the lowest index value for the Encryption Key and/or MAC/Signature key is used. For the proposed key wrapping use case, the Get response would look the same even if the Cryptographic Parameters were omitted from the Key Wrapping Specification in the Get request. If the whole Key Wrapping Specification is omitted from the Get request, then the key that is retrieved will be in cleartext and unwrapped. I can add another Get to the use case to make this clear. For this and possible future key wrapping use cases, I would suggest also adding a reference to Section 3.21 in the Usage Guide which addresses key wrapping. Thanks, Mathias