kmip-interop-tech — archive

Key name conflicts

From: Robert Lockhart <[email protected]>
To: [email protected]
Date: Mon, 21 Jan 2013 21:43:00 -0000

I agree on the prepending the test case on the key name as it will make it easier to go through logs. As for confusion on keys, we have separation of domains/groups within the server so it is not as much a problem for us for the name identifier. However in the case where it is all one big happy pool, I suggest clients prepend a domain name (e.g. townsendsecurity.com, thalesesec.com, etc… on the name to remove confusion or potential conflicts. I am just not sure how hard it would be to implement for some of the other client vendors. Currently we don’t do it from the client other than as defined in the test cases but there is no reason we couldn’t. It is something we learned a long time ago that you have a better chance to ensure uniqueness doing so for both the name and for the UUID. It is one of the many things on my plate at the moment is to publish a profile for a URI name space that can ensure uniqueness globally when implemented properly by using a fully qualified domain name as the first part of a UUID and there is no reason you couldn’t do the same for the name. An example of the UUID’s you get from us would be as follows: · km:\townsendsecurity.com1SKFF-M-05-0000000000001 · km:\subdomain1.subdomain2.thales-esecurity.com1001020304050607 · km:\thales-esecurity.comsome-credential-identifier These are just a few and the 0 and 1 are actually object types that I want to propose to differentiate credentials from KMIP objects. We currently use these type of identifiers for UUID only, but there is no reason you can’t use them for name as well to keep the clients happy. Just a thought. Bob L. From: [email protected] [ mailto:[email protected] ] On Behalf Of Jim Flood Sent: Thursday, January 17, 2013 1:04 PM To: [email protected] Subject: [kmip-interop-tech] Key name conflicts I meant to bring this up in the interop call: it would be great during the interop testing and also during the RSA show itself if clients distinguished their key names somehow, since on my server the name space is global, i.e. shared by all clients. This would prevent one client's key from being destroyed in the middle of a test by another client locating by the same key name. For example, Acme client would create a key "AcmeRekeyKey" instead of "RekeyKey". (Some clients are already doing this.) BTW I also found it useful to have the key name reflect the test, e.g. having "SKFF-M-5" as part of the key name, when verifying the test logs.