kmip — archive

[Peter Zelechoski <pzelechoski@essvote.com>]

Bruce -
 
I think we are in agreement.  Although you have been 
able to assess what the implications are for you; I haven't gotten there 
yet.
 
- Peter




From: Bruce Rich [mailto:brich@us.ibm.com]
Sent: 2009-05-14 10:17 AM
To: Zelechoski, 
Peter
Cc: kmip@lists.oasis-open.org
Subject: RE: [kmip] 
question regarding conformance statement for KMIP



Peter,

I agree that conformance needs to mean something.  I 
was merely looking at the current specification to see if it says anything that 
reads on the current discussion point.  It seems to indicate that all 
managed objects are optional.

If we 
want KMIP conformance claims to be meaningful, it may mean that we either change 
the specification, or that we introduce profiles over the top of the 
specification.  (This was basically the approach used with the Web Services 
specs, where WS-I introduced profiles of the specs that had meaningful, 
interoperable subsets).

<possibleRatHole>
I would 
love it if KMIPv1 did not require support of Key Wrapping Specification (as not 
needed over SSL-protected session),  but if I say that I support any 
ManagedObject on the Query Objects call, then it looks like I need to (with some 
set of CryptographicParameters).  The current Query doesn't seem to allow 
me to tell clients not to ask for or to send wrapped keys.

I would also love it if KMIPv1 did not require support of 
the Derive Key operation (with 7 defined derivation mechanisms), but if I say 
that I support SymmetricKey on the Query Objects call, then it looks like I need 
to, as Query doesn't have a way for me to report this either.  This would 
simply be a matter of adding Derive Key to the optional operations list that 
Query Operations can report on.
</possibleRatHole>

Bruce A Rich
brich at-sign us dot ibm dot 
com





  

  

    
From: 
    
"Zelechoski, Peter" 
      <pzelechoski@essvote.com> 
  

    
To: 
    
Bruce Rich/Austin/IBM@IBMUS 
  

    
Cc: 
    
<kmip@lists.oasis-open.org>, 
      <robert.griffin@rsa.com> 
  

    
Date: 
    
05/14/2009 08:38 AM 
  

    
Subject: 
    
RE: [kmip] question regarding conformance 
      statement for KMIP





Bruce -
 
OK, I understand 
what you are saying.  However, I wonder about a standard with no required 
exchanges for claiming conformance.  There should be something the system 
must handle to claim conformance.  If you can answer "not supported" to 
every object and still say you are conformant, you have delivered nothing of 
value and that waters down the claims of truly conformant systems.
 
- 
Peter



From: Bruce Rich [mailto:brich@us.ibm.com] 

Sent: 2009-05-14 8:27 AM
To: Zelechoski, 
Peter
Cc: kmip@lists.oasis-open.org; 
robert.griffin@rsa.com
Subject: RE: [kmip] question regarding 
conformance statement for KMIP


Peter,

I'm not sure what you meant by "mandatory object". 
 It would seem that all objects are optional, as the server's response to a 
Query Objects operation specifies those objects that the server supports, and 
all the managed objects are potential entries in that list. So if a server does 
not wish to support registration of SplitKey, then it would simply omit SplitKey 
from the list of objects that it claims it will support (if the client bothers 
to ask via Query Objects). 

Bruce A Rich
brich at-sign us dot ibm dot com




  

  

    
From: 
    
"Zelechoski, Peter" 
      <pzelechoski@essvote.com> 
  

    
To: 
      
    
<robert.griffin@rsa.com> 
  

    
Cc: 
    
<kmip@lists.oasis-open.org> 
  

    
Date: 
      
    
05/13/2009 08:57 PM 
      
  

    
Subject: 
    
RE: [kmip] question regarding conformance 
      statement for KMIP







Robert -

My opinion is 
that an implementation that wants to claim compliance to
the standard would 
be required to respond accurately to all
required/mandatory objects.  A 
response of "not supported" would only be
appropriate for an optional 
object.

- Peter