KMIPClient Class
Properties Methods Events Configuration Settings Errors
The KMIPClient class provides client-side functionality for KMIP.
Syntax
class secureblackbox.KMIPClient
Remarks
The Key Management Interoperability Protocol (KMIP) is an OASIS standard for communication between different key management servers and clients.
Property List
The following is the full list of the properties of the class with short descriptions. Click on the links for further details.
| data_file | A path to the file containing the unsigned data. |
| encoder_type | Specifies the KMIP encoder type. |
| external_crypto_custom_params | Custom parameters to be passed to the signing service (uninterpreted). |
| external_crypto_data | Additional data to be included in the async state and mirrored back by the requestor. |
| external_crypto_external_hash_calculation | Specifies whether the message hash is to be calculated at the external endpoint. |
| external_crypto_hash_algorithm | Specifies the request's signature hash algorithm. |
| external_crypto_key_id | The ID of the pre-shared key used for DC request authentication. |
| external_crypto_key_secret | The pre-shared key used for DC request authentication. |
| external_crypto_method | Specifies the asynchronous signing method. |
| external_crypto_mode | Specifies the external cryptography mode. |
| external_crypto_public_key_algorithm | Provide public key algorithm here if the certificate is not available on the pre-signing stage. |
| host | Specifies the host name of the KMIP server. |
| input_file | Path to the file containing data to be signed, verified, encrypted or decrypted. |
| object_count | The number of records in the Object arrays. |
| object_id | Contains the value currently stored in the ID Placeholder. |
| object_key_algorithm | The cryptographic algorithm for this object. |
| object_key_length | The length of the cryptographic key. |
| object_object_type | The type of this object. |
| object_sig_algorithm | Digital signature algorithm for this object (only for certificates). |
| object_unique_identifier | The unique identifier of the object generated by the key management system. |
| output_file | Specifies the file where the signed, encrypted, or decrypted data should be saved. |
| password | Specifies a password to authenticate to the KMIP server. |
| pinned_cert_bytes | Returns raw certificate data in DER format. |
| pinned_cert_handle | Allows to get or set a 'handle', a unique identifier of the underlying property object. |
| pinned_cert_request_bytes | Provides access to raw certificate request data in DER format. |
| pinned_cert_request_handle | Allows to get or set a 'handle', a unique identifier of the underlying property object. |
| port | Specifies the port on the KMIP server to connect to. |
| proxy_address | The IP address of the proxy server. |
| proxy_authentication | The authentication type used by the proxy server. |
| proxy_password | The password to authenticate to the proxy server. |
| proxy_port | The port on the proxy server to connect to. |
| proxy_proxy_type | The type of the proxy server. |
| proxy_request_headers | Contains HTTP request headers for WebTunnel and HTTP proxy. |
| proxy_response_body | Contains the HTTP or HTTPS (WebTunnel) proxy response body. |
| proxy_response_headers | Contains response headers received from an HTTP or HTTPS (WebTunnel) proxy server. |
| proxy_use_i_pv6 | Specifies whether IPv6 should be used when connecting through the proxy. |
| proxy_use_proxy | Enables or disables proxy-driven connection. |
| proxy_username | Specifies the username credential for proxy authentication. |
| signature_validation_result | The signature validation result. |
| socket_dns_mode | Selects the DNS resolver to use: the class's (secure) built-in one, or the one provided by the system. |
| socket_dns_port | Specifies the port number to be used for sending queries to the DNS server. |
| socket_dns_query_timeout | The timeout (in milliseconds) for each DNS query. |
| socket_dns_servers | The addresses of DNS servers to use for address resolution, separated by commas or semicolons. |
| socket_dns_total_timeout | The timeout (in milliseconds) for the whole resolution process. |
| socket_incoming_speed_limit | The maximum number of bytes to read from the socket, per second. |
| socket_local_address | The local network interface to bind the socket to. |
| socket_local_port | The local port number to bind the socket to. |
| socket_outgoing_speed_limit | The maximum number of bytes to write to the socket, per second. |
| socket_timeout | The maximum period of waiting, in milliseconds, after which the socket operation is considered unsuccessful. |
| socket_use_i_pv6 | Enables or disables IP protocol version 6. |
| tls_client_cert_count | The number of records in the TLSClientCert arrays. |
| tls_client_cert_bytes | Returns raw certificate data in DER format. |
| tls_client_cert_handle | Allows to get or set a 'handle', a unique identifier of the underlying property object. |
| tls_server_cert_count | The number of records in the TLSServerCert arrays. |
| tls_server_cert_bytes | Returns raw certificate data in DER format. |
| tls_server_cert_handle | Allows to get or set a 'handle', a unique identifier of the underlying property object. |
| tls_auto_validate_certificates | Specifies whether server-side TLS certificates should be validated automatically using internal validation rules. |
| tls_base_configuration | Selects the base configuration for the TLS settings. |
| tls_ciphersuites | A list of ciphersuites separated with commas or semicolons. |
| tlsec_curves | Defines the elliptic curves to enable. |
| tls_force_resume_if_destination_changes | Whether to force TLS session resumption when the destination address changes. |
| tls_pre_shared_identity | Defines the identity used when the PSK (Pre-Shared Key) key-exchange mechanism is negotiated. |
| tls_pre_shared_key | Contains the pre-shared for the PSK (Pre-Shared Key) key-exchange mechanism, encoded with base16. |
| tls_pre_shared_key_ciphersuite | Defines the ciphersuite used for PSK (Pre-Shared Key) negotiation. |
| tls_renegotiation_attack_prevention_mode | Selects renegotiation attack prevention mechanism. |
| tls_revocation_check | Specifies the kind(s) of revocation check to perform. |
| tlsssl_options | Various SSL (TLS) protocol options, set of cssloExpectShutdownMessage 0x001 Wait for the close-notify message when shutting down the connection cssloOpenSSLDTLSWorkaround 0x002 (DEPRECATED) Use a DTLS version workaround when talking to very old OpenSSL versions cssloDisableKexLengthAlignment 0x004 Do not align the client-side PMS by the RSA modulus size. |
| tlstls_mode | Specifies the TLS mode to use. |
| tls_use_extended_master_secret | Enables Extended Master Secret Extension, as defined in RFC 7627. |
| tls_use_session_resumption | Enables or disables TLS session resumption capability. |
| tls_versions | Th SSL/TLS versions to enable by default. |
| username | The username to authenticate to the KMIP server. |
Method List
The following is the full list of the methods of the class with short descriptions. Click on the links for further details.
| add_certificate | Imports a certificate to the KMIP server. |
| add_key | Imports a key to the KMIP server. |
| add_pinned | Imports a certificate to the KMIP server. |
| config | Sets or retrieves a configuration setting. |
| decrypt | Decrypts the provided data using a key stored on the KMIP server. |
| encrypt | Encrypts the provided data using a key stored on the KMIP server. |
| generate_cert | Generates a new certificate on the KMIP server. |
| generate_cert_from_pinned | Generates a new certificate on the KMIP server from the pinned certificate. |
| generate_cert_from_request | Generates a new certificate on the KMIP server from the certificate request. |
| generate_key | Generates a symmetric key or an asymmetric key pair on the KMIP server. |
| get_list | Retrieves the list of objects of a given type. |
| remove | Removes the specified object from the server. |
| sign | Signs the data using a key on the KMIP server. |
| verify | Verifies digitally signed data. |
Event List
The following is the full list of the events fired by the class with short descriptions. Click on the links for further details.
| on_error | Provides information about errors during KMIP operations. |
| on_external_sign | Handles remote or external signing initiated by the SignExternal method or other source. |
| on_notification | This event notifies the application about an underlying control flow event. |
| on_tls_cert_validate | This event is fired upon receipt of the TLS server's certificate, allowing the user to control its acceptance. |
Configuration Settings
The following is a list of configuration settings for the class with short descriptions. Click on the links for further details.
| BlockCipherMode | Block cipher mode to use for encrypting or decrypting. |
| BlockSize | Block size of data for encrypting, decrypting or signing. |
| Curve | Name of the curve of the newly added elliptic cryptography (EC) key. |
| HashAlgorithm | Hash algorithm to use for signing or verifying. |
| IVCounterNonce | Initialization vector, counter or nonce for encrypting or decrypting. |
| MajorProtocolVersion | Major protocol version of the KMIP server. |
| MaximumItems | The maximum number of items to be returned on getting the object list. |
| MinorProtocolVersion | Minor protocol version of the KMIP server. |
| OffsetItems | The number of items to skip on getting the object list. |
| PaddingMethod | Padding method to use for encrypting or decrypting. |
| RandomIV | Whether to generate the initialization vector automatically. |
| TagLength | Tag length to use for encrypting or decrypting. |
| TempPath | Path for storing temporary files. |
| CheckKeyIntegrityBeforeUse | Enables or disable private key integrity check before use. |
| CookieCaching | Specifies whether a cookie cache should be used for HTTP(S) transports. |
| Cookies | Gets or sets local cookies for the class (supported for HTTPClient, RESTClient and SOAPClient only). |
| DefDeriveKeyIterations | Specifies the default key derivation algorithm iteration count. |
| EnableClientSideSSLFFDHE | Enables or disables finite field DHE key exchange support in TLS clients. |
| GlobalCookies | Gets or sets global cookies for all the HTTP transports. |
| HttpUserAgent | Specifies the user agent name to be used by all HTTP clients. |
| LogDestination | Specifies the debug log destination. |
| LogDetails | Specifies the debug log details to dump. |
| LogFile | Specifies the debug log filename. |
| LogFilters | Specifies the debug log filters. |
| LogFlushMode | Specifies the log flush mode. |
| LogLevel | Specifies the debug log level. |
| LogMaxEventCount | Specifies the maximum number of events to cache before further action is taken. |
| LogRotationMode | Specifies the log rotation mode. |
| MaxASN1BufferLength | Specifies the maximal allowed length for ASN.1 primitive tag data. |
| MaxASN1TreeDepth | Specifies the maximal depth for processed ASN.1 trees. |
| OCSPHashAlgorithm | Specifies the hash algorithm to be used to identify certificates in OCSP requests. |
| UseOwnDNSResolver | Specifies whether the client classes should use own DNS resolver. |
| UseSharedSystemStorages | Specifies whether the validation engine should use a global per-process copy of the system certificate stores. |
| UseSystemOAEPAndPSS | Enforces or disables the use of system-driven RSA OAEP and PSS computations. |
| UseSystemRandom | Enables or disables the use of the OS PRNG. |