KMIPClient Class

Properties   Methods   Events   Config Settings   Errors  

The KMIPClient class provides client-side functionality for KMIP protocol.

Syntax

secureblackbox.KMIPClient

Remarks

The KMIPClient component implements the client-side counterpart of the KMIP environment. KMIP, or the Key Management Interoperability Protocol, is an OASIS standard of communication between applications that need to use or manage cryptographic keys over the network. A typical example of a KMIP client is an application that needs to access a remotely stored cryptographic key (shared by a KMIP server) - for example, to solicit a digital signature or decrypt an encrypted document.

Capabilities

KMIPClient supports the majority of the features defined by the KMIP specification, both on the key management and cryptographic operations fronts. While the KMIP version implemented in KMIPClient is 1.3, the KMIP approach to version sequencing allows KMIPClient to communicate equally efficiently with implementations supporting earlier and newer protocol versions. All the three encoding types (TTLV, JSON, and XML) are supported, which can be used over TCP, TLS, or HTTP(S) transports.

Working with KMIPClient

Setting up the component

KMIP servers can come in a variety of configurations, many of which cannot be detected or applied automatically. That's why the first stage is about configuring the component in such way that it knows how to talk to a specific server that you need to work with. Below are the key settings that you need to tune up. You can get most or all of this information from the administrator of the KMIP server:

Network access parameters

This is the network address and port that the KMIP server is listening on - for example, 10.0.1.110:5696 or kmip.server.com:25696.

The transport type

This could be one of TCP (unencrypted low-level connection), TLS (encrypted low-level connection), HTTP (unencrypted HTTP), HTTPS (encrypted HTTP). Transport type is not negotiable: the client must use exactly the same transport as the server expects. You specify the transport by applying the appropriate transport-specific prefix to the server address that you are passing to BaseURL:

• kmip:// for plain TCP (e.g. kmip://10.0.1.110:5696)
• kmips:// for TLS (e.g. kmips://kmip.server.com:25696)
• http:// for HTTP (e.g. http://kmip.server.com:80)
• https:// for HTTPS (e.g. https://10.0.1.110:5697)

KMIP servers accessible over HTTP(S) may reside either at a root (/) or a deeper-level web server endpoint (for example, /services/kmip). Append this path to the network parameters as you would normally do when working with HTTP endpoints. Having done that, combine the transport prefix, the network parameters, and the HTTP path (if used) together to obtain the value to assign to BaseURL:

client.BaseURL = "https://kmip.server.com:25696/services/kmip"; // TLS-secured HTTP connection to kmip.server.com running on port 25696

The encoding type

KMIP offers three encoding types: TTLV ("tag, type, length, value"), JSON, and XML. Depending on configuration and scenarios used installation may prefer one over the others. Plain TCP and TLS KMIP setups normally use TTLV encoding. The client and server must use the same encoding to understand each other.

TLS configuration

TLS-protected connections require additional setup of the TLS parameters. Those are not part of KMIP, but, rather, are intended to supply expected security configuration. The principal security setting here concerns the way the server's TLS certificate is validated. You will find more details about configuring TLS on the client side in the Validating TLS Certificates article.

Once the connection and protocol parameters are configured, you can go ahead and start making requests to the KMIP server. A KMIP server can serve requests which generally fall into one of the two categories:

• Key management requests - such as importing a certificate, generating a keypair, or obtaining a list of keys stored on the server.
• Cryptographic operation requests - such as signing or encrypting data.

Depending on your specific setup, the server may support a subset of operations from one or both categories.

Managing keys and certificates

The common key management operations are:

Importing a keypair or certificate to the server

Use AddKey to import an asymmetric keypair or its part, or a secret symmetric key, to the KMIP server. Use Add to import a certificate. Both methods return a unique object identifier that you can use to identify the object on the server.

Listing server objects

Use List to request a criteria-based list of objects from the server. The objects returned by the server will be published in the Objects collection.

Reading object properties

KMIPClient offers a few methods to read object properties. You can choose the method that fits your scenario best. Use Read and ReadKey methods to read certificates and keys directly into the Certificate and Key properties. You can then pass the received objects to other components that support them (such as CertificateManager). Use ReadObject to read the object into the Objects list. Use ReadAttribute to read a specific attribute of an object.

Generating server-side objects

KMIP supports server-side object generation, which allows for secure cryptographic material setup. Among objects you can generate are certificates (Generate) and generic keys (GenerateKey).

Making cryptographic calls

The common cryptographic calls are:

Signing data

Use the Sign method to sign the data using a server-side private key.

Encrypting and decrypting data

Use the Encrypt and Decrypt methods to encrypt or decrypt data using a server-side key. This method can be used with both symmetric and asymmetric keys.

Providing data for the operations

You can provide input for the cryptographic operations in one of the following forms:

• as a byte array - use InputBytes property.
• as a stream - use InputStream.
• in a file - use InputFile.

The processed (e.g. signed) data can be retrieved from an equivalent set of output properties (OutputBytes, OutputStream, OutputFile). You can mix and match input and output data sources as you need: for example, you can provide the input in a file, but read the output as a byte array from OutputBytes.

Note that the OutputBytes is only populated if neither of OutputFile and OutputStream is set.

Referencing server objects

Every object residing on a KMIP server is referenced by its unique object identifier. Your code is expected to pass the identifier of the object that you want to use or read to the relevant method, such as Sign or ReadObject. If you do not know the identifier of the object that you need to use, use the List method to solicit the list of the server-side objects first. Locate the required object in the list and pass its unique identifier to the needed method.

Property List

---

The following is the full list of the properties of the class with short descriptions. Click on the links for further details.

Method List

---

The following is the full list of the methods of the class with short descriptions. Click on the links for further details.

Event List

---

The following is the full list of the events fired by the class with short descriptions. Click on the links for further details.

Config Settings

---

The following is a list of config settings for the class with short descriptions. Click on the links for further details.

AuthTypes Property (KMIPClient Class)

Defines allowed HTTP authentication types.

Syntax

public int getAuthTypes();
public void setAuthTypes(int authTypes);

Default Value

0

Remarks

Use this property to define which authentication types the component should support or attempt to use by enabling the relevant bitmask flags:

AuxResult Property (KMIPClient Class)

Contains the auxiliary result of the last performed operation.

Syntax

public String getAuxResult();

Default Value

""

Remarks

Use this property to obtain an auxiliary result of the last performed operation. One of such results is the new Counter/Nonce value after an encryption operation.

This property is read-only.

BaseURL Property (KMIPClient Class)

Specifies the url of the KMIP server.

Syntax

public String getBaseURL();
public void setBaseURL(String baseURL);

Default Value

""

Remarks

Use this property to specify the address of the KMIP server.

The address to assign to this property needs to be in the standard URI-like notation:

protocol://username:password@address:port/path

The protocol token must be based on the transport that you want to use (which is largely defined by the server setup) and can be one of the following:

• kmip:// - KMIP over TCP (unencrypted)
• kmips:// - KMIP over TLS (encrypted)
• http:// - KMIP over HTTP (unencrypted)
• https:// - KMIP over HTTPS (encrypted)

The address and port are network credentials that the server can be accessed at, such as 192.168.5.101:5696 for a server residing in a local network, or kmip.server.com:25696 for a server residing on the Internet. The path part can be used for KMIP servers accessible via HTTP(S) endpoints.

Examples

• kmip://10.25.0.61:5696
• kmips://10.0.1.10:11111
• kmips://kmip.server.com:11111
• http://user:password123@www.server.com:3128/services/kmip
• https://kmip.server.com:19991

Note that you need to take extra steps to prepare the component for secure connections when using TLS-enabled endpoints. One factor to be considered is the need to validate the server's TLS certificates. This article provides insights into the validation routine: Validating TLS Certificates.

The credentials used within the HTTP and HTTPS values are used for HTTP basic or digest authentication only. If your KMIP server expects you to use KMIP-level authentication, use Username and Password properties to provide your credentials.

BlockedCertificates Property (KMIPClient Class)

The certificates that must be rejected as trust anchors.

Syntax

public CertificateList getBlockedCertificates();
public void setBlockedCertificates(CertificateList blockedCertificates);

Remarks

Use this property to provide a list of compromised or blocked certificates. Any chain containing a blocked certificate will fail validation.

This property is not available at design time.

Please refer to the Certificate type for a complete list of fields.

Certificate Property (KMIPClient Class)

The certificate or request object to perform operations on.

Syntax

public Certificate getCertificate();
public void setCertificate(Certificate certificate);

Remarks

Use this property to provide the certificate or CSR object on which a subsequent operation (such as Add or Generate) should be performed.

This property is not available at design time.

Please refer to the Certificate type for a complete list of fields.

ConnectionInfo Property (KMIPClient Class)

Returns the details of the underlying network connection.

Syntax

public TLSConnectionInfo getConnectionInfo();

Remarks

Use this property to learn about the connection setup, such as the protocol security details and amounts of data transferred each way.

This property is read-only and not available at design time.

Please refer to the TLSConnectionInfo type for a complete list of fields.

DataBytes Property (KMIPClient Class)

Use this property to pass the secondary input to the class in the byte array form.

Syntax

public byte[] getDataBytes();
public void setDataBytes(byte[] dataBytes);

Remarks

Some cryptographic operations require more than one inputs. One example is the Verify operation, which expects you to provide the signature and the data being authenticated as separate data pieces. This property lets you provide that secondary data piece (the data being authenticated). The primary data piece (the signature in this case) should be provided via one of the Input* properties, such as InputBytes.

This property is one of three ways in which you can provide the data to the component. The other two are DataFile and DataStream. Choose the data source type that fits your circumstances best.

This property is not available at design time.

DataFile Property (KMIPClient Class)

Use this property to pass the secondary input to the class from a file.

Syntax

public String getDataFile();
public void setDataFile(String dataFile);

Default Value

""

Remarks

Some cryptographic operations require more than one inputs. One example is the Verify operation, which expects you to provide the signature and the data being authenticated as separate data pieces. This property lets you provide that secondary data piece (the data being authenticated). The primary data piece (the signature in this case) should be provided via one of the Input* properties, such as InputFile.

This property is one of three ways in which you can provide the data to the component. The other two are DataBytes and DataStream. Choose the data source type that fits your circumstances best.

DataStream Property (KMIPClient Class)

Use this property to pass the secondary input to the class as a stream.

Syntax

public java.io.InputStream getDataStream();
public void setDataStream(java.io.InputStream dataStream);

Default Value

null

Remarks

Some cryptographic operations require more than one inputs. One example is the Verify operation, which expects you to provide the signature and the data being authenticated as separate data pieces. This property lets you provide that secondary data piece (the data being authenticated). The primary data piece (the signature in this case) should be provided via one of the Input* properties, such as InputStream.

This property is one of three ways in which you can provide the data to the component. The other two are DataBytes and DataFile. Choose the data source type that fits your circumstances best.

This property is not available at design time.

Encoding Property (KMIPClient Class)

Specifies the KMIP encoding type.

Syntax

public int getEncoding();
public void setEncoding(int encoding);

Enumerated values:
  public final static int etTTLV = 0;
  public final static int etXML = 1;
  public final static int etJSON = 2;

Default Value

0

Remarks

Use this property to specify the KMIP message encoding to be used in the communications with the server.

The following encodings are available:

You need to know the right encoding for your KMIP server before accessing it. This is something you can get from the administrator of the server. KMIP servers accessible via plain TCP or TLS transports typically use the TTLV encoding.

ExternalCrypto Property (KMIPClient Class)

Provides access to external signing and DC parameters.

Syntax

public ExternalCrypto getExternalCrypto();

Remarks

Use this property to tune-up remote cryptography settings. SecureBlackbox supports two independent types of external cryptography: synchronous (based on the ExternalSign event) and asynchronous (based on the DC protocol and the DCAuth signing component).

This property is read-only.

Please refer to the ExternalCrypto type for a complete list of fields.

FIPSMode Property (KMIPClient Class)

Reserved.

Syntax

public boolean isFIPSMode();
public void setFIPSMode(boolean FIPSMode);

Default Value

False

Remarks

This property is reserved for future use.

InputBytes Property (KMIPClient Class)

Use this property to pass the input to class in byte array form.

Syntax

public byte[] getInputBytes();
public void setInputBytes(byte[] inputBytes);

Remarks

Assign a byte array containing the data to be processed to this property.

This property is not available at design time.

InputFile Property (KMIPClient Class)

A path to the file containing the data to be passed as input to a cryptographic operation.

Syntax

public String getInputFile();
public void setInputFile(String inputFile);

Default Value

""

Remarks

Provide the full path to the file containing data to be signed, verified, encrypted or decrypted.

This property is one of the three ways that you can provide the input data to KMIPClient, with InputBytes and InputStream being the other two.

InputStream Property (KMIPClient Class)

A stream containing the data to be passed as input to a cryptographic operation.

Syntax

public java.io.InputStream getInputStream();
public void setInputStream(java.io.InputStream inputStream);

Default Value

null

Remarks

This readable stream should provide data to be signed, verified, encrypted or decrypted.

This property is one of the three ways that you can provide the input data to KMIPClient, with InputBytes and InputFile being the other two.

This property is not available at design time.

Key Property (KMIPClient Class)

The key to perform the operations on.

Syntax

public CryptoKey getKey();
public void setKey(CryptoKey key);

Remarks

Use this property to provide the key object on which a subsequent operation - such as AddKey - should be performed.

This property is not available at design time.

Please refer to the CryptoKey type for a complete list of fields.

KnownCertificates Property (KMIPClient Class)

Additional certificates for chain validation.

Syntax

public CertificateList getKnownCertificates();
public void setKnownCertificates(CertificateList knownCertificates);

Remarks

Use this property to supply a list of additional certificates that might be needed for chain validation. An example of a scenario where you might want to do that is when intermediary CA certificates are absent from the standard system locations (or when there are no standard system locations), and therefore should be supplied to the class manually.

The purpose of the certificates to be added to this collection is roughly equivalent to that of the Intermediate Certification Authorities system store in Windows.

Do not add trust anchors or root certificates to this collection: add them to TrustedCertificates instead.

This property is not available at design time.

Please refer to the Certificate type for a complete list of fields.

KnownCRLs Property (KMIPClient Class)

Additional CRLs for chain validation.

Syntax

public CRLList getKnownCRLs();
public void setKnownCRLs(CRLList knownCRLs);

Remarks

Use this property to supply additional CRLs that might be needed for chain validation. This property may be helpful when a chain is validated in offline mode, and the associated CRLs are stored separately from the signed message or document.

This property is not available at design time.

Please refer to the CRL type for a complete list of fields.

KnownOCSPs Property (KMIPClient Class)

Additional OCSP responses for chain validation.

Syntax

public OCSPResponseList getKnownOCSPs();
public void setKnownOCSPs(OCSPResponseList knownOCSPs);

Remarks

Use this property to supply additional OCSP responses that might be needed for chain validation. This property may be helpful when a chain is validated in offline mode, and the associated OCSP responses are stored separately from the signed message or document.

This property is not available at design time.

Please refer to the OCSPResponse type for a complete list of fields.

Objects Property (KMIPClient Class)

A list of objects returned by List .

Syntax

public KMIPObjectList getObjects();

Remarks

This property provides access to the list of objects returned by List.

All, some, or just the ObjectType property of each object will be populated, depending on the value of the Filter parameter that was passed to the List call.

This property is read-only and not available at design time.

Please refer to the KMIPObject type for a complete list of fields.

OutputBytes Property (KMIPClient Class)

Use this property to read the output the class object has produced.

Syntax

public byte[] getOutputBytes();

Remarks

Read the contents of this property after the operation has completed to read the produced output. This property will only be set if the OutputFile and OutputStream properties had not been assigned.

This property is read-only and not available at design time.

OutputFile Property (KMIPClient Class)

Specifies the file where the signed, encrypted, or decrypted data should be saved.

Syntax

public String getOutputFile();
public void setOutputFile(String outputFile);

Default Value

""

Remarks

Provide a full path to the file where the signed, encrypted, or decrypted data should be saved.

This property is one of the three ways that you can receive the output data from KMIPClient, with OutputBytes and OutputStream being the other two.

OutputStream Property (KMIPClient Class)

The stream where the signed, encrypted, or decrypted document should be saved.

Syntax

public java.io.OutputStream getOutputStream();
public void setOutputStream(java.io.OutputStream outputStream);

Default Value

null

Remarks

Use this property to provide the stream to write the signed, encrypted, or decrypted data to.

This property is one of the three ways that you can receive the output data from KMIPClient, with OutputBytes and OutputFile being the other two.

This property is not available at design time.

Password Property (KMIPClient Class)

Specifies a password to authenticate to the KMIP server.

Syntax

public String getPassword();
public void setPassword(String password);

Default Value

""

Remarks

Use this property to provide a password for authentication on the KMIP server.

The value assigned to this property is used for built-in user authentication provided by KMIP. If the KMIP server you are connecting to expects you to use HTTP basic or digest authentication, provide the credentials via the BaseURL property.

Proxy Property (KMIPClient Class)

The proxy server settings.

Syntax

public ProxySettings getProxy();

Remarks

Use this property to tune up the proxy server settings.

This property is read-only.

Please refer to the ProxySettings type for a complete list of fields.

SignatureValidationResult Property (KMIPClient Class)

The signature validation result.

Syntax

public int getSignatureValidationResult();

Enumerated values:
  public final static int svtValid = 0;
  public final static int svtUnknown = 1;
  public final static int svtCorrupted = 2;
  public final static int svtSignerNotFound = 3;
  public final static int svtFailure = 4;
  public final static int svtReferenceCorrupted = 5;

Default Value

0

Remarks

Use this property to check the result of the most recent signature validation.

This property is read-only and not available at design time.

SocketSettings Property (KMIPClient Class)

Manages network connection settings.

Syntax

public SocketSettings getSocketSettings();

Remarks

Use this property to tune up network connection parameters.

This property is read-only.

Please refer to the SocketSettings type for a complete list of fields.

TLSClientChain Property (KMIPClient Class)

The TLS client certificate chain.

Syntax

public CertificateList getTLSClientChain();
public void setTLSClientChain(CertificateList TLSClientChain);

Remarks

Assign a certificate chain to this property to enable TLS client authentication in the class. Note that the client's end-entity certificate should have a private key associated with it.

Use the CertificateStorage or CertificateManager components to import the certificate from a file, system store, or PKCS11 device.

This property is not available at design time.

Please refer to the Certificate type for a complete list of fields.

TLSServerChain Property (KMIPClient Class)

The TLS server's certificate chain.

Syntax

public CertificateList getTLSServerChain();

Remarks

Use this property to access the certificate chain sent by the TLS server. This property is ready to read when the TLSCertValidate event is fired by the client component.

This property is read-only and not available at design time.

Please refer to the Certificate type for a complete list of fields.

TLSSettings Property (KMIPClient Class)

Manages TLS layer settings.

Syntax

public TLSSettings getTLSSettings();

Remarks

Use this property to tune up the TLS layer parameters.

This property is read-only.

Please refer to the TLSSettings type for a complete list of fields.

TrustedCertificates Property (KMIPClient Class)

A list of trusted certificates for chain validation.

Syntax

public CertificateList getTrustedCertificates();
public void setTrustedCertificates(CertificateList trustedCertificates);

Remarks

Use this property to supply a list of trusted certificates that might be needed for chain validation. An example of a scenario where you might want to do that is when root CA certificates are absent from the standard system locations (or when there are no standard system locations), and therefore should be supplied to the component manually.

The purpose of this certificate collection is largely the same as that of the Windows Trusted Root Certification Authorities system store.

Use this property with extreme care as it directly affects chain verifiability; a wrong certificate added to the trusted list may result in bad chains being accepted, and forfeited signatures being recognized as genuine. Only add certificates that originate from the parties that you know and trust.

This property is not available at design time.

Please refer to the Certificate type for a complete list of fields.

Username Property (KMIPClient Class)

The username to authenticate to the KMIP server.

Syntax

public String getUsername();
public void setUsername(String username);

Default Value

""

Remarks

Use this property to provide a username for authentication on the KMIP server.

The value assigned to this property is used for built-in user authentication provided by KMIP. If the KMIP server you are connecting to expects you to use HTTP basic or digest authentication, provide the credentials via the BaseURL property.

Activate Method (KMIPClient Class)

Activates the specified server object.

Syntax

public void activate(String objectId);

Remarks

Use this method to activate the object using its ObjectId. Activating the object makes it available for cryptographic operations.

This method is complementary to Deactivate that can be used to disable server-side objects.

Add Method (KMIPClient Class)

Imports a certificate to the KMIP server.

Syntax

public String add(boolean addPrivateKey, String group, boolean activate);

Remarks

Call this method to import a certificate to the KMIP server. Provide the certificate via Certificate property.

Use the Group parameter to supply a unique identifier for objects associated with this certificate. A typical KMIP server would store two or three objects per certificate - the certificate, its public key, and, if provided, its private key. The shared group identifier will make it easy to establish correspondence between the objects.

Set the AddPrivateKey parameter to true to import the private key (and create a corresponding KMIP object) together with the certificate. Use the Activate parameter to instruct the server to activate the new certificate-related objects immediately.

The method returns the unique identifier of the created certificate object. Check the AuxResult property to read the ID of the associated key object.

AddKey Method (KMIPClient Class)

Imports a key or keypair to the KMIP server.

Syntax

public String addKey(String group, boolean activate);

Remarks

Use this method to import a key or an asymmetric keypair to the KMIP server. Provide the key via the Key property.

Use the Group parameter to supply a unique identifier for objects associated with this key. Import of an asymmetric keypair may result in two objects being created on the server - the public key and the private key. The shared group identifier will make it easy to establish correspondence between the objects.

Use the Activate parameter to instruct the server to activate the new key objects immediately.

The method returns the unique identifier of the created key object. Check the AuxResult property to read the ID of the second object key component object, if expected.

Config Method (KMIPClient Class)

Sets or retrieves a configuration setting.

Syntax

public String config(String configurationString);

Remarks

Config is a generic method available in every class. It is used to set and retrieve configuration settings for the class.

These settings are similar in functionality to properties, but they are rarely used. In order to avoid "polluting" the property namespace of the class, access to these internal properties is provided through the Config method.

To set a configuration setting named PROPERTY, you must call Config("PROPERTY=VALUE"), where VALUE is the value of the setting expressed as a string. For boolean values, use the strings "True", "False", "0", "1", "Yes", or "No" (case does not matter).

To read (query) the value of a configuration setting, you must call Config("PROPERTY"). The value will be returned as a string.

CustomRequest Method (KMIPClient Class)

Performs a custom request to the server.

Syntax

public byte[] customRequest(byte[] data);

Remarks

Use this method to send a custom request to the KMIP server. Pass the serialized KMIP request data to the Data parameter. Any response returned back by the server is passed back to the application via the result of this method.

This method can be handy if you need to make a request of the kind that KMIPClient does not support at the moment.

Deactivate Method (KMIPClient Class)

Deactivates the specified server object.

Syntax

public void deactivate(String objectId);

Remarks

Use this method to deactivate the object using its ObjectId. Deactivated objects remain on the server but cannot be used for cryptographic operations. Use Remove method to delete objects from the server permanently.

This method is complementary to Activate that lets you enable ('activate') server objects.

Decrypt Method (KMIPClient Class)

Decrypts the provided data using a key stored on the KMIP server.

Syntax

public void decrypt(String objectId, String algorithm, byte[] IV, String blockMode, String paddingMethod, int tagLength);

Remarks

Use this method to decrypt data using the key with the specified ObjectId.

Provide the encrypted data via one of the Input* properties (InputFile, InputStream, or InputBytes). The decrypted data will be saved to one of the output properties.

Use the Algorithm, IV, BlockMode, PaddingMethod, and TagLength parameters to provide adjustments to the decryption algorithm. Not every call will require all of the adjustments. Asymmetric decryption calls (such as RSA) do not typically require parameters.

DoAction Method (KMIPClient Class)

Performs an additional action.

Syntax

public String doAction(String actionID, String actionParams);

Remarks

DoAction is a generic method available in every class. It is used to perform an additional action introduced after the product major release. The list of actions is not fixed, and may be flexibly extended over time.

The unique identifier (case insensitive) of the action is provided in the ActionID parameter.

ActionParams contains the value of a single parameter, or a list of multiple parameters for the action in the form of PARAM1=VALUE1;PARAM2=VALUE2;....

Common ActionIDs:

Encrypt Method (KMIPClient Class)

Encrypts the provided data using a key stored on the KMIP server.

Syntax

public void encrypt(String objectId, String algorithm, byte[] IV, String blockMode, String paddingMethod, int tagLength);

Remarks

Use this method to encrypt data using the key with the specified ObjectId. Provide the data to be encrypted via InputFile or InputStream. The encrypted data will be saved to OutputFile (or OutputStream).

Use optional Algorithm, IV, BlockMode, Padding, and TagLength parameters to adjust encryption flow. The values to be passed as these parameters depend on the encryption algorithm being used. Public key algorithms typically do not require these parameters.

Generate Method (KMIPClient Class)

Generates a new certificate on the KMIP server.

Syntax

public String generate(String publicKeyId, boolean activate);

Remarks

Use this method to generate a new certificate on the server. Set up the needed parameters of the certificate in the Certificate property. This property may contain a prepared certificate request.

An optional PublicKeyId parameter specifies the ID of the server-side public key object to base the certificate on.

The method returns a unique ID assigned to the new certificate object. Note that the certificate itself is not populated in the Certificate property: use Read to request it from the server.

GenerateKey Method (KMIPClient Class)

Generates a symmetric key or an asymmetric key pair on the KMIP server.

Syntax

public String generateKey(String keyAlgorithm, String scheme, String schemeParams, int keyBits, String group, boolean activate);

Remarks

Use KeyAlgorithm and KeyBits to indicate the desired algorithm and key length. Provide an group name of the new key via the Group parameter.

The method returns the ID assigned by the server to the new key object. This may differ from the one you supplied.

Note that the key itself is not populated in the Key property: use ReadKey to request it from the server.

List Method (KMIPClient Class)

Retrieves the list of objects of selected types from the server.

Syntax

public void list(int objectTypes, String filter, int offsetItems, int maximumItems, boolean freshOnly);

Remarks

ObjectTypes is expected to contain a bit mask according to which objects of one or more types can be selected. The ObjectTypes of 0 implies that there is no mask, and all objects should be returned. Possible values:

Use OffsetItems and MaximumItems to narrow down your search. Use Filter to specify the object properties that you would like to be requested: an empty value or an asterisk tells the client to request all the properties of the listed objects, whereas the objectid filter only results in the object IDs being returned.

Read Method (KMIPClient Class)

Downloads a certificate from the KMIP server.

Syntax

public void read(String objectId);

Remarks

Use this method to download a certificate object from the server. Specify the ID of the certificate object via the ObjectId parameter.

Upon completion, the certificate is populated in the Certificate property.

ReadAttribute Method (KMIPClient Class)

Requests an attribute from an object.

Syntax

public String readAttribute(String objectId, String name);

Remarks

Use this method to request an attribute defined by the Name parameter for a server-side object indicated by its ObjectId.

The list of attributes supported by KMIP is available here: KMIP v1.3, paragraph 3

ReadKey Method (KMIPClient Class)

Downloads a key object from the KMIP server.

Syntax

public void readKey(String objectId);

Remarks

Use this method to retrieve a key object from the server. Public, private, and secret key IDs can be passed to this method, but only non-sensitive parameters of the private and secret keys will be returned.

The key data is populated in the Key property.

ReadObject Method (KMIPClient Class)

Requests object information from the KMIP server.

Syntax

public void readObject(String objectId);

Remarks

Use this method to request information about a server-side object by its unique ObjectId.

If ObjectId represents a valid certificate or key, the details of the object are populated in Certificate or Key object respectively.

Remove Method (KMIPClient Class)

Removes the specified object from the server.

Syntax

public void remove(String objectId);

Remarks

Use this method to delete the object specified by its ObjectId from the KMIP server permanently.

If you would like to disable the object but keep it on the server permanently, use Deactivate method instead.

Reset Method (KMIPClient Class)

Resets the class settings.

Syntax

public void reset();

Remarks

Reset is a generic method available in every class.

SetAttribute Method (KMIPClient Class)

Sets an attribute of an existing server-side object.

Syntax

public void setAttribute(String objectId, String name, String value, boolean delete);

Remarks

Use this method to set an attribute of a server-side object.

The list of attributes supported by KMIP is available here: KMIP v1.3, paragraph 3

Set Delete parameter to true to delete the attribute instead of setting it.

SetRequestBytes Method (KMIPClient Class)

Replaces the data that has been prepared for sending out.

Syntax

public void setRequestBytes(byte[] value);

Remarks

Call this method from your Request event handler to alter the request data being sent to the server. This method method may be handy if you need to adjust the request data that the client has prepared manually before sending it out.

SetResponseBytes Method (KMIPClient Class)

Alters the data received from the server in a response.

Syntax

public void setResponseBytes(byte[] value);

Remarks

Call this method from your Response event handler to alter the data received from the server before passing it for processing. This method may be handy if you would like to adjust data received from the server - for example, to fix an error in the server's response.

Sign Method (KMIPClient Class)

Signs the data using a key on the KMIP server.

Syntax

public void sign(String objectId, String algorithm, String paddingMethod, String hashAlgorithm, boolean inputIsHash);

Remarks

Use this method to sign the data using the key with the specified ObjectId. Pass the data to be signed via InputFile (or InputStream) property. The resulting signed data will be written to OutputFile (or OutputStream).

The Algorithm and HashAlgorithm parameters should specify the algorithms to be used for the cryptographic signing. Set InputIsHash to true to indicate that you are passing the hash of the data instead of the actual data.

If any of Algorithm or HashAlgorithm are omitted, the server will use the default algorithm associated with the key. Note that this is not always possible, so make sure your requests carry as much details as possible.

The following key algorithms are supported: RSA, EC, ECDSA, ECDH, EDDSA, DSA, ELGAMAL, DH, SRP.

The following hash algorithms are supported: SHA1, SHA256, SHA384, SHA512, SHA224, WHIRLPOOL, POLY1305, SHA3_224, SHA3_256, SHA3_384, SHA3_512. Note that servers may not support all of these algorithms.

Verify Method (KMIPClient Class)

Verifies digitally signed data.

Syntax

public void verify(String objectId, String algorithm, String paddingMethod, String hashAlgorithm, boolean inputIsHash);

Remarks

Use this method to verify the integrity of the signature using a server-side key.

Please provide the signature via InputFile (or InputStream / InputBytes) property. For detached signatures, please also provide the data that was signed via DataFile (or DataStream / DataBytes) property.

Provide additional parameters of the operation:

• Algorithm: the signature algorithm (e.g. sha256WithRSAEncryption).
• PaddingMethod: the padding method used (e.g. PSS).
• HashAlgorithm: the hash algorithm to use for signature verification (e.g. SHA256).
• InputIsHash: specifies whether the data provided via DataFile or similar property contains the data or its message digest.

Error Event (KMIPClient Class)

Provides information about errors during KMIP operations.

Syntax

public class DefaultKMIPClientEventListener implements KMIPClientEventListener {
  ...
  public void error(KMIPClientErrorEvent e) {}
  ...
}

public class KMIPClientErrorEvent {
  public int errorCode;
  public String description;
}

Remarks

This event is fired in case of exceptional conditions occured during KMIP operations.

ErrorCode contains an error code and Description contains a textual description of the error.

ExternalSign Event (KMIPClient Class)

Handles remote or external signing initiated by the SignExternal method or other source.

Syntax

public class DefaultKMIPClientEventListener implements KMIPClientEventListener {
  ...
  public void externalSign(KMIPClientExternalSignEvent e) {}
  ...
}

public class KMIPClientExternalSignEvent {
  public String operationId;
  public String hashAlgorithm;
  public String pars;
  public String data;
  public String signedData; //read-write
}

Remarks

Assign a handler to this event if you need to delegate a low-level signing operation to an external, remote, or custom signing engine. Depending on the settings, the handler will receive a hashed or unhashed value to be signed.

The event handler must pass the value of Data to the signer, obtain the signature, and pass it back to the class via the SignedData parameter.

OperationId provides a comment about the operation and its origin. It depends on the exact class being used, and may be empty. HashAlgorithm specifies the hash algorithm being used for the operation, and Pars contains algorithm-dependent parameters.

The class uses base16 (hex) encoding for the Data, SignedData, and Pars parameters. If your signing engine uses a different input and output encoding, you may need to decode and/or encode the data before and/or after the signing.

A sample MD5 hash encoded in base16: a0dee2a0382afbb09120ffa7ccd8a152 - lower case base16 A0DEE2A0382AFBB09120FFA7CCD8A152 - upper case base16

A sample event handler that uses the .NET RSACryptoServiceProvider class may look like the following: signer.OnExternalSign += (s, e) => { var cert = new X509Certificate2("cert.pfx", "", X509KeyStorageFlags.Exportable); var key = (RSACryptoServiceProvider)cert.PrivateKey; var dataToSign = e.Data.FromBase16String(); var signedData = key.SignHash(dataToSign, "2.16.840.1.101.3.4.2.1"); e.SignedData = signedData.ToBase16String(); };

Notification Event (KMIPClient Class)

This event notifies the application about an underlying control flow event.

Syntax

public class DefaultKMIPClientEventListener implements KMIPClientEventListener {
  ...
  public void notification(KMIPClientNotificationEvent e) {}
  ...
}

public class KMIPClientNotificationEvent {
  public String eventID;
  public String eventParam;
}

Remarks

The class fires this event to let the application know about some event, occurrence, or milestone in the class. For example, it may fire to report completion of the document processing. The list of events being reported is not fixed, and may be flexibly extended over time.

The unique identifier of the event is provided in the EventID parameter. EventParam contains any parameters accompanying the occurrence. Depending on the type of the class, the exact action it is performing, or the document being processed, one or both may be omitted.

This class can fire this event with the following EventID values:

Request Event (KMIPClient Class)

KMIPClient fires this event to notify the user about the request being sent to the KMIP server.

Syntax

public class DefaultKMIPClientEventListener implements KMIPClientEventListener {
  ...
  public void request(KMIPClientRequestEvent e) {}
  ...
}

public class KMIPClientRequestEvent {
  public byte[] requestData;
}

Remarks

Subscribe to this event to be notified about individual requests sent by the KMIP client to the server.

The RequestData parameter contains the encoded KMIP request. You can alter what is being sent by providing custom request bytes via the SetRequestBytes method.

Response Event (KMIPClient Class)

KMIPClient uses this event to notify the user about the response being received.

Syntax

public class DefaultKMIPClientEventListener implements KMIPClientEventListener {
  ...
  public void response(KMIPClientResponseEvent e) {}
  ...
}

public class KMIPClientResponseEvent {
  public byte[] responseData;
}

Remarks

Subscribe to this event to be notified about KMIP protocol responses that the KMIP client receives from the server.

The ResponseData parameter contains the encoded body of the response. Use SetResponseBytes to alter the response data received before it is processed by the client.

TLSCertNeeded Event (KMIPClient Class)

Fires when a remote TLS party requests a client certificate.

Syntax

public class DefaultKMIPClientEventListener implements KMIPClientEventListener {
  ...
  public void TLSCertNeeded(KMIPClientTLSCertNeededEvent e) {}
  ...
}

public class KMIPClientTLSCertNeededEvent {
  public String host;
  public String CANames;
}

Remarks

This event fires to notify the implementation that a remote TLS server has requested a client certificate. The Host parameter identifies the host that makes a request, and the CANames parameter (optional, according to the TLS spec) advises on the accepted issuing CAs.

Use the TLSClientChain property in response to this event to provide the requested certificate. Please make sure the client certificate includes the associated private key. Note that you may set the certificates before the connection without waiting for this event to fire.

This event is preceded by the TLSHandshake event for the given host and, if the certificate was accepted, succeeded by the TLSEstablished event.

TLSCertValidate Event (KMIPClient Class)

This event is fired upon receipt of the TLS server's certificate, allowing the user to control its acceptance.

Syntax

public class DefaultKMIPClientEventListener implements KMIPClientEventListener {
  ...
  public void TLSCertValidate(KMIPClientTLSCertValidateEvent e) {}
  ...
}

public class KMIPClientTLSCertValidateEvent {
  public String serverHost;
  public String serverIP;
  public boolean accept; //read-write
}

Remarks

This event is fired during a TLS handshake. Use the TLSServerChain property to access the certificate chain. In general, classes may contact a number of TLS endpoints during their work, depending on their configuration.

Accept is assigned in accordance with the outcome of the internal validation check performed by the class, and can be adjusted if needed.

TLSEstablished Event (KMIPClient Class)

Fires when a TLS handshake with Host successfully completes.

Syntax

public class DefaultKMIPClientEventListener implements KMIPClientEventListener {
  ...
  public void TLSEstablished(KMIPClientTLSEstablishedEvent e) {}
  ...
}

public class KMIPClientTLSEstablishedEvent {
  public String host;
  public String version;
  public String ciphersuite;
  public byte[] connectionId;
  public boolean abort; //read-write
}

Remarks

The class uses this event to notify the application about a successful completion of a TLS handshake.

The Version, Ciphersuite, and ConnectionId parameters indicate the security parameters of the new connection. Use the Abort parameter if you need to terminate the connection at this stage.

TLSHandshake Event (KMIPClient Class)

Fires when a new TLS handshake is initiated, before the handshake commences.

Syntax

public class DefaultKMIPClientEventListener implements KMIPClientEventListener {
  ...
  public void TLSHandshake(KMIPClientTLSHandshakeEvent e) {}
  ...
}

public class KMIPClientTLSHandshakeEvent {
  public String host;
  public boolean abort; //read-write
}

Remarks

The class uses this event to notify the application about the start of a new TLS handshake to Host. If the handshake is successful, this event will be followed by the TLSEstablished event. If the server chooses to request a client certificate, the TLSCertNeeded event will also be fired.

TLSPSK Event (KMIPClient Class)

Notifies the application about the PSK key exchange.

Syntax

public class DefaultKMIPClientEventListener implements KMIPClientEventListener {
  ...
  public void TLSPSK(KMIPClientTLSPSKEvent e) {}
  ...
}

public class KMIPClientTLSPSKEvent {
  public String host;
  public String hint;
}

Remarks

The class fires this event to notify the application about the beginning of TLS-PSK key exchange with Host. The Hint parameter may be used by the server to identify the key or service to use. Use the PreSharedKey field of TLSSettings to provide the pre-shared key to the component.

TLSShutdown Event (KMIPClient Class)

Reports the graceful closure of a TLS connection.

Syntax

public class DefaultKMIPClientEventListener implements KMIPClientEventListener {
  ...
  public void TLSShutdown(KMIPClientTLSShutdownEvent e) {}
  ...
}

public class KMIPClientTLSShutdownEvent {
  public String host;
}

Remarks

This event notifies the application about the closure of an earlier established TLS connection. Note that only graceful connection closures are reported.

Certificate Type

Encapsulates an individual X.509 certificate.

Remarks

This type keeps and provides access to X.509 certificate details.

Fields

Constructors

public Certificate( bytes,  startIndex,  count,  password);

public Certificate( certBytes,  certStartIndex,  certCount,  keyBytes,  keyStartIndex,  keyCount,  password);

public Certificate( bytes,  startIndex,  count);

public Certificate( path,  password);

public Certificate( certPath,  keyPath,  password);

public Certificate( path);

public Certificate( stream);

public Certificate( stream,  password);

public Certificate( certStream,  keyStream,  password);

public Certificate();

CRL Type

Represents a Certificate Revocation List.

Remarks

CRLs store information about revoked certificates, i.e., certificates that have been identified as invalid by their issuing certificate authority (CA) for any number of reasons.

Each CRL object lists certificates from a single CA and identifies them by their serial numbers. A CA may or may not publish a CRL, may publish several CRLs, or may publish the same CRL in multiple locations.

Unlike OCSP responses, CRLs only list certificates that have been revoked. They do not list certificates that are still valid.

Fields

Constructors

public CRL( bytes,  startIndex,  count);

public CRL( location);

public CRL( stream);

public CRL();

CryptoKey Type

This container represents a cryptographic key.

Remarks

This type is a universal placeholder for cryptographic keys.

Fields

Constructors

public CryptoKey();

ExternalCrypto Type

Specifies the parameters of external cryptographic calls.

Remarks

External cryptocalls are used in a Distributed Cryptography (DC) subsystem, which allows the delegation of security operations to the remote agent. For instance, it can be used to compute the signature value on the server, while retaining the client's private key locally.

Fields

Constructors

public ExternalCrypto();

KMIPObject Type

A container representing a KMIP object.

Remarks

KMIPObject represents an object before it is committed to the KMIP server or after it has been read from there. Certificates, certificate requests, keys, and data objects are examples of KMIP objects.

Fields

Constructors

public KMIPObject();

public KMIPObject( AObjectId);

OCSPResponse Type

Represents a single OCSP response originating from an OCSP responder.

Remarks

OCSP is a protocol that allows verification of certificate status in real-time, and is an alternative to Certificate Revocation Lists (CRLs).

An OCSP response is a snapshot of the certificate status at a given time.

Fields

Constructors

public OCSPResponse( bytes,  startIndex,  count);

public OCSPResponse( location);

public OCSPResponse( stream);

public OCSPResponse();

ProxySettings Type

A container for proxy server settings.

Remarks

This type exposes a collection of properties for tuning up the proxy server configuration.

Fields

Constructors

public ProxySettings();

SocketSettings Type

A container for the socket settings.

Remarks

This type is a container for socket-layer parameters.

Fields

Constructors

public SocketSettings();

TLSConnectionInfo Type

Contains information about a network connection.

Remarks

Use this property to check various details of the network connection. These include the total amounts of data transferred, the availability of TLS, and its parameters.

Fields

Constructors

public TLSConnectionInfo();

TLSSettings Type

A container for TLS connection settings.

Remarks

The TLS (Transport Layer Security) protocol provides security for information exchanged over insecure connections such as TCP/IP.

Fields

Constructors

public TLSSettings();

Config Settings (KMIPClient Class)

The class accepts one or more of the following configuration settings. Configuration settings are similar in functionality to properties, but they are rarely used. In order to avoid "polluting" the property namespace of the class, access to these internal properties is provided through the Config method.

KMIPClient Config Settings

Base Config Settings

Trappable Errors (KMIPClient Class)

KMIPClient Errors