PyKMIP: Python Implementation of the Key Management Interoperability Protocol

PyKMIP is a Python implementation of the OASIS Key Management Interoperability Protocol (KMIP). It allows client and server applications to communicate using a standardized encoding for key management operations.

Key capabilities include:

• Full CRUD lifecycle: Create, Read, Update, and Delete operations for key management.
• Metadata management: Managing object metadata.
• Cryptographic operations: Conducting cryptographic tasks via the protocol.
• Supported object types: Symmetric/asymmetric encryption keys, passwords/passphrases, certificates, and opaque data blobs.

PyKMIP is a Python implementation of the Key Management Interoperability Protocol (KMIP), an OASIS communication standard. It enables client and server applications to communicate key management operations and data.

Key Capabilities:

• Lifecycle Management: Supports the full CRUD (Create, Read, Update, Delete) lifecycle for keys.
• Metadata & Cryptography: Provides operations for managing object metadata and conducting cryptographic operations.
• Supported Object Types:
  • Symmetric and asymmetric encryption keys
  • Passwords and passphrases
  • Certificates
  • Opaque data blobs

The PyKMIP server implements a subset of the KMIP specification. All cryptographic functions are powered by the pyca/cryptography library and OpenSSL. If the underlying backend lacks support for a specific algorithm or feature, the PyKMIP server will not support it.

Supported operations include:

• Lifecycle Management: Activate, Destroy, Revoke.
• Key Management: Create (symmetric), CreateKeyPair (asymmetric), DeriveKey, Register.
• Data Operations: Encrypt, Decrypt, Sign, SignatureVerify, MAC.
• Attribute Management: GetAttributes, GetAttributeList, Get, SetAttribute, ModifyAttribute, DeleteAttribute.
• Discovery & Query: Locate, Query, DiscoverVersions.

The PyKMIP server manages all data (keys, certificates, etc.) via SQLAlchemy using a SQLite backend.

• Persistence: Managed objects are stored in a flat file at the location specified by database_path (defaults to /tmp/pykmip.database). If this file is deleted, all stored objects are lost.
• Upgrades: There is no upgrade path for the data model. If the server's data model is updated, running it against an older pykmip.database file will generate errors.

A capability_information dictionary contains details about the KMIP server's capabilities, typically retrieved via a Query operation. It includes boolean flags for features like streaming, asynchronous operations, and attestation, as well as enums for modes like unwrap_mode and destroy_action.

from kmip import enums

capability_information = {
    'streaming_capability': False,
    'asynchronous_capability': False,
    'attestation_capability': False,
    'unwrap_mode': enums.UnwrapMode.PROCESSED,
    'destroy_action': enums.DestroyAction.DELETED,
    'shredding_algorithm': enums.ShreddingAlgorithm.UNSUPPORTED,
    'rng_mode': enums.RNGMode.SHARED_INSTANTIATION,
    'batch_undo_capability': False,
    'batch_continue_capability': False,
    'quantum_safe_capability': False
}

The extension_information dictionary contains details about specific KMIP specification extensions supported by a server, often returned during a Query operation. It includes fields like extension_name, extension_tag, and extension_type.

>>> from kmip import enums
        >>> extension_information = {
        ...     'extension_name': 'ACME LOCATION',
        ...     'extension_tag': 0x0054aa01,
        ...     'extension_type': 0x00000007
        ... }

Access control for server objects is managed via operation policies. An operation policy maps a combination of object type and operation to a specific permission. When a client performs an operation, the server identifies the client, looks up the object, and checks the object's assigned operation policy to determine if the action is permitted.

Supported Permissions

• Allow All: Any authenticated client can perform the operation on any object of that type.
• Allow Owner: Only the client identified as the owner of the object can perform the operation.
• Disallow All: No client can perform the operation (used for static public objects or server-only tasks).

Note: If an operation policy does not explicitly cover a specific object type or operation, the server defaults to Disallow All for safety.

A key_wrapping_specification dictionary defines how an object should be cryptographically wrapped. This is used as a parameter for the Get operation to retrieve wrapped objects.

It includes the following keys:

• wrapping_method (enum): The method used.
• encryption_key_information (dict): Information about the encryption key.
• mac_signature_key_information (dict): Information about the MAC signature key.
• attribute_names (list): A list of attribute names to include.
• encoding_option (enum): The encoding option used.

from kmip import enums
key_wrapping_specification = {
    'wrapping_method': enums.WrappingMethod.ENCRYPT,
    'encryption_key_information': {...},
    'attribute_names': [
        'Cryptographic Algorithm',
        'Cryptographic Length'
    ]
}

The name is a string specifying the name of a managed object stored by the server. It can be used alongside unique_identifier to identify an object or as a filter with the Locate operation.

name_type is an enumeration specifying the type of name value used in a name attribute structure.

from kmip import enums
enums.NameType.URI

The derivation_parameters dictionary contains settings used during DeriveKey operations. It includes keys for cryptographic parameters, initialization vectors, derivation data, salt, and iteration counts.

>>> from kmip import enums
        >>> derivation_parameters = {
        ...     'cryptographic_parameters': {...},
        ...     'initialization_vector': b'\x01\x02\x03\x04',
        ...     'derivation_data': b'\xFF\xFF\xFF\xFF',
        ...     'salt': b'\x00\x00\xFF\xFF',
        ...     'iteration_count': 1000
        ... }

Cryptographic parameters are defined using a dictionary containing settings for cryptographic operations. Common keys include block_cipher_mode, padding_method, random_iv, and initial_counter_value.

>>> from kmip import enums
        >>> cryptographic_parameters = {
        ...     'block_cipher_mode': enums.BlockCipherMode.CTR,
        ...     'padding_method': enums.PaddingMethod.PKCS5,
        ...     'random_iv': False,
        ...     'initial_counter_value': 0
        ... }

The encryption_key_information dictionary contains details about the encryption key used for key wrapping. It requires a unique_identifier (string) and a cryptographic_parameters (dict).

>>> from kmip import enums
        >>> encryption_key_information = {
        ...     'unique_identifier': '123e4567-e89b-12d3-a456-426655440000',
        ...     'cryptographic_parameters': {...}
        ... }