View mode

User manual

cosmian¶

Command Line Interface used to manage the KMS and Findex servers.

If any assistance is needed, please either visit the Cosmian technical documentation at https://docs.cosmian.com or contact the Cosmian support team on Discord https://discord.com/invite/7kPMNtHpnz

Usage¶

cosmian <subcommand> [options]

Arguments¶

--conf-path [-c] <CONF_PATH> Configuration file location

--kms-url <KMS_URL> The URL of the KMS

--kms-accept-invalid-certs <KMS_ACCEPT_INVALID_CERTS> Allow to connect using a self-signed cert or untrusted cert chain

Possible values: "true", "false"

--kms-print-json <KMS_PRINT_JSON> Output the KMS JSON KMIP request and response. This is useful to understand JSON POST requests and responses required to programmatically call the KMS on the /kmip/2_1 endpoint

Possible values: "true", "false"

--findex-url <FINDEX_URL> The URL of the Findex server

--findex-accept-invalid-certs <FINDEX_ACCEPT_INVALID_CERTS> Allow to connect using a self-signed cert or untrusted cert chain

Possible values: "true", "false"

Subcommands¶

kms [1] Handle KMS actions

findex [2] Handle Findex server actions

markdown [3] Action to auto-generate doc in Markdown format Run cargo run --bin cosmian -- markdown documentation/docs/cli/main_commands.md

1 cosmian kms¶

Handle KMS actions

Usage¶

cosmian kms <subcommand>

Subcommands¶

access-rights [1.1] Manage the users’ access rights to the cryptographic objects

attributes [1.2] Get/Set/Delete the KMIP object attributes

bench [1.3] Run a set of benches to check the server performance

cc [1.4] Manage Covercrypt keys and policies. Rotate attributes. Encrypt and decrypt data

certificates [1.5] Manage certificates. Create, import, destroy and revoke. Encrypt and decrypt data

ec [1.6] Manage elliptic curve keys. Encrypt and decrypt data using ECIES

google [1.7] Manage google elements. Handle key pairs and identities from Gmail API

locate [1.8] Locate cryptographic objects inside the KMS

login [1.9] Login to the Identity Provider of the KMS server using the OAuth2 authorization code flow.

logout [1.10] Logout from the Identity Provider.

hash [1.11] Hash arbitrary data.

mac [1.12] Hash arbitrary data with a MAC key.

new-database [1.13] Initialize a new user encrypted database and return the secret (SQLCipher only).

rsa [1.14] Manage RSA keys. Encrypt and decrypt data using RSA keys

server-version [1.15] Print the version of the server

sym [1.16] Manage symmetric keys. Encrypt and decrypt data

1.1 cosmian kms access-rights¶

Manage the users’ access rights to the cryptographic objects

Usage¶

cosmian kms access-rights <subcommand>

Subcommands¶

grant [1.1.1] Grant another user one or multiple access rights to an object

revoke [1.1.2] Revoke another user one or multiple access rights to an object

list [1.1.3] List the access rights granted on an object to other users

owned [1.1.4] List the objects owned by the calling user

obtained [1.1.5] List the access rights obtained by the calling user

1.1.1 cosmian kms access-rights grant¶

Grant another user one or multiple access rights to an object

Usage¶

cosmian kms access-rights grant [options] <USER> <OBJECT_UID> <OPERATIONS>...

Arguments¶

<USER> The user identifier to allow

<OBJECT_UID> The object unique identifier stored in the KMS

<OPERATIONS> The operations to grant (create, get, encrypt, decrypt, import, revoke, locate, rekey, destroy)

1.1.2 cosmian kms access-rights revoke¶

Revoke another user one or multiple access rights to an object

Usage¶

cosmian kms access-rights revoke [options] <USER> <OBJECT_UID> <OPERATIONS>...

Arguments¶

<USER> The user to revoke access to

<OBJECT_UID> The object unique identifier stored in the KMS

<OPERATIONS> The operations to revoke (create, get, encrypt, decrypt, import, revoke, locate, rekey, destroy)

1.1.3 cosmian kms access-rights list¶

List the access rights granted on an object to other users

Usage¶

cosmian kms access-rights list [options] <OBJECT_UID>

Arguments¶

<OBJECT_UID> The object unique identifier

1.1.4 cosmian kms access-rights owned¶

List the objects owned by the calling user

Usage¶

cosmian kms access-rights owned

1.1.5 cosmian kms access-rights obtained¶

List the access rights obtained by the calling user

Usage¶

cosmian kms access-rights obtained

1.2 cosmian kms attributes¶

Get/Set/Delete the KMIP object attributes

Usage¶

cosmian kms attributes <subcommand>

Subcommands¶

get [1.2.1] Get the KMIP object attributes and tags.

set [1.2.2] Set the KMIP object attributes.

delete [1.2.3] Delete the KMIP object attributes.

1.2.1 cosmian kms attributes get¶

Get the KMIP object attributes and tags.

Usage¶

cosmian kms attributes get [options]

Arguments¶

--id [-i] <ID> The unique identifier of the cryptographic object. If not specified, tags should be specified

--tag [-t] <TAG> Tag to use to retrieve the key when no key id is specified. To specify multiple tags, use the option multiple times

--attribute [-a] <ATTRIBUTE> The attributes or KMIP-tags to retrieve. To specify multiple attributes, use the option multiple times. If not specified, all possible attributes are returned.

--link-type [-l] <LINK_TYPE> Filter on retrieved links. Only if KMIP tag LinkType is used in attribute parameter. To specify multiple attributes, use the option multiple times. If not specified, all possible link types are returned.

Possible values: "certificate", "public-key", "private-key", "derivation-base-object", "derived-key", "replacement-object", "replaced-object", "parent", "child", "previous", "next", "pkcs12-certificate", "pkcs12-password", "wrapping-key"

--output-file [-o] <OUTPUT_FILE> An optional file where to export the attributes. The attributes will be in JSON TTLV format.

1.2.2 cosmian kms attributes set¶

Set the KMIP object attributes.

Usage¶

cosmian kms attributes set [options]

Arguments¶

--id [-i] <ID> The unique identifier of the cryptographic object. If not specified, tags should be specified

--tag [-t] <TAG> Tag to use to retrieve the key when no key id is specified. To specify multiple tags, use the option multiple times

--activation-date [-d] <ACTIVATION_DATE> Set the activation date of the key. Epoch time (or Unix time) in milliseconds

--cryptographic-algorithm [-a] <CRYPTOGRAPHIC_ALGORITHM> The cryptographic algorithm used by the key

Possible values: "aes", "rsa", "ecdsa", "ecdh", "ec", "chacha20", "chacha20-poly1305", "sha3224", "sha3256", "sha3384", "sha3512", "ed25519", "ed448", "covercrypt", "covercrypt-bulk"

--cryptographic-length <CRYPTOGRAPHIC_LENGTH> The length of the cryptographic key

--key-usage [-u] <KEY_USAGE> The key usage. Add multiple times to specify multiple key usages

Possible values: "sign", "verify", "encrypt", "decrypt", "wrap-key", "unwrap-key", "mac-generate", "mac-verify", "derive-key", "key-agreement", "certificate-sign", "crl-sign", "authenticate", "unrestricted"

--public-key-id <PUBLIC_KEY_ID> The link to the corresponding public key id if any

--private-key-id <PRIVATE_KEY_ID> The link to the corresponding private key id if any

--certificate-id <CERTIFICATE_ID> The link to the corresponding certificate id if any

--p12-id <PKCS12_CERTIFICATE_ID> The link to the corresponding PKCS12 certificate id if any

--p12-pwd <PKCS12_PASSWORD_CERTIFICATE> The link to the corresponding PKCS12 password certificate if any

--parent-id <PARENT_ID> The link to the corresponding parent id if any

--child-id <CHILD_ID> The link to the corresponding child id if any

--vendor-identification [-v] <VENDOR_IDENTIFICATION> The vendor identification

--attribute-name [-n] <ATTRIBUTE_NAME> The attribute name

--attribute-value <ATTRIBUTE_VALUE> The attribute value (in hex format)

1.2.3 cosmian kms attributes delete¶

Delete the KMIP object attributes.

Usage¶

cosmian kms attributes delete [options]