KMIP support by Cosmian KMS¶
This page summarizes the KMIP coverage in Cosmian KMS. The support status is
derived from the actual implementation in crate/server/src/core/operations.
Legend:
- ✅ Fully supported
- ❌ Not implemented
- 🚫 Deprecated
- 🚧 Partially supported (not used here)
- N/A Not applicable
KMIP coverage¶
Messages¶
| Message | Current |
|---|---|
| Request Message | ✅ |
| Response Message | ✅ |
Operations¶
| Operation | Current |
|---|---|
| Create | ✅ |
| Create Key Pair | ✅ |
| Register | ✅ |
| Re-key | ✅ |
| Re-key Key Pair | ✅ |
| DeriveKey | ✅ |
| Certify | ✅ |
| Re-certify | ❌ |
| Locate | ✅ |
| Check | ❌ |
| Get | ✅ |
| Get Attributes | ✅ |
| Get Attribute List | ❌ |
| Add Attribute | ✅ |
| Set Attribute (Modify) | ✅ |
| Delete Attribute | ✅ |
| Obtain Lease | ❌ |
| Get Usage Allocation | ❌ |
| Activate | ✅ |
| Revoke | ✅ |
| Destroy | ✅ |
| Archive | ❌ |
| Recover | ❌ |
| Validate | ✅ |
| Query | ✅ |
| Cancel | ❌ |
| Poll | ❌ |
| Notify | ❌ |
| Put | ❌ |
| Discover Versions | ✅ |
| Encrypt | ✅ |
| Decrypt | ✅ |
| Sign | ✅ |
| Signature Verify | ✅ |
| MAC | ✅ |
| MAC Verify | ❌ |
| RNG Retrieve | ❌ |
| RNG Seed | ❌ |
| Hash | ✅ |
| Create Split Key | ❌ |
| Join Split Key | ❌ |
| Export | ✅ |
| Import | ✅ |
Methodology¶
- Operations shown as ✅ are backed by a Rust implementation file under
crate/server/src/core/operations. - If no implementation file exists for an operation, it is marked ❌.
- This documentation is auto-generated by analyzing the source code.
If you spot a mismatch or want to extend coverage, please open an issue or PR.
Managed Objects¶
| Managed Object | Current |
|---|---|
| Certificate | ✅ |
| Symmetric Key | ✅ |
| Public Key | ✅ |
| Private Key | ✅ |
| Split Key | ❌ |
| Template | 🚫 |
| Secret Data | ✅ |
| Opaque Object | ✅ |
| PGP Key | ❌ |
Notes:
- Opaque Object import support is present (see
import.rs). - PGP Key types appear in digest and attribute handling but full object import/register is not implemented, hence ❌.
Base Objects¶
| Base Object | Current |
|---|---|
| Attribute | ✅ |
| Credential | ✅ |
| Key Block | ✅ |
| Key Value | ✅ |
| Key Wrapping Data | ✅ |
| Key Wrapping Specification | ✅ |
| Transparent Key Structures | ✅ |
| Template-Attribute Structures | ✅ |
| Extension Information | ✅ |
| Data | ❌ |
| Data Length | ❌ |
| Signature Data | ❌ |
| MAC Data | ❌ |
| Nonce | ✅ |
| Correlation Value | ❌ |
| Init Indicator | ❌ |
| Final Indicator | ❌ |
| RNG Parameter | ✅ |
| Profile Information | ✅ |
| Validation Information | ✅ |
| Capability Information | ✅ |
| Authenticated Encryption Additional Data | ✅ |
| Authenticated Encryption Tag | ✅ |
Notes:
- AEAD Additional Data and Tag are supported in encrypt/decrypt APIs.
- Nonce and RNG Parameter are used by symmetric encryption paths.
Transparent Key Structures¶
| Structure | Current |
|---|---|
| Symmetric Key | ✅ |
| DSA Private/Public Key | ❌ |
| RSA Private/Public Key | ✅ |
| DH Private/Public Key | ❌ |
| ECDSA Private/Public Key | ✅ |
| ECDH Private/Public Key | ❌ |
| ECMQV Private/Public | ❌ |
| EC Private/Public | ✅ |
Note: EC/ECDSA support is present; DH/DSA/ECMQV are not implemented.
Attributes¶
| Attribute | Current |
|---|---|
| Activation Date | ✅ |
| Alternative Name | ❌ |
| Always Sensitive | ❌ |
| Application Specific Information | ❌ |
| Archive Date | ❌ |
| Attribute Index | ❌ |
| Certificate Attributes | ❌ |
| Certificate Identifier | 🚫 |
| Certificate Issuer | 🚫 |
| Certificate Length | ❌ |
| Certificate Subject | 🚫 |
| Certificate Type | ✅ |
| Comment | ❌ |
| Compromise Date | ❌ |
| Compromise Occurrence Date | ✅ |
| Contact Information | ❌ |
| Critical | ❌ |
| Cryptographic Algorithm | ✅ |
| Cryptographic Domain Parameters | ✅ |
| Cryptographic Length | ✅ |
| Cryptographic Parameters | ✅ |
| Cryptographic Usage Mask | ✅ |
| Deactivation Date | ✅ |
| Description | ❌ |
| Destroy Date | ❌ |
| Digest | ✅ |
| Digital Signature Algorithm | ✅ |
| Extractable | ❌ |
| Fresh | ❌ |
| Initial Date | ✅ |
| Key Format Type | ❌ |
| Key Value Location | ❌ |
| Key Value Present | ❌ |
| Last Change Date | ✅ |
| Lease Time | ❌ |
| Link | ✅ |
| Name | ❌ |
| Never Extractable | ❌ |
| Nist Key Type | ❌ |
| Object Group | ❌ |
| Object Group Member | ❌ |
| Object Type | ✅ |
| Opaque Data Type | ❌ |
| Operation Policy Name | 🚫 |
| Original Creation Date | ✅ |
| PKCS#12 Friendly Name | ❌ |
| Process Start Date | ❌ |
| Protect Stop Date | ❌ |
| Protection Level | ❌ |
| Protection Period | ❌ |
| Protection Storage Masks | ❌ |
| Quantum Safe | ❌ |
| Random Number Generator | ❌ |
| Revocation Reason | ✅ |
| Rotate Date | ❌ |
| Rotate Generation | ❌ |
| Rotate Interval | ❌ |
| Rotate Latest | ❌ |
| Rotate Name | ❌ |
| Rotate Offset | ❌ |
| Sensitive | ✅ |
| Short Unique Identifier | ❌ |
| State | ✅ |
| Unique Identifier | ✅ |
| Usage Limits | ❌ |
| Vendor Attribute | ❌ |
| X.509 Certificate Identifier | ✅ |
| X.509 Certificate Issuer | ✅ |
| X.509 Certificate Subject | ✅ |
Notes:
- GetAttributes returns a union of metadata attributes and those embedded in KeyBlock structures.
- “Vendor Attributes” are available via the Cosmian vendor namespace and are accessible via GetAttributes.
- A ✅ indicates the attribute is used or updated by at least one KMIP operation implementation in
crate/server/src/core/operations, explicitly excluding the attribute-only handlers (Add/Delete/Get/Set Attribute).