Proposal to Update KMIP State Model Addition of Suspended, Revoked and Shredded key states

Notes on the State Model A device is not required to support the full state model Clients need to conform and honor a minimum of two states Active and destroyed or shredded Servers should support a full model to ensure interoperability Based on individual use cases it may be required to document which states a profile will make use of if the full model is not supported Not all objects stored in a KMIP server will make use of states and profiles should define at least three states (active and destroyed or shredded) State models should be defined in profiles if they do not require the entire model for support

17 18 Shredded Revoked Pre-ActivationActiveDeactivatedDestroyed 1112 Suspended Compromised Destroyed Compromised Updated State Model 13 SP Part 1 New State

New State Definitions Suspended1 The use of a key may be suspended for a period of time. Individual modules may locally suspend the use of a key without reporting the suspension beyond the users of the module. A suspended key may be restored to an active state at a later time. A suspended key is suspended for all use unless re-activated. Eventually the suspended key is either activated or deactivated. Revoked1 A revoked key is permanently taken out of service and will eventually be de-activated. If the integrity or secrecy of the key is suspect, the compromised key may be revoked. Revoked keys are reported in a certificate revocation list or by some equivalent mechanism. Revoked keys are typically revoked for all use. A revoked key can only transition to the deactivated state. Destroyed The key is destroyed so that it cannot be recovered. Even though the key no longer exists in this state, certain key attributes (e.g., key identifier, type, transition times and cryptoperiod) are retained. Unique attributes that may still exist (e.g. Name) may be reused. Shredded A Shredded key is completely removed including all key attributes such that no remnants of the key exist except in logged information. This releases globally unique attributes (e.g., UUID back into a re-usable condition. 1 Definitions taken from or based in part on state model in NIST Draft SP dated June 15, 2010 (provided by Elaine Barker)

New Transitions and Descriptions TransitionStates From – ToDescription 1 11Active to Suspended An active key may transition to the suspended state if, for some reason, it is to be temporarily taken out of use. In this state the key is not used to protect or process data. 12Suspended to Active A suspended key may transition to an active key when the reason for the suspension no longer exists. 13Suspended to Deactivated A suspended key may also transition to the deactivated state if that key is no longer to be used to process data. All appropriate users should be notified that the key has been deactivated. 14Active to Revoked An active key may transition to the revoked state if it is determined that the key should no longer be used and all possible users should be notified of the revocation. This transition occurs with keys that are shared among entities. 15Revoked to Deactivated A revoked key may transition to the deactivated state. This transition may occur immediately upon revocation. 16Revoked to Compromised A revoked object may transition to the compromised state when the integrity or the confidentiality of a key requiring protection becomes suspect. 17Destroyed to Shredded A destroyed object may transition to the shredded state in order to remove any remaining attributes from the system. Information on the objects lifecycle and attributes may remain in logged form. 18Destroyed Compromised to Shredded A destroyed compromised object may transition to the shredded state in order to remove any remaining attributes from the system. Information on the objects lifecycle and attributes may remain in logged form. 19Pre-activated to Shredded A key that has never been used may transition from the pre-activation state directly to the shredded state. In this case, the integrity of a key or the confidentiality of a key requiring confidentiality protection is considered trustworthy, but it has been determined that the key will not be needed in the future. 1 Definitions wholly or based in part on state model in NIST Draft SP dated June 15, 2010 (provided by Elaine Barker)

State Enumeration Table (update) State NameValue Pre-Active Active Deactivated Compromised Destroyed Destroyed Compromised Suspended Revoked / Disabled Shredded Extensions8XXXXXXX ( through FFFFFFFF)

To Be Done A State Definition Profile that expands on the existing NIST SP Part 1 (current release) document Existing states may need to be updated (e.g. Destroyed) Define all transitions (existing and new) Update specification with new enumerations Update profiles as required