Server Side Wrap Operations A Proposal to Add or Modify Operations to Better Support Key Wrapping for KMIP 2.0 07 December 2017 OASIS Key Management Interoperability Protocol Managed Object Wrapping Proposal

Why the Need? There are environments where managed objects must be maintained in a secure fashion even if served Use cases where a wrapped key meets security versus an unwrapped key include proxy servers for specific applications such as Smart Grid File Encryption Hardware Security Modules via a potentially non-secure File Servers What is in KMIP 1.x does not provide for maintaining security of keys Get allows wrapping of an object as it is server which is a good start! Rewrapping a managed object is not easy or possible without client getting clear text object at some point 29 June 2017 OASIS Key Management Interoperability Protocol Managed Object Wrapping Proposal

Options Option 1 Option 2 Option 3 Add three new operations and replace existing painful methods Wrap – Wrap an existing Managed Object and return or register the result Unwrap – Unwrap an existing Managed Object and register the result Rewrap – Unwrap then Wrap a managed object and return or register the result Option 2 Add rewrap key and rewrap key pair operations Modify Create to wrap a created managed object Modify Register to wrap or unwrap a new managed object Add appropriate rewrap operation Option 3 Update Encrypt and Decrypt to work with existing managed objects Potentially overloads Encrypt and Decrypt operations although some vendors use encrypt/decrypt for wrap/unwrap operations already 29 June 2017 OASIS Key Management Interoperability Protocol Managed Object Wrapping Proposal