1. Cryptographic Usage Mask
Nitin Jain ( Safenet )

2. Cryptographic Usage Mask
Currently in KMIP spec usage masks are not briefed clearly under Cryptographic Usage Mask attribute.
Add below table in KMIP spec and KMIP usage guide to understand the usage masks.
Should add one more line in KMIP spec under Cryptographic Usage Mask attribute :
“The Cryptographic Usage Mask attribute defines the cryptographic usage of a Symmetric Key, Private Key and Public Key Managed objects only.”
Note: Request to remove Usage Masks marked with red.
Usage Mask
Description
Applicable Objects 1
Sign
Key can be used for Signing the Data.
Private Key 2
Verify
Key can be used for Verification of Data.
Public Key 3
Encrypt
Key can be used to Encrypt the Data.
Symmetric and Public Key 4
Decrypt
Key can be used to Decrypt the Data.
Symmetric and Private Key 5
Wrap Key
Key can be used to Wrap a Key. 6
Unwrap Key
Key can be used to Unwrap a Key. 7
Export
This is ambiguous but one thing for sure that this is not for exporting the Key Material (should be deprecated and removed from spec) 8
MAC Generate
Key can be used to generate MAC.
Symmetric Key 9
MAC Verify
Key can be used to verify MAC. 10
Derive Key
Key can be used to Derive a Key.
Symmetric Key and Secret Data

3. Is it ok to deprecate these from spec and usage guide?
Usage Mask Table
Usage Mask
Description
Applicable Objects 11
Content Commitment
This usage mask provides non-repudiation.
This mask is can be used when Public Key can be used to verify digital signatures.
It protects against the signing entity falsely denying some action.
Public Key 12
Key Agreement
This mask can be used when Public Key can be used for key agreement. 13
Certificate Sign
Key can be used to verify signatures on public key certificates (Public Key Case) or Key can be used to sign public key certificates (Private Key Case)
Public Key, Private Key 14
CRL Sign
Key can be used to verify signatures on certificate revocation lists (Public Key Case) or Key can be used to sign the CRL (Private Key Case) 15
Generate Cryptogram
Description of these usage masks are given in KMIP Usage Guide under section 3.26
However I didn’t find any practical use case which any of KMIP client would use.
Is it ok to deprecate these from spec and usage guide? 16
Validate Cryptogram 17
Translate Encrypt 18
Translate Decrypt 19
Translate Wrap 20
Translate Unwrap