1. Server Side Wrap Operations
A Proposal to Add or Modify Operations to Better Support Key Wrapping for KMIP 2.0
07 December 2017
OASIS Key Management Interoperability Protocol Managed Object Wrapping Proposal

2. Why the Need?
There are environments where managed objects must be maintained in a secure fashion even if served
Use cases where a wrapped key meets security versus an unwrapped key include proxy servers for specific applications such as
Smart Grid
File Encryption
Hardware Security Modules via a potentially non-secure File Servers
What is in KMIP 1.x does not provide for maintaining security of keys
Get allows wrapping of an object as it is server which is a good start!
Rewrapping a managed object is not easy or possible without client getting clear text object at some point
29 June 2017
OASIS Key Management Interoperability Protocol Managed Object Wrapping Proposal

3. Options Option 1 Option 2 Option 3
Add three new operations and replace existing painful methods
Wrap – Wrap an existing Managed Object and return or register the result
Unwrap – Unwrap an existing Managed Object and register the result
Rewrap – Unwrap then Wrap a managed object and return or register the result
Option 2
Add rewrap key and rewrap key pair operations
Modify Create to wrap a created managed object
Modify Register to wrap or unwrap a new managed object
Add appropriate rewrap operation
Option 3
Update Encrypt and Decrypt to work with existing managed objects
Potentially overloads Encrypt and Decrypt operations although some vendors use encrypt/decrypt for wrap/unwrap operations already
29 June 2017
OASIS Key Management Interoperability Protocol Managed Object Wrapping Proposal