KMIP: a common language for key management

A protocol between client and key service

Key Management Interoperability Protocol, KMIP, is an OASIS standard for communication about cryptographic objects. For example, a client can request that keys be created, registered, retrieved or destroyed in a key management service.

This enables different systems to use a shared interface rather than a separate connection for each provider. However, KMIP is not an encryption algorithm and does not, on its own, describe how an entire application protects its data.

Standards support is the starting point for compatibility

Two products that both claim KMIP support still need to support the same relevant functions. Versions, profiles, objects and operations may differ. The client's expectations therefore need to be checked against the server implementation.

• Check the version, profile and operations the client needs.
• Plan client authentication, certificates and renewal.
• Restrict which clients may use which objects.
• Test connection failures, reconnection and recovery in the actual environment.

Where is the key when it is used?

KMIP can be used to retrieve key material for a client. A central KMS therefore does not automatically mean that all keys or cryptographic operations remain within the key service. Map how the client handles keys, any caches and the protection of key material after delivery.

Make the lifecycle part of the integration

Document who is responsible for rotation, deactivation and deletion. Also check what is needed to recover encrypted data from an older backup. When protocols, permissions and the lifecycle work together, central key management remains useful through change.