kmip-interop-tech — archive

[David Featherstone]

Tim is quite right: The two options cannot co-exist. Nevertheless, John's point is valid: When the logic of Option-1 assigns an Attribute Index of 0 (zero) to an attribute instance -- e.g. to an instance of Cryptographic Parameters -- a KMIP client must jump through hoops to assert the presence of a different instance having "the lowest Attribute Index". The following text suggests yet a third alternative, Option-3: The "Attribute Default" qualifier [for KMIP v1.4, or later], which remains backward compatible with Option-1, while solving the same issue identified by Option-2. Cheers, ... Dave KMIP 1.4+: Attribute Default Qualifier ============================= Consider the following Batch Item that Creates a key from a given Template1 (containing a Cryptographic Parameters attribute instance) and an explicitly specified Cryptographic Parameters attribute instance. Note the presence on Line=12 of an (optional) Boolean-type AttributeDefault qualifier: 1 <BatchItem> 2 <Operation type="Enumeration" value="Create"/> 3 <RequestPayload> 4 <ObjectType type="Enumeration" value="SymmetricKey"/> 5 <TemplateAttribute> 6 <Name> 7 <NameValue type="TextString" value="Template1"/> 8 <NameType type="Enumeration" value="UninterpretedTextString"/> 9 </Name> 10 <Attribute> 11 <AttributeName type="TextString" value="Cryptographic Parameters"/> * 12 * <AttributeDefault type="Boolean" value="True"/> 13 <AttributeValue> 14 <KeyRoleType type="Enumeration" value="DEK"/> 15 <CryptographicAlgorithm type="Enumeration" value="AES"/> 16 </AttributeValue> 17 </Attribute> 18 <Attribute> 19 <AttributeName type="TextString" value="Cryptographic Usage Mask"/> 20 <AttributeValue type="Integer" value="Decrypt Encrypt"/> 21 </Attribute> 22 </TemplateAttribute> 23 </RequestPayload> 24 </BatchItem> The qualifier may also appear in an Add Attribute, or Modify Attribute operation [see Line=7]: 1 <BatchItem> 2 <Operation type="Enumeration" value="Modify Attribute"/> 3 <RequestPayload> 4 <Attribute> 5 <AttributeName type="TextString" value="Cryptographic Parameters"/> 6 <AttributeIndex type="Integer" value="3"/> * 7 * <AttributeDefault type="Boolean" value="True"/> 8 </Attribute> 9 o o o Note that at most one instance of a given attribute may express the AttributeDefault qualifier. If an existing attribute instance already expresses this qualifier, then applying this qualifier to a modified instance [i.e. Modify Attribute] or to a new instance [i.e. Add Attribute], causes the qualification to /transfer/ from the existing instance to the modified or new instance. The AttributeDefault qualifier would be completely /optional/ and, in its absence, all aspects of Option-1 would be in effect. In the presence of this qualifier, however, the instance having this qualifier would take precedence over the instance having "the lowest Attribute Index" [although, nothing prohibits the instance having the lowest Attribute Index from simultaneously expressing the AttributeDefault qualifier]. Because the AttributeDefault qualifier is associated to at most one instance, in the absence of an AttributeIndex the AttributeDefault qualifier could be optionally employed to identify a particular attribute instance for operations such as Modify, and Delete Attribute. Just as specifying a non-existent AttributeIndex results in an error, so would specifying a non-existent AttributeDefault result in an error. Upon deletion of the attribute instance expressing the AttributeDefault qualifier, behaviour reverts to that prescribed by Option-1. Likewise, upon setting the AttributeDefault qualifier to "False", behaviour reverts to that prescribed by Option-1. [It should be possible to set the AttributeDefault to "False" on /any/ attribute instance, thereby reverting behaviour to that prescribed by Option-1.] ------------------------------------------------------------- -- The information contained in this electronic mail transmission may be privileged and confidential, and therefore, protected from disclosure. If you have received this communication in error, please notify us immediately by replying to this message and deleting it from your computer without copying or disclosing it.