"Name" attribute dropped from Public/Private Keys (KMIP 2.0)

[KBassford]

Hi Peter,

I presume this is a Whops. You can verify this by pulling the attribute list for any Public and/or Private Key. According to the spec. Only keys that have been re-keyed should loose their "Name" attribute. (Example below)

Public Key Attribute list ...
("['Cryptographic Algorithm', 'Cryptographic Length', 'Cryptographic Usage "
 "Mask', 'Initial Date', 'Object Type', 'State', 'Unique Identifier']")

Public Key Attributes ...
("('923', [Attribute(attribute_name=AttributeName(value='Cryptographic "
 "Algorithm'), attribute_index=None, "
 'attribute_value=Enumeration(enum=CryptographicAlgorithm, '
 'value=CryptographicAlgorithm.RSA, tag=Tags.ATTRIBUTE_VALUE)), '
 "Attribute(attribute_name=AttributeName(value='Unique Identifier'), "
 "attribute_index=None, attribute_value=UniqueIdentifier(value='923')), "
 "Attribute(attribute_name=AttributeName(value='Cryptographic Length'), "
 'attribute_index=None, attribute_value=CryptographicLength(value=2048)), '
 "Attribute(attribute_name=AttributeName(value='State'), attribute_index=None, "
 'attribute_value=Enumeration(enum=State, value=State.PRE_ACTIVE, '
 'tag=Tags.ATTRIBUTE_VALUE)), '
 "Attribute(attribute_name=AttributeName(value='Object Type'), "
 'attribute_index=None, attribute_value=Enumeration(enum=ObjectType, '
 'value=ObjectType.PUBLIC_KEY, tag=Tags.ATTRIBUTE_VALUE)), '
 "Attribute(attribute_name=AttributeName(value='Initial Date'), "
 'attribute_index=None, attribute_value=DateTime(value=1561384115, '
 'tag=Tags.ATTRIBUTE_VALUE)), '
 "Attribute(attribute_name=AttributeName(value='Cryptographic Usage Mask'), "
 'attribute_index=None, attribute_value=CryptographicUsageMask(value=10))])')

[PeterHamilton]

Thanks for filing this. Is this right after you create the key pair?

Also, did you mean "whoops" or does "whops" refer to something specific?

[KBassford]

Nothing specific, I presume this was a "whoops" when getting rid of the 'Operation Policy Name' attribute (which does go away in KMIP 2.0). After updating my test script (to get rid of the OPN), I found it was blowing up when I tried to save the name for a later locate test.

My create_key_pair params ...

create_key_pair(
    CryptographicAlgorithm.RSA,
    2048,
    public_name=test15_RSA_Public_Key,
    public_usage_mask=[<CryptographicUsageMask.VERIFY: 2>, <CryptographicUsageMask.DECRYPT: 8>],
        (mask): 0x0000000a
    private_name=test15_RSA_Private_Key,
    private_usage_mask=[<CryptographicUsageMask.SIGN: 1>]
        (mask): 0x00000001
)

[PeterHamilton]

Hmm. Ok. The names should definitely be available for key pairs. I'll need to debug why they're not showing up. Given Name isn't listed in the attribute list either, I suspect it's a single root cause.

[KBassford]

If it helps, switching back to KMIP 1.4 brings back both the "Name" and "Operation Policy Name" attributes in both Get Attributes List, and Get Attributes.

[PeterHamilton]

Interesting. That does help, thanks! I only modified the policy details for Operation Policy Name when I updated the server to KMIP 2.0. I'll dig into the policy enforcement to see where I screwed up.

[KBassford]

Oh, I forgot to mention that is upon key generation, i.e.
create_key_pair (KMIP 2.0), no "Name"
create_key_pair (KMIP 1.x), has "Name"
Forgot to mention that earlier, and re-reading it was not readily apparent.

[PeterHamilton]

No problem, that's what I inferred. Taking a brief look hasn't revealed anything obvious yet. I'll need to dig deeper later this afternoon.

[KBassford]

Found an interesting side note! For curiosity's sake I went back to an object I stored under KMIP 1.2 (using get_attribute_list and get_attributes, both running KMIP 2.0) and got the following response ...

Object Attribute List ...
("['Cryptographic Algorithm', 'Cryptographic Length', 'Cryptographic Usage "
 "Mask', 'Initial Date', 'Name', 'Object Type', 'State', 'Unique Identifier']")

Object Attributes ...
("('5', [Attribute(attribute_name=AttributeName(value='Cryptographic "
 "Algorithm'), attribute_index=None, "
 'attribute_value=Enumeration(enum=CryptographicAlgorithm, '
 'value=CryptographicAlgorithm.RSA, tag=Tags.ATTRIBUTE_VALUE)), '
 "Attribute(attribute_name=AttributeName(value='Cryptographic Length'), "
 'attribute_index=None, attribute_value=CryptographicLength(value=2048)), '
 "Attribute(attribute_name=AttributeName(value='Cryptographic Usage Mask'), "
 'attribute_index=None, attribute_value=CryptographicUsageMask(value=10)), '
 "Attribute(attribute_name=AttributeName(value='Initial Date'), "
 'attribute_index=None, attribute_value=DateTime(value=1559241409, '
 'tag=Tags.ATTRIBUTE_VALUE)), '
 "Attribute(attribute_name=AttributeName(value='Object Type'), "
 'attribute_index=None, attribute_value=Enumeration(enum=ObjectType, '
 'value=ObjectType.PUBLIC_KEY, tag=Tags.ATTRIBUTE_VALUE)), '
 "Attribute(attribute_name=AttributeName(value='State'), attribute_index=None, "
 'attribute_value=Enumeration(enum=State, value=State.PRE_ACTIVE, '
 'tag=Tags.ATTRIBUTE_VALUE)), '
 "Attribute(attribute_name=AttributeName(value='Unique Identifier'), "
 "attribute_index=None, attribute_value=UniqueIdentifier(value='5'))])")

So "Name" appears in get_attribute_list, but not in get_attributes!

[PeterHamilton]

Finally got back to this issue. After some interesting experiments, it turns out that this is a 2.5 year old bug in the ProxyKmipClient, not the server. I should have a fix up later today.