kmip-rs

This project is a WORK IN PROGRESS

A pure-Rust implementation of the OASIS Key Management Interoperability Protocol (KMIP), targeting KMIP 1.0–1.4. The workspace provides a typed synchronous client, server-side primitives for building a KMIP service, and the underlying TTLV (Tag-Type-Length-Value) codec as a standalone crate that can be reused in isolation.

Workspace layout

Crate	Description
kmip	KMIP protocol types, request/response payloads, attributes, and a synchronous TLS client and server.
ttlv	Standalone KMIP TTLV (binary and XML) encoder/decoder, with a Stream adapter for I/O.
ttlv-derive	Proc-macro crate providing #[derive(Encodable, Decodable, Enum)].

Installation

The crates are not yet published to crates.io. Add as git dependencies:

[dependencies]
kmip = { git = "https://github.com/phsym/kmip-rs" }

Quick start

Connect to a KMIP server with rustls (the default TLS backend) and create an AES-256 symmetric key:

use kmip::{
    CryptographicUsageMask,
    attributes::{Attribute, CryptographicLength},
    client::ClientBuilder,
    enums::{CryptographicAlgorithm, ObjectType},
    payloads::CreateRequestPayload,
    types::TemplateAttribute,
};

let mut client = ClientBuilder::default()
    .add_root_certificate_file("ca.pem").unwrap()
    .identity_file("client.pem", "client.key").unwrap()
    .connect("kmip.example.com:5696", "kmip.example.com").unwrap();

let response = client.request(CreateRequestPayload {
    object_type: ObjectType::SymmetricKey,
    attributes: TemplateAttribute::new(vec![
        Attribute::new(CryptographicAlgorithm::AES),
        Attribute::new(CryptographicLength(256)),
        Attribute::new(
            CryptographicUsageMask::Encrypt | CryptographicUsageMask::Decrypt,
        ),
    ]),
}).unwrap();

println!("created key: {:?}", response);

The same operation written with the fluent helpers on Client:

use kmip::{CryptographicUsageMask, client::ClientBuilder};

let mut client = ClientBuilder::default()
    .add_root_certificate_file("ca.pem").unwrap()
    .identity_file("client.pem", "client.key").unwrap()
    .connect("kmip.example.com:5696", "kmip.example.com").unwrap();

let response = client
    .create()
    .aes(256, CryptographicUsageMask::Encrypt | CryptographicUsageMask::Decrypt)
    .exec().unwrap();

println!("created key: {:?}", response);

Each operation has a dedicated builder under client::exec (create, create_keypair, register, rekey, locate, get, encrypt, decrypt, sign, add_attribute, …). For batched requests use client.batch(...), and for raw RequestMessage exchange use client.roundtrip(&msg). Protocol version is auto-negotiated against the server's Discover Versions response.

TLS backends

The kmip crate compiles against several TLS implementations. All backends share a single ClientBuilder::connect(addr, domain) method; the backend is chosen by a TlsBackend implementation rather than a per-backend method.

Feature	Backend type	Notes
tls-rustls	RustlsBackend	Default. Pure Rust, uses the platform trust store.
tls-native	NativeTlsBackend	Delegates to the OS (SChannel / SecureTransport / OpenSSL).
tls-openssl	OpenSslBackend	Requires a system OpenSSL.
tls-boring	BoringBackend	Useful when matching a BoringSSL-based server stack.

Note: with NativeTlsBackend, the client identity private key passed to ClientBuilder::identity / identity_file must be PKCS#8-encoded (-----BEGIN PRIVATE KEY-----). The other backends also accept PKCS#1 (-----BEGIN RSA PRIVATE KEY-----) and SEC1 (-----BEGIN EC PRIVATE KEY-----) keys. Convert with openssl pkcs8 -topk8 -nocrypt if needed.

Pick a backend at runtime by passing its type to ClientBuilder::new:

use kmip::client::{ClientBuilder, RustlsBackend};

let mut client = ClientBuilder::new(RustlsBackend)
    .connect("kmip.example.com:5696", "kmip.example.com").unwrap();

The default-tls-rustls feature (on by default) selects rustls as the built-in default: it's what ClientBuilder::default() (used above) and Client::builder() construct. Both are only available when default-tls-rustls is enabled; with it disabled, use ClientBuilder::new(backend) to choose a backend explicitly.

Multiple backends can be enabled at once and selected per-client via ClientBuilder::new, with one exception: tls-boring and tls-openssl cannot be enabled together (they export conflicting symbols).

Optional features

Feature	Default	Effect
tls-rustls	yes	Enables the rustls client backend (see above).
default-tls-rustls	yes	Makes rustls the built-in default (ClientBuilder::default() / Client::builder()).
uuid	yes	Implements unique-identifier helpers using the uuid crate.
serde	no	Derives serde::Serialize on protocol types for logging/inspection.
arbitrary	no	Derives arbitrary::Arbitrary for fuzzing.
interop-rust-crypto	no	Cryptographic interop using pure-Rust crates (rsa, p256, p384, p521).
interop-openssl	no	Cryptographic interop using OpenSSL.
interop-boring	no	Cryptographic interop using BoringSSL.

The ttlv crate has its own feature flags (xml, text, derive, chrono, serde, arbitrary, bitflags), all opt-in (empty default set) — see ttlv/README.md. When using kmip you don't need to set them: kmip already enables the ttlv features it depends on.

Minimum supported Rust version

Rust 1.88.0, edition 2024. The MSRV is checked in CI; bumping it is considered a non-breaking change.

Implementation status

Legend:

• N/A : Not Applicable
• ✅ : Fully compatible
• ❌ : Not implemented or reviewed
• 🚧 : Work in progress / Partially compatible
• 💀 : Deprecated

Messages

	v1.0	v1.1	v1.2	v1.3	v1.4
Request Message	✅	✅	✅	✅	✅
Response Message	✅	✅	✅	✅	✅

Operations

Operation	v1.0	v1.1	v1.2	v1.3	v1.4
Create	✅	✅	✅	✅	✅
Create Key Pair	✅	✅	✅	✅	✅
Register	✅	✅	✅	✅	✅
Re-key	✅	✅	✅	✅	✅
DeriveKey	❌	❌	❌	❌	❌
Certify	❌	❌	❌	❌	❌
Re-certify	❌	❌	❌	❌	❌
Locate	✅	✅	✅	✅	✅
Check	❌	❌	❌	❌	❌
Get	✅	✅	✅	✅	✅
Get Attributes	✅	✅	✅	✅	✅
Get Attribute List	✅	✅	✅	✅	✅
Add Attribute	✅	✅	✅	✅	✅
Modify Attribute	✅	✅	✅	✅	✅
Delete Attribute	✅	✅	✅	✅	✅
Obtain Lease	✅	✅	✅	✅	✅
Get Usage Allocation	✅	✅	✅	✅	✅
Activate	✅	✅	✅	✅	✅
Revoke	✅	✅	✅	✅	✅
Destroy	✅	✅	✅	✅	✅
Archive	✅	✅	✅	✅	✅
Recover	✅	✅	✅	✅	✅
Validate	❌	❌	❌	❌	❌
Query	✅	✅	✅	✅	✅
Cancel	❌	❌	❌	❌	❌
Poll	❌	❌	❌	❌	❌
Notify	❌	❌	❌	❌	❌
Put	❌	❌	❌	❌	❌
Discover	N/A	✅	✅	✅	✅
Re-key Key Pair	N/A	✅	✅	✅	✅
Encrypt	N/A	N/A	✅	✅	✅
Decrypt	N/A	N/A	✅	✅	✅
Sign	N/A	N/A	✅	✅	✅
Signature Verify	N/A	N/A	✅	✅	✅
MAC	N/A	N/A	❌	❌	❌
MAC Verify	N/A	N/A	❌	❌	❌
RNG Retrieve	N/A	N/A	❌	❌	❌
RNG Seed	N/A	N/A	❌	❌	❌
Hash	N/A	N/A	❌	❌	❌
Create Split Key	N/A	N/A	❌	❌	❌
Join Split Key	N/A	N/A	❌	❌	❌
Export	N/A	N/A	N/A	N/A	✅
Import	N/A	N/A	N/A	N/A	✅

Managed Objects

Object	v1.0	v1.1	v1.2	v1.3	v1.4
Certificate	✅	✅	✅	✅	✅
Symmetric Key	✅	✅	✅	✅	✅
Public Key	✅	✅	✅	✅	✅
Private Key	✅	✅	✅	✅	✅
Split Key	✅	✅	✅	✅	✅
Template	✅	✅	✅	💀	💀
Secret Data	✅	✅	✅	✅	✅
Opaque Object	✅	✅	✅	✅	✅
PGP Key	N/A	N/A	✅	✅	✅

Base Objects

Object	v1.0	v1.1	v1.2	v1.3	v1.4
Attribute	✅	✅	✅	✅	✅
Credential	✅	✅	✅	✅	✅
Key Block	✅	✅	✅	✅	✅
Key Value	✅	✅	✅	✅	✅
Key Wrapping Data	✅	✅	✅	✅	✅
Key Wrapping Specification	✅	✅	✅	✅	✅
Transparent Key Structures	🚧	🚧	🚧	🚧	🚧
Template-Attribute Structures	✅	✅	✅	✅	✅
Extension Information	N/A	✅	✅	✅	✅
Data	N/A	N/A	✅	✅	✅
Data Length	N/A	N/A	❌	❌	❌
Signature Data	N/A	N/A	✅	✅	✅
MAC Data	N/A	N/A	❌	❌	❌
Nonce	N/A	N/A	✅	✅	✅
Correlation Value	N/A	N/A	N/A	✅	✅
Init Indicator	N/A	N/A	N/A	✅	✅
Final Indicator	N/A	N/A	N/A	✅	✅
RNG Parameter	N/A	N/A	N/A	✅	✅
Profile Information	N/A	N/A	N/A	✅	✅
Validation Information	N/A	N/A	N/A	✅	✅
Capability Information	N/A	N/A	N/A	✅	✅
Authenticated Encryption Additional Data	N/A	N/A	N/A	N/A	✅
Authenticated Encryption Tag	N/A	N/A	N/A	N/A	✅

Transparent Key Structures

Object	v1.0	v1.1	v1.2	v1.3	v1.4
Symmetric Key	✅	✅	✅	✅	✅
DSA Private/Public Key	❌	❌	❌	❌	❌
RSA Private/Public Key	✅	✅	✅	✅	✅
DH Private/Public Key	❌	❌	❌	❌	❌
ECDSA Private/Public Key	✅	✅	✅	💀	💀
ECDH Private/Public Key	❌	❌	❌	💀	💀
ECMQV Private/Public	❌	❌	❌	💀	💀
EC Private/Public	N/A	N/A	N/A	✅	✅

Attributes

Attribute	v1.0	v1.1	v1.2	v1.3	v1.4
Unique Identifier	✅	✅	✅	✅	✅
Name	✅	✅	✅	✅	✅
Object Type	✅	✅	✅	✅	✅
Cryptographic Algorithm	✅	✅	✅	✅	✅
Cryptographic Length	✅	✅	✅	✅	✅
Cryptographic Parameters	✅	✅	✅	✅	✅
Cryptographic Domain Parameters	✅	✅	✅	✅	✅
Certificate Type	✅	✅	✅	✅	✅
Certificate Identifier	✅	💀	💀	💀	💀
Certificate Subject	✅	💀	💀	💀	💀
Certificate Issuer	✅	💀	💀	💀	💀
Digest	✅	✅	✅	✅	✅
Operation Policy Name	✅	✅	✅	💀	💀
Cryptographic Usage Mask	✅	✅	✅	✅	✅
Lease Time	✅	✅	✅	✅	✅
Usage Limits	✅	✅	✅	✅	✅
State	✅	✅	✅	✅	✅
Initial Date	✅	✅	✅	✅	✅
Activation Date	✅	✅	✅	✅	✅
Process Start Date	✅	✅	✅	✅	✅
Protect Stop Date	✅	✅	✅	✅	✅
Deactivation Date	✅	✅	✅	✅	✅
Destroy Date	✅	✅	✅	✅	✅
Compromise Occurrence Date	✅	✅	✅	✅	✅
Compromise Date	✅	✅	✅	✅	✅
Revocation Reason	✅	✅	✅	✅	✅
Archive Date	✅	✅	✅	✅	✅
Object Group	✅	✅	✅	✅	✅
Link	✅	✅	✅	✅	✅
Application Specific Information	✅	✅	✅	✅	✅
Contact Information	✅	✅	✅	✅	✅
Last Change Date	✅	✅	✅	✅	✅
Custom Attribute	✅	✅	✅	✅	✅
Certificate Length	N/A	✅	✅	✅	✅
X.509 Certificate Identifier	N/A	✅	✅	✅	✅
X.509 Certificate Subject	N/A	✅	✅	✅	✅
X.509 Certificate Issuer	N/A	✅	✅	✅	✅
Digital Signature Algorithm	N/A	✅	✅	✅	✅
Fresh	N/A	✅	✅	✅	✅
Alternative Name	N/A	N/A	✅	✅	✅
Key Value Present	N/A	N/A	✅	✅	✅
Key Value Location	N/A	N/A	✅	✅	✅
Original Creation Date	N/A	N/A	✅	✅	✅
Random Number Generator	N/A	N/A	N/A	✅	✅
PKCS#12 Friendly Name	N/A	N/A	N/A	N/A	✅
Description	N/A	N/A	N/A	N/A	✅
Comment	N/A	N/A	N/A	N/A	✅
Sensitive	N/A	N/A	N/A	N/A	✅
Always Sensitive	N/A	N/A	N/A	N/A	✅
Extractable	N/A	N/A	N/A	N/A	✅
Never Extractable	N/A	N/A	N/A	N/A	✅

License

Licensed under either of

• Apache License, Version 2.0 (LICENSE-APACHE or http://www.apache.org/licenses/LICENSE-2.0)
• MIT license (LICENSE-MIT or http://opensource.org/licenses/MIT)

at your option.

Contribution

Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in the work by you, as defined in the Apache-2.0 license, shall be dual licensed as above, without any additional terms or conditions.