Skip to content

README.md

Latest commit

 

History

History
151 lines (116 loc) · 5.77 KB

README.md

File metadata and controls

151 lines (116 loc) · 5.77 KB

Cyphera Open KMIP Server

Alpha software. For development and interoperability evaluation only. This release is not externally audited and is not suitable for production key custody. Secret material is currently stored unwrapped in SQLite unless you add your own envelope-encryption layer. In normal mode, the KMIP listener requires mTLS and the REST API requires an API key when enabled. Use --dev only for local development.

Open-source KMIP 1.4 key management server for developers. Create keys, manage lifecycle, run server-side crypto, and connect KMIP clients — without fighting enterprise KMS platforms.

Works standalone or paired with Cyphera Open PKI Server for mTLS certificate lifecycle.

What it does

  • KMIP 1.4 protocol over mTLS — implements core and extended operation handlers
  • REST API for key management, crypto operations, and audit
  • Server-side AES-GCM encrypt/decrypt, RSA/ECDSA sign/verify, HMAC, key wrapping
  • Key lifecycle: create, activate, revoke, destroy, rekey, archive, recover
  • RSA and ECDSA key pair generation
  • X.509 certificate storage
  • Custom per-key attributes
  • Audit logging with client identity tracking
  • SQLite storage with WAL mode and secure delete
  • Dev mode: --dev generates mTLS certs and API key instantly
  • Single binary. No external dependencies.

Install

go install github.com/cyphera-labs/open-kmip-server/cmd/open-kmip@latest

Or use Docker:

# Dev mode (local testing only — auto-generates certs)
docker run -d -p 127.0.0.1:5696:5696 -p 127.0.0.1:8200:8200 \
  ghcr.io/cyphera-labs/open-kmip-server --dev --db /data/open-kmip.db

# Normal mode (provide your own certs and API key)
docker run -d -p 5696:5696 -p 8200:8200 \
  -v kmip-data:/data -v "$PWD/certs:/certs:ro" \
  ghcr.io/cyphera-labs/open-kmip-server \
  --cert /certs/server.pem --key /certs/server-key.pem \
  --ca /certs/ca.pem --api-key "$KMIP_API_KEY" --db /data/open-kmip.db

Quick Start

# Start in dev mode (auto-generates certs + API key)
open-kmip --dev

Prints client cert paths and API key to stdout. KMIP on :5696, REST API on :8200.

# Create a key
curl -sk -H "Authorization: Bearer $API_KEY" \
  -X POST https://localhost:8200/v1/keys \
  -d '{"name":"my-aes-key","algorithm":"AES","length":256}'

# Activate it
curl -sk -H "Authorization: Bearer $API_KEY" \
  -X POST https://localhost:8200/v1/keys/$UID/activate

# Encrypt something
curl -sk -H "Authorization: Bearer $API_KEY" \
  -X POST https://localhost:8200/v1/keys/$UID/encrypt \
  -d '{"data":"aGVsbG8gd29ybGQ="}'

With Open PKI Server

Generate mTLS certs using Open PKI Server:

open-pki init-ca --name kmip-root --out ./certs

open-pki issue-server-cert \
  --profile kmip-server \
  --cn localhost --san localhost --san 127.0.0.1 \
  --out ./certs

open-pki issue-client-cert \
  --profile kmip-client \
  --cn my-app \
  --out ./certs

open-kmip \
  --cert ./certs/localhost.pem \
  --key ./certs/localhost-key.pem \
  --ca ./certs/ca.pem \
  --api-key my-secret

REST API

Method Endpoint Description
POST /v1/keys Create key or key pair
GET /v1/keys List keys
GET /v1/keys/{uid} Get key metadata
POST /v1/keys/{uid}/activate Activate
POST /v1/keys/{uid}/revoke Revoke
DELETE /v1/keys/{uid} Destroy
POST /v1/keys/{uid}/rekey Rekey
POST /v1/keys/{uid}/encrypt Encrypt (AES-GCM)
POST /v1/keys/{uid}/decrypt Decrypt
POST /v1/keys/{uid}/sign Sign (RSA/ECDSA)
POST /v1/keys/{uid}/verify Verify signature
POST /v1/keys/{uid}/mac HMAC-SHA256
POST /v1/keys/{uid}/wrap Wrap key
POST /v1/keys/{uid}/unwrap Unwrap key
POST /v1/certificates Upload certificate
GET /v1/connections Active KMIP connections
GET /v1/status Server status
GET /v1/audit Audit log

KMIP Protocol

This server implements an alpha subset of KMIP 1.4 over TTLV. Only operations exercised by the repository test suite should be treated as compatibility targets for this release. Third-party interoperability, including PyKMIP, is preliminary and should be validated in your environment before use.

Create, CreateKeyPair, Register, ReKey, DeriveKey, Locate, Check, Get, GetAttributes, GetAttributeList, AddAttribute, ModifyAttribute, DeleteAttribute, ObtainLease, Activate, Revoke, Destroy, Archive, Recover, Query, Poll, DiscoverVersions, Encrypt, Decrypt, Sign, SignatureVerify, MAC

Compatible Clients

  • Cyphera KMIP clients — Go, Java, Python, Node.js, Rust, .NET, PHP, Ruby, Swift
  • PyKMIP (preliminary — validate in your environment)
  • Other KMIP 1.4 clients (preliminary — validate in your environment)

Configuration

Flag Env Default Description
--dev false Dev mode with auto-generated certs
--host 0.0.0.0 Listen address
--port 5696 KMIP protocol port
--api-port 8200 REST API port (0 to disable)
--api-key KMIP_API_KEY REST API key
--cert Server certificate PEM
--key Server private key PEM
--ca CA certificate PEM
--storage sqlite sqlite or memory
--db open-kmip.db SQLite database path

License

Apache License 2.0

Links