# kmipgotest

**Repository Path**: zklall/kmipgotest

## Basic Information

- **Project Name**: kmipgotest
- **Description**: No description available
- **Primary Language**: Unknown
- **License**: Not specified
- **Default Branch**: master
- **Homepage**: None
- **GVP Project**: No

## Statistics

- **Stars**: 1
- **Forks**: 0
- **Created**: 2026-01-15
- **Last Updated**: 2026-01-20

## Categories & Tags

**Categories**: Uncategorized

**Tags**: None

## README

# KMIP 1.4 Server

A standards-compliant KMIP (Key Management Interoperability Protocol) 1.4 server implementation in Go.

## Features

- **KMIP 1.4 Protocol Support**: Full implementation of the KMIP 1.4 specification
- **Core Operations**:
  - CREATE: Generate new cryptographic keys
  - GET: Retrieve keys by unique identifier
  - ACTIVATE: Activate pre-active keys
  - REGISTER: Import externally generated keys
  - ADD ATTRIBUTE: Add attributes to existing keys
  - MODIFY ATTRIBUTE: Modify existing key attributes
- **TLS Security**: Optional TLS 1.2+ encryption support
- **In-Memory Storage**: Thread-safe key storage with state management
- **Batch Operations**: Support for multiple operations in a single request

## Requirements

- Go 1.21 or higher
- OpenSSL (for certificate generation)

## Installation

```bash
# Clone the repository
git clone <repository-url>
cd kmip-server

# Download dependencies
go mod tidy

# Build the server
go build -o kmip-server ./cmd/server
```

## Certificate Generation

For TLS-enabled mode, generate self-signed certificates:

```bash
# Generate server private key
openssl genrsa -out server.key 2048

# Generate server certificate
openssl req -new -x509 -key server.key -out server.crt -days 365 -subj "/C=CN/ST=Beijing/L=Beijing/O=KMIP/CN=localhost"

# (Optional) Generate CA for client certificate verification
openssl genrsa -out ca.key 2048
openssl req -new -x509 -key ca.key -out ca.pem -days 365
```

## Configuration

Edit `config.yaml` to configure the server:

```yaml
listen_address: "0.0.0.0"
listen_port: 5696

tls:
  enabled: true                    # Set to true for TLS
  cert_file: "server.crt"          # Server certificate path
  key_file: "server.key"           # Server private key path
  require_client_cert: false       # Require client certificates
  ca_file: "ca.pem"                # CA certificate for client verification

storage:
  type: "memory"                   # Storage backend type
  max_keys: 10000                  # Maximum keys to store

logging:
  level: "info"                    # Log level: debug, info, warn, error
  format: "json"                   # Log format: json, text
```

## Usage

### Start the Server

```bash
# With default config
./kmip-server

# With custom config
./kmip-server -config config.yaml
```

### Key States

Keys follow the KMIP lifecycle:

```
Pre-Active → Active → Deactivated → Destroyed
```

- **Pre-Active**: Key created but not yet usable
- **Active**: Key is operational
- **Deactivated**: Key is no longer active but recoverable
- **Destroyed**: Key has been permanently deleted

## Supported Object Types

- Symmetric Key
- Public Key
- Private Key
- Certificate
- Opaque Object
- Secret Data

## Supported Cryptographic Algorithms

- AES
- DES
- 3DES
- RSA
- DSA
- ECDSA
- HMAC-SHA1
- HMAC-SHA256
- HMAC-SHA384
- HMAC-SHA512

## KMIP Protocol Details

### Message Format

KMIP uses TTLV (Tag-Type-Length-Value) encoding:

```
| Tag (2 bytes) | Type (1 byte) | Length (4 bytes) | Value (variable) |
```

### Default Port

KMIP standard port: **5696**

### Batch Processing

The server supports batch operations for efficient multiple key management requests.

## Logging

The server provides structured logging with configurable levels:

- **debug**: Detailed debugging information
- **info**: General operational information
- **warn**: Warning messages
- **error**: Error messages only

## License

This project is licensed under the MIT License.