1. Project: Key Management Framework
   1. Announcements
   2. Events
   3. News
   4. Blogs
   5. Discussions
   6. Leaders
   7. Observers
   8. Files
   9. Proposed KMF API Changes

OpenSolaris Project: Key Management Framework

View the leaders for this project
Project Observers

Endorsing communities

OS/Net (ON)
Security

Status

• PSARC/2006/074 Approved 2006-07-19. Integrated into Build 53 of the ON consolidation.
• PSARC 2007/426 - KMFAPI Interface Taxonomy Changes - putback into build 74.
• PSARC 2007/465 - pktool symmetric key enhancements - putback into build 74
• PSARC 2008/037 - new EKU support for pktool and kmfcfg - putback into build 85
• Bug 6621224 - KMF Dynamic Plugin Support - putack in build 80

All Recent bug/rfe putbacks

Key Management Framework

The goal of the project is to provide a unified set of interfaces (both programming APIs and administrative tools) for managing PKI objects in Solaris. Currently, there are at several different "keystore systems" that developers and administrators must choose when designing systems that employ PKI technologies - NSS, OpenSSL, and PKCS#11 are the 3 main choices for Solaris users. Each of these systems presents very different programming APIs and administrative tools and none of them has any sort of concept of a PKI policy enforcement system.

Details

KMF provides a generic interfaces that can be used to manipulate objects (keys, certificates) in all of the above mentioned keystores. The programming API layer is generic and allows the developer to specify which type of keystore is to be used. KMF will also provide plugin modules for each of the 3 systems so that new applications can be written to use any of the above keystores. A new management utility that will allow the administrator to manage PKI objects in all 3 keystores from a single utility, instead of learning 3 different utilities (openssl, certutil, pkutil).

Another unique feature of KMF is that it will provide a system-wide policy database that KMF applications can use to apply to applications, regardless of which type of keystore is being used. The administrator will be able to create policy definitions in a global database. KMF applications can then choose which policy they want to assert and then all subsequent KMF operations will behave according to the limitations of the policy being enforced. Policy definitions include rules for how validations is to be performed, key usage and extended key usage requirements, trust anchor definitions, OCSP parameters, and CRL DB parameters (location, etc).

Feature Summary

• Provide abstracted programming APIs for developing PKI applications
• Provide new administrative utility for managing PKI objects
• Provide new PKI policy database and enforcement system for PKI apps

More Information

• Source Code
• KMF Whitepaper (design document)
• KMF Overview Presentation slides
• Other Design whitepapers and presentations are available in the files section.
• Join the KMF mailing list

---

Announcements

27 Nov 2006	Key Management Framework putback
13 Mar 2006	Design Document Posted

Blogs

darren - Worst (and Best) keyboards

May 9, 1:11 PM

Seems like for some reason I didn't actually post this when I wrote it on Jan 10th 2008, so I'll post it now I've just read over the PC World "10 Worst Keyboards of all time" article . Out of the 10 ...

darren - Missing Apple Mac hardware

May 9, 1:10 PM

My current home machine is a first generation (ordered the day after the announcement) PPC Mac Mini. I initially ordered it with 512Mb RAM and no WiFi or Bluetooth. It has since been upgraded to 1G ...

darren - Simple CLI based CA on Solaris

Apr 30, 7:25 AM

With the recently added ability to sign PKCS#10 certificate request files the pktool(1) command of OpenSolaris can be used as a very simple Certificate Authority, similar to what can be done with the ...

wyllys - Tech Days and Photos

Apr 8, 4:18 PM

I recently had a round-the-world trip to speak at 2 Sun Tech Days events - Sydney and Johannesburg.  Both events went very well, I presented on "New Security Features in Solaris" and "OpenSolaris: A ...

darren - Mercurial Links

Feb 19, 7:21 AM

A few hopefully helpful links for OpenSolaris /JDK developers in the transition to mercurial (hg). Distributed revision control with Mercurial: http://hgbook.red-bean.com/hgbook.html Genunix.org Wiki ...