All notable changes to this project will be documented in this file.
- Sign and SignatureVerify support across CLI, and UI (#522, #606):
- CLI: Added
signandsignature_verifysubcommands for RSA and Elliptic Curves (crate/cli/src/actions/kms/.../sign.rs,.../signature_verify.rs). - UI: Added React pages for RSA and EC signing and verification (
ui/src/RsaSign.tsx,ui/src/RsaVerify.tsx,ui/src/ECSign.tsx,ui/src/ECVerify.tsx), and surfaced object type in Locate.
- CLI: Added
- Make DB pool max_connections configurable (#632)
- Support sign and verify on CLI/UI + issue 619 (#606)
- Server: Consolidate KMIP operations
SignandSignatureVerifyfor RSA and Elliptic Curves (crate/server/src/core/operations/sign.rs,signature_verify.rs; routes updated). Supported signature schemes: RSASSA-PSS, ECDSA, EdDSA (Ed25519, Ed448). - Digest (pre-hashed) mode for signing and verification (#619):
- Introduced
digested=truehandling so inputs are treated as final digests (no implicit hashing) across RSA and EC paths (crypto + server). - RSA: Added verify support using pre-hashed input, including PKCS#1 v1.5 and RSASSA-PSS flows (
crate/crypto/src/crypto/rsa/verify.rs). - EC: Added verify support using pre-hashed input (
crate/crypto/src/crypto/elliptic_curves/verify.rs).
- Introduced
- Non-FIPS EC deterministic behavior (RFC 6979-like) via RustCrypto P256 implementation in non-FIPS builds.
- RSASSA-PSS: Server respects
salt_lenwhen specified (including0) duringSign.
- Added CLI and crypto tests for sign/verify flows, including digested mode
- MySQL schema missing PRIMARY KEY (#628)
- On JWT auth, token was not properly forwarded in requests (#629)
- Support COSMIAN_KMS_CONF env. variable in docker (#630)
- Support AWS ECS Fargate (#634)
- ObjectType Attribute problem (#588)
- (UI) Remove in home page the incorrect HSM comment (#639)
- Support mysql TDE while fixing the KMIP 1.x TTLV deserializer (#631)
- Cli needs snake case (#640)
- Rename .github/README.md
- Update installation instructions (#635)
- (deps) Bump sigstore/cosign-installer from 3.7.0 to 4.0.0 (#624)
- (deps) Bump crazy-max/ghaction-dump-context from 1 to 2 (#625)
- (deps) Bump actions/setup-node from 4 to 6 (#626)
- (deps) Bump actions/download-artifact from 4 to 6 (#627)
- (deps) Bump actions/download-artifact from 6 to 7 (#637)
- (deps) Bump actions/upload-artifact from 5 to 6 (#638)
- Rearrange releases (#636)
- KMIP XML Vector Conformance (1.4 & 2.1) (see details) (#583)
- Nix: Reproducible Package Management (see details) (#596):
- Create OpenTelemetryConfig to be consumed for server metrics (#610)
- Support official KMIP test vectors 1.4/2.1 (#583)
- Reproducible Package Management with Nix (#596)
- (deps) Bump docker/metadata-action from 4 to 5 (#613)
- (deps) Bump actions/checkout from 4 to 6 (#614)
- (deps) Bump crazy-max/ghaction-import-gpg from 5 to 6 (#615)
- (deps) Bump actions/upload-artifact from 4 to 5 (#616)
- (deps) Bump softprops/action-gh-release from 1 to 2 (#617)
- End-to-end alignment with the official KMIP XML test vectors across library, server routing, and CLI: Create, Query/DiscoverVersions, attribute flows, and OpaqueObject revoke/destroy are covered.
-
KMIP crate
- Operations/types/messages:
- Expanded Operation enum and message wiring to include: Interop, PKCS11, Check, RNG Retrieve, RNG Seed, GetAttributeList, MACVerify, ModifyAttribute, Log, plus responses.
- Request/Response batch items are Clone with structured Display for clearer diagnostics.
- Added Vendor OpaqueDataType; Display impls for CryptographicDomainParameters, ProtectionStorageMasks, StorageStatusMask.
- TTLV improvements:
- Deserializer coercions: Integer/Interval→i64, Enumeration/LongInteger→u8; ByteString→hex for ShortUniqueIdentifier.
- Relaxed Attribute decoding supporting VendorAttribute and AttributeName+Value forms.
- deserialize_ignored_any no-op to avoid loops in permissive paths.
- Protocol alignment:
- DiscoverVersions now uses KMIP 0.x types (protocol_version_major/minor) per spec; Query advertises operations/objects supported.
- XML support:
- Added XML serializer/deserializer and parser with tests for 1.4 and 2.1 XML vectors.
- Operations/types/messages:
-
server
- New KMIP operations exposed and routed: DiscoverVersions, Query, RNG Retrieve, RNG Seed, MACVerify, GetAttributeList, ModifyAttribute, Check.
- OpaqueObject Revoke/Destroy parity with vectors; deterministic ordering for GetAttributeList.
- RNG implementation module (ANSI X9.31) with public routing.
- Optional cascade mechanism for Destroy and Revoke.
-
CLI
- New subcommands: rng (Retrieve/Seed), mac verify, discover-versions, query.
- New opaque-object subcommands: Create/Import/Export/Revoke/Destroy (no wrap/unwrap).
-
kms_client
- REST client methods added for RNG Retrieve/Seed, MACVerify, Query, DiscoverVersions, Check, GetAttributeList, attribute ops, register, and crypto ops.
-
server_database
- Deterministic GetAttributeList behavior across backends; Locate query refinements; backend adapters updated (MySQL, PostgreSQL, SQLite, Redis-Findex).
-
crypto
- Robustness and consistency improvements to RSA OAEP and wrap/unwrap paths used by KMIP flows.
-
interfaces / hsm / access / client_utils
- Minor interface refinements and HSM integration stability improvements supporting the new routes and attribute flows.
- Export OpaqueObject Raw/Base64 returns opaque bytes (no KeyBlock).
- DiscoverVersions type/field mismatches fixed by switching to KMIP 0.x (major/minor).
- TTLV deserializer: better errors and coercions (u8 from Enumeration/LongInteger; i64 widening from Integer/Interval; vendor Attribute decoding) for XML vector compatibility.
- GetAttributeList: unified, deterministic ordering across environments.
- Extensive XML vector tests for 1.4 and 2.1 in the kmip crate (mandatory/optional suites, crypto coverage).
- Added CLI tests: OpaqueObject CRUD (create/import, export json/base64/raw, revoke, destroy), RNG Retrieve/Seed, MAC Verify, Query, and DiscoverVersions.
- Server TTLV tests expanded (e.g., DSA creation/get flows) and vector integrations.
- Added KMIP specification scaffolding READMEs and a script to generate XML-based support tables.
- Build scripts adjusted for the new test coverage and flows.
-
Reproducible builds with Nix:
- Full migration to Nix package manager for deterministic, bit-for-bit reproducible builds
- Automated hash verification system ensuring build artifact integrity across platforms
- Support for offline/air-gapped builds with complete dependency caching
- Unified build system replacing platform-specific scripts (
.sh,.ps1) - Comprehensive build variants: FIPS/non-FIPS × static/dynamic × vendor/non-vendor
- Native support for cross-platform builds (Linux x86_64/ARM64, macOS x86_64/ARM64, Windows)
-
Build infrastructure improvements:
- New
nix/directory with reproducible derivations for KMS server, OpenSSL 3.1.2, UI, and Docker images - Automated hash tracking system with 400+ expected hashes for all build artifacts and dependencies
- Deterministic OpenSSL 3.1.2 builds (both FIPS and non-FIPS variants) with static linking support
- Docker images built entirely through Nix for consistency
- Package signing infrastructure for Debian (.deb) and RPM packages
- SBOM (Software Bill of Materials) generation integrated into build process
- New
-
Testing & CI enhancements:
- Refactored GitHub workflows with comprehensive reusable components
- New test suites:
test_all.sh,smoke_test_deb.sh,smoke_test_rpm.sh,smoke_test_dmg.sh - Database-specific test scripts for MySQL, PostgreSQL, Redis, and SQLite backends
- HSM integration tests for Utimaco, Proteccio, SoftHSM2, and Crypt2pay
- Google CSE endpoint testing with HSM integration
- Systemd service file validation tests
- Docker image smoke tests with health checks
- CI/CD pipeline reorganization:
- New reusable workflow structure:
main.yml→main_base.yml/packaging.yml - Separated authentication tests by FIPS/non-FIPS variants
- Modularized test execution with dedicated scripts per component
- Common utilities consolidated in
.github/scripts/common.sh
- New reusable workflow structure:
- Comprehensive Nix build system documentation with visual diagrams:
- Build architecture and reproducibility guarantees
- Hash verification flow and offline build processes
- Package signing setup and verification procedures
- Troubleshooting guides and learning resources
- GitHub workflows documentation with complete execution flow diagrams
- Updated Copilot instructions for Nix-based development
- Build and test guide in
.github/copilot-instructions.md
- Avoid negative certificate serial number (#609)
- Remove useless css in autogenerated doc
- (deps) Bump actions/checkout from 5 to 6 (#604)
- Azure byok UI (#597)
- Upgrade Findex from v5 to v8 (#542)
- (redis): Created a new data storage schema for Redis, using a double-index instead of the "next Keyword".
- (redis): Developed a migration algorithm to update data under KMSes prior to 5.12.x.
- (redis): Introduction of strong typing for UserId and ObjectUid to reduce string manipulation errors, and created new types inspired from legacy cloudproof components.
- Used new crypto core serializations for storage (when applicable)
- Automatic key unwrapping depending on ObjectType (#600):
- Automatically unwrap keys (that are wrapped) when retrieving keys from database. It can be useful when server is configured with a Key Encryption Key that wraps all new keys. The unwrapped keys stay temporarily in expiring cache.
- This feature is combined to the parameter default_unwrap_type that filters the ObjectType to unwrap.
- Possible filters in server configuration are: All, Certificate, CertificateRequest, OpaqueObject, PGPKey, PrivateKey, PublicKey, SecretData, SplitKey, SymmetricKey
- Rework all the databases migration and represent more easy to read schemas (#542)
- Document migration flows
- Update KMS configuration TOML file with parameter
default_unwrap_type.
- (deps-dev): bump js-yaml from 4.1.0 to 4.1.1 in /ui in the npm_and_yarn group across 1 directory
- (redis): Add two integration tests that migrate from version 5.1.0 and 5.2.0 to (#542)
- Refactored migration traits between the SQL databases and the Redis one (while possible)
- Deleted a lot of dead code
- Marked the Label parameter as deprecated.
- Updated the
aes_gcm_siv_not_opensslfunctions to avoid using deprecated dependencies.
Redis users: Starting version 5.12.0, the KMS will start operating with a new version of Findex (the SSE used with the Redis DB), and a data migration is necessary :
🚨 IMPORTANT: Back up your Redis database before upgrading to version 5.12.0. 🚨
- If you're upgrading from a version prior to 5.0.0 : Please export your keys using standard formats (PKCS#8, PEM, etc.) and re-import them after clearing the redis store. Databases created with version 4.x.x are not compatible with the automated migration routine and won't start if the
db_versionkey is unset. - If you're upgrading from a 5.x DB : A transparent migration process will occur and should typically take less than a minute.
🐛 Bug Fixes (#598)
- Fix key wrapping where
wrapping-keyis itself wrapped: unwrap it and then use it - Add an automatic key unwrapping for google_cse key at server startup
- Create a
OnceCellHSM instance when multiple KMS servers are use - avoiding potential startup error - Improved handling of wrapped keys, attribute propagation, and TLS cipher suite configuration
🧪 Testing (#598)
- Add CLI-tests on Google CSE endpoints (/wrap, /privatekeydecrypt, etc.) and on Google key pair creation - all with the google_cse key wrapped by HSM
📚 Documentation (#598)
- Example of configuration file: replace deprecated [auth] section with [idp_auth]
- Rework KMIP support documentation (#595)
- Remove double entry on KMIP Support
- (windows): Enable test on whole workspace(#593)
- Add Crypt2pay HSM integration with a dedicated loader crate
- Generic "other" HSM support using Softhsm2 compatibility
- Enable empty (null) password/pin HSM login via special handling in slot management
- Add Windows/macOS installers with cargo packager tool (#585)
- (google_cse) Load RSA private as PKCS8 or PKCS1 format (#592)
Gmail CSE users: Versions 5.8/5.9 and 5.10 contain a blocking issue with Gmail Client-Side Encryption support (issue loading PKCS#8 RSA private key). Please upgrade to version 5.11.0 or later to ensure proper Gmail CSE functionality.
- Add KMIP current support (#581)
- (deps) Bump esbuild (#587)
- Add HSM key search with basic filters (#552)
- Support wrapping SecretData object in export (#551)
- Support DeriveKey KMIP operation (#554)
- Add option to enable automatic unwrapping for Get and Export requests (#579)
- Enable workspace clippy lints for all crates (#553)
- Release HSM tests (#567)
- Keep error info on DBerror (#516)
- React CVE deps (#566)
- Remove min_specialization feature (#569)
- HSM key search fails after encountering incompatible key (#574)
- (windows) Socket server listen on localhost instead of 0.0.0.0 (#575)
- Add SmartCard HSM to README.md (#563)
- Added documentation for Smart card HSM and SoftHSM2 (#570)
- Add server configs examples (#568)
- Filter tests with credentials and prerequisites (#571)
- Enable Google CSE on workspace
- Add CLA Assistant GitHub Action configuration
- Create CLA.md and CONTRIBUTING.md
- About forks, skip Google CSE tests and docker build
- About dependabot branches, skip Google CSE tests and docker build (#559)
- Move CLA assistant workflow to correct path
- Skip public doc rebuild on forks and dependabot branches
- Skip CLA assistant on dependabot branches
- Integrate CLA signature in main_base.yml workflow - 2
- Trigger on issue comment
- Use an unprotected branch for CLA signing
- Remove trigger on pull_request_target
- Upgrade toolchain to nightly 2025-09-15 (#564)
- (deps) Bump actions/checkout from 4 to 5
- (deps) Bump the npm_and_yarn group across 1 directory with 4 updates
- Add Smart card HSM support and bug fixes (#538)
- CLI features:
- tracing: print function names while using tracing macros. Use cosmian_logger instead of tracing crate (#536)
- When wrapped with
No Encoding, the RSA private key bytes and EC private key bytes are now the PKCS#8 DER bytes (#541) - CLI: fixed broken
attributes get(#541)
- Added Google CSEK and Google CMEK documentation (#541)
- Added Azure BYOK documentation (#541)
- Re-organized documentation (#541)
- Fixing typo in Encrypt/Decrypt requests examples (#545)
- Enable softhsm2 tests (#539)
- Fix python installation on pykmip-tests GH workflow
- Fix race condition on test_privileged_users
- Add auth test with expired cert (#547)
- Server crate publish (#534)
- Add KMIP operations
SignandVerifySignaturefor digital signature support (#511) - Add TLS cipher suites selection (#524)
- (google_cse) Further restrict access to CSE privileged unwrap endpoint (#517)
- Fix potential race condition in Google CSE migration key pair creation when multiple servers start simultaneously (#519)
- Simplify clap JWT Auth configuration (#531)
- Add non-fips UI build (#532)
- Fix Credential parsing in KMIP Request Message (#529)
- Use crypto core for db crypto (#526)
- Cloudproof reexports (#528)
- (percona) Add correction to percona doc (#521)
- (hsm) Added KMS-HSM integration workflow graph (#523)
- Fixes CLI Key Wrapping documentation on export (#530)
- Clarify Gmail CSE CA authority usage (#533)
- Uniformize clippy lints on all crates (#525)
- Create SECURITY.md with vulnerability tracking and reporting guidelines (#527)
- Add support HTTP forward proxy (for intermediate CLI crate) (#509)
- PKCS11: move PKCS#11 docs into cli repository (#510)
- Google CSE: save openssl commands to verify resource hash computation
- In JWT auth, change
audiencetype fromStringtoVec<String>(#491) - Support AES-CBC encryption without padding for Oracle TDE support (#493)
- Add support for existing PKCS12 leaf certificates when creating Google CSE keypairs (#505)
- Support debian 10 for old glibc compatibility (required for Oracle TDE) (#508)
- Add GitHub Copilot instructions for KMS development workflow (#504)
- Test docker container once generated by ci (#481)
- Use machete and publish crates on tags (#499)
- Remove test data folder (#497)
- Reorder crates in Cargo.toml
- Fix docker image name in tests (#500)
- Automate CVE resolution (when possible) by mirroring deny.toml in .cargo/audit.toml
- Remove useless and old UI files (#487)
- Test_kms_server must remain dev-dependency (#486)
- Enable native TLS support for OpenID Connect authentication (#489)
- Display CSE information from UI (#478)
- Fix outdated UI pkg
- Rocky package must be NON-FIPS (#482)
- Add MongoDB documentation (#483)
- Improve User Interface documentation
- Support for TLS 1.3 on the HTTPS port of the KMIP server (#458)
- Fixed RevocationReasonCode in KMIP 1.x (#460)
- Better support of PyKMIP client (#438)
- Support for Percona PostgreSQL TDE (Transparent Data Encryption) (#464)
- Support for Secret Data (#398)
- Fixed an issue with Locate failing when an HSM is present
- Fixed missing attributes when the wrapped object is not in the cache (#462)
- Added support for SoftHsmV2 (#457)
- Implement Register KMIP Operation
- ANSI colors in stdout are now disabled by default but can be re-enabled using a configuration flag
- Handle extension file to define x509 setup extensions for Google CSE keypairs create command
- Fix the default path for the
kms.tomlfile on Windows - Full configuration
kms.tomlfile for Linux packaged distributions - Handle KMIP Dates as OffsetDateTime instead of i64
- Display items ID on Google keypairs creation command
- Missing documentation on the rolling file appender in the server configuration file
- Update README.md to reflect that the KMS now builds in FIPS mode by default
- Test custom JWT used from Google CSE migration endpoints
- Test Import and Register KMIP operations
- Fix error on Google CSE migration authentication
- Support for daily rolling log files to a specified directory
- Invert fips feature (#448)
- Google CSE - Added support for all algorithms in private_key_decrypt
- Google CSE - Added support for all algorithms in private_key_sign
- Align UI version with Cargo workspace
- In UI, fix
IvCounterNonce(#446) - (Linux packages) Save and restore conf during installation
- Interoperability fixes with PyKMIP
- Remove reference of cosmian_gui
- Markdown fixes
- Rename cli repo
- (windows) Reduce verbosity
- Support for MySQL 8.0.42 and higher (#443)
- Fix clap error on cse keypair command
- Support for outbound proxy to fetch the JWKS (JSON Web Key Set) (#439)
- Support for JWKS (JSON Web Key Set) that provides JWK not appropriate for OIDC authentication (#433)
- Safer handling of Google CSE authorization token decoding (#431)
- Support custom JWT authentication for external KACLS using an RSA keypair in the Google CSE migration flow
- Expose the RSA public key via the new
/certsendpoint - Rewrite
/rewrapendpoint to fully support the migration flow logic - Rewrite
/privilegedunwrapendpoint to properly integrate with the migration process - Support for PKCE (Proof Key for Code Exchange) authentication from the CLI with the Cosmian KMS
- Concurrent multi-factor authentication with clear cascading rules (OIDC / Client Certificates / API Token)
- Unclear cascading rules in multi-factor authentication
- Refactor server configuration to include a dedicated google_cse section
- Derive the Google CSE KACLS URL from the public_url configuration value for better flexibility
- Expose user_id in the response from the /token endpoint for improved UI identification
- Add unit tests for Google CSE digest computation, validating against Google's official documentation appendix
- Test custom JWT generation and parsing to ensure compatibility and correctness
- Revise the Google CSE documentation section for clarity and accuracy
- Add a new section on migrating Google CSE data from Drive, including practical steps and examples
- PKCE documentation with configuration examples
- Improved authentication documentation, both client and server side
WARNING: This is a breaking change release. Databases created with version 4.x.x are not compatible with version 5.0.0. Please export your keys using standard formats (PKCS#8, PEM, etc.) and re-import them after upgrading.
- Support for KMIP 1.0, 1.1, 1.2, 1.3, 1.4, 2.0, 2.1 (#412)
- Binary TTLV for all KMIP versions on port 5696
- JSON TTLV for all KMIP versions on port 9998, endpoint /kmip
- VMware support
- Possible automatic key wrapping on Create and Import
- Better telemetry using OTLP and logs to syslog
- Run KMS server with privileged users (#408):
- These users can grant or revoke create access rights for other users
- Without
Createaccess right or privileged status, users can't create or import objects to KMS
- Rationalize SQL implementation (#379)
- Rust KeyBlock implementation not fully compliant with KMIP 2.1 specs (#76)
- Multiple fixes in KMIP 2.1 TTLV formats
- More extensive coverage of KMIP attributes
- Database schema changes
- Add support for Oracle Transparent Database Encryption (TDE) using Oracle Key Vault (#396)
- Add missing artifacts on tags (#407)
- Missing folder assets in DEB/RPM (#406)
- Align Docker build image to the wasm-pack prebuild binary for ARM cross-build
- Add digest and MAC KMIP operations (#370)
- Upgrade Covercrypt to v15 (#382)
- Add CBC encryption mode (#395)
- Add UI (#391)
- Shrink docker images size using slim-bullseye base image (#377)
- Clean unneeded test files (#392)
- RUSTSEC-2025-0009:
ring: Some AES functions may panic when overflow checking is enabled. - RUSTSEC-2025-0022:
openssl: Use-After-Free in Md::fetch and Cipher::fetch
- Move all CLI relative crates on https://github.com/Cosmian/cli (#383)
- Fix Google expected X509 extensions
- Add HSM tests using Utimaco simulator (#380)
- Reuse generic Github workflows (#401)
- Fix rhel9 artifact name
- Utimaco General Purpose HSMs support (#367)
- Fixed HSM base code dangling pointer issue in
releasemode - Fixed unwanted
ValueEnumincosmian sym encrypt - Remove ckms linux packages in favor of cosmian packages (#366)
- Rename binary
cosmian_kms_servertocosmian_kms- reuse the same name as marketplace images
- Clarified installation documentation
- Improved database configuration
- Improved HSM integration documentation
- Add how to release doc (#361)
- Change default port of KMS package from 8080 to 9998 (#364)
- VM marketplace guide examples (#365)
- (google_cse) Update authentication section (#363)
- Allow continue on error (#362)
- (google_cse) Typos in configuring .well-known file (#359)
- Fix publish on package.cosmian.com
- Add server param to disable (if needed) Google CSE JWT token validation (#349)
- Add remove option to
Destroy+ Object not found error message fix (#357)
- Save configuration file outside of clap actions (#351)
- Fix an incorrect message on 'object not found' (#353)
- Fix bad links and mkdocs formatting
- Simple review (#358
- Explain default KMS configuration on CVM (#359
- Better build with mkdocs; faster Mermaid support and better Katex support
- Add CLI bench command (#348)
- Re-expose clap actions for other CLIs (cosmian, ckms_gui) (#339)
- Revisit the mkdocs documentation (#339)
- HSM support (#344)
- support for the Proteccio HSM that provides both
- the ability to perform the Create, Destroy, Export, Encrypt, and Decrypt operations on the HSM
- the ability to create keys in the KMS that are wrapped by a key in the HSM
- the database components are now in a separate crate
server_database. They are now split in 2 implementations: Objects store and Permissions store - a new
interfacescrate gathers interfaces to be implemented by new external components. Interfaces include:- Object Store
- Permissions Store
- Encryption Oracle
- key unique identifiers now support prefixes. Object Stores, Permissions stores, and Encryption Oracles can be registered against the prefixes.
- support for the
SensitiveAttribute in addition to the ability to wrap a key by another key has been added to all keys creations
- support for the Proteccio HSM that provides both
- Make keys non revocable on server (#341)
- Docker for Linux ARM and keep support for MacOS Intel (#343)
- The macOS-12 environment is now deprecated
- Better permissions checking on wrapping and unwrapping
- Add benchmarks on simultaneous encryptions/decryptions
- Maturin build on macos arm - force forward compatibility (#336)
- Launch encrypted GMeet through GCal (#334)
- MacOS-maturin: Upgrade python version from 3.12 to 3.13 (#333)
- Dont panic on indexing slicing (#331)
ckmsinstallation - specifically for Windows (#332)
- Client
ckms: merge attributes handling (set/get/delete) underattributessubcommand (#329)
- Guard on size of ciphertexts for BulkData (#330)
- KMIP Attributes: fix deletion on Links and Vendor Attributes (#329)
- Google Workspace Client-Side-Encryption (CSE)
updates (#319)
- Generate Google S/MIME key-pairs and identities and upload them to Gmail API from ckms CLI (#270)
- Server-side, export cert at PKCS7 format
- Implement missing CSE endpoints
- Wrap/unwrap CSE elements with authenticated encryption
- Export wrapped keys from KMS specifying the cipher mode
- Handle auth for guest users (#271)
- Add SetAttribute/DeleteAttribute KMIP operations (#303)
- Re-enable wrap/unwrap on ckms by linking statically on openssl (#317)
- Added AES GCM-SIV and AES XTS (#328)
- Added the ability to client side encrypt files with
ckmsand a hybrid scheme (#328) - Create Symmetric Key / Private keys with custom unique id (#326)
- Add bulk encrypt / decrypt facility (#318)
- Replace Debug derive trait of KMIP Object by a custom Display impl (#327)
- Documentation: Migrating emails to Gmail CSE (#316)
- Update CSE documentation (Gmail S/MIME) (#316)
- Update KMS build instructions (#320)
- Add test on database backends (#311)
- Reduce CI pipeline duration in debug (#315)
- Add CSE endpoints testing (#319)
- Clippy hardening in crate
kmip(#304)
- Add ReKey KMIP operation (#294)
- Add API token authentication between server and clients (#290)
- Build a generic database upgrade mechanism (#299)
- Export of certificates can now be performed using the certificate id (instead of just the private key id)
- More intuitive PKCS#12 import (#306)
- Support for export under legacy PKCS#12 format (#306)
- Documentation (S/MIME)
- KMIP Attributes:
- Certificates handling/tasks:
- Merge decrypt match in same function (#295)
- Fix Public RSA Key size in get attributes (#275)
- RUSTSEC:
- CLI doc fixes (certificates certify)
- Fix PKCS#12 export of self-signed cert (#305)
- Fix serialization of
Attributesinredis-findex(#307)
- clippy tasks:
- Rename MacOS artifacts giving CPU architecture
- Configure
ckmsto build reqwest with minimal idle connections reuse (#272) - Do not delete tags if none are provided (#276)
- De-activated Google CSE tests when tokens are not supplied through env. var.
- Cleaned-up and improved certificates import tests
- Made test DB backend selectable using env. var.
KMS_TEST_URL
- Add KMIP operation
Validatefor certificates (#247) - Added RSA benchmarks (#251)
- Add OpenTelemetry OTLP protocol support to KMS server (#253)
- Support for multiple certification scenarios and self-signing (#248)
- Create Debian/RPM packages for Ubuntu 2x.04 and RHEL 9 (#264)
- Drop Centos 7 support (#265)
- Replace
cargo auditwithcargo deny(#245) - Replace Linux cross-compiling for Windows with compiling on Windows Github runner (#249)
- Add support for build on MacOS ARM
- Fixed import of symmetric key tag to '_kk' from '_sk'
- Add support for LUKS via PKCS#11 module
- Add support for CKM_RSA_PKCS (PKCS#1 v1.5) for RSA encryption/decryption
- Create Gmail key pairs and identities with
ckmsvia Gmail API (#243)
- Comment out mermaid configuration
- Add Google Workspace CSE endpoints for **encrypted Gmail ** (#192)
- Oauth2 OIDC doc fixes
- Add license to KMS GCP image (#235)
- Re-enable the validation of JWT Issuer URI
- Fix CSE error status code, propagating the right status code instead of generic server code error
- Handle many identity providers in jwt authentication
- New command line argument
--key-usageto define key or certificate usage on import - Exhaustive verification that the key used to perform cryptographic operations is allowed to do them
- KMIP object creation can now precisely define the usage of the key it describes
- Add standalone workflow to test KMS in Cosmian VM (#233)
- Rebase KMS GCP image on Cosmian VM 1.1.0-rc.4
- Remove optimization RUSTFLAGS (#227)
- Rebase KMS GCP image on Cosmian VM 1.1.0-rc.3
- Fixed double quotes problem in cosmian vm test (CI)
- Fixed trailing null byte bug for biguint/bytes conversions (#224)
- Make the CLI compile on Windows and macOS (without openssl installed) (#209)
- Support Veracrypt PKCS11 provider library (#208)
- Update
test_kms.pyto use covercrypt14.0.0(#217)
- Add missing image_licenses in packer for GCP (#219)
- Push GCP images based on Cosmian VM 1.1.0-rc2
ckmsneedskmipdependency with featuresopenssl(#202)
- Push GCP images on cosmian-dev and cosmian-public only once (#203)
- Filter reboot test on GCP/RHEL instance.
- Add build of GCP images (ubuntu/redhat) #191.
- Save KMIP Attributes in a proper column of
Objectstable #166:- Remove all custom tags
_cert_spki,_cert_cn,_cert_issuerand_cert_sk
- Remove all custom tags
- Add support for CoverCrypt
rekey,prune, andPolicyediting methods #179:- Add CLI commands to perform these actions
- Accurate CryptographicUsageMask for KMIP creation (RSA and EC keys) #189 and #187.
- Rework utils/crypto #178.
- Fixing inconsistent crypto consts #190.
- Fix interpolation in error macros #184.
- Move internal KMIP Objects into
Boxto avoid stack memory overflow #200.
- Generalize the refresh of JWKS in the middleware #150.
- CI speed up #173.
- Add support for Microsoft Double Key Encryption (DKE) endpoints #170.
- Re-organized crypto package by algorithm, removed duplicated code #170.
- Add support for FIPS mode for the ckms client #170.
- Documented TOML configuration file for the KMS server #170.
- Overall improvements to the documentation on algorithms and FIPS mode #170.
- CLI: allow multiple operations to be supplied at once for access control #155.
- Business Source License 1.1
- Test and deliver in CI missing FIPS binary (fips.so and openssl.cnf for FIPS) #152
- Load correct openssl provider on run
- Pypi now requires a token to publish #148
- X509 v3 extensions support #120
- Dynamic salt for password derivation, resolving issue #124 #128
- Support Cosmian VM #129
- Make rsa oaep aes a generalized encryption system for use in all kms and not only for key wrapping #130
- ECIES implementation for Hybrid Encryption #134
- Add pyo3 methods for
symmetric
create_key,encrypt,decrypt#135 - Add RSA keys create key pair #137
- Upgrade Rust toolchain to 2024-01-09 #141
- Support keypair generation for curve448 Montgomery and edwards forms #143
- Fix mkdocs formatting
- Support for certificate generation using the Certify KMIP operation and a PKCS#10 or a public key
- Support for most standardized encoding formats on import.export: PKCS#8, PKCS#1, SEC1, X509, PKCS#12
- Improvements to the Locate functionality for attributes and tags
- Support for the Get Attributes KMIP operation
- Database: support for atomic operations
- Replaced part of Rust Crypto with openssl for more standardized module support
- Deactivated automatic certificate verification, which will be reallocated
for the future
ValidateKMIP operation support #102 - Deactivated the non KMIP compliant certificate "quick create feature",
which can now be achieved using the
CertifyKMIP operation #103
- Redis-Findex:
createnow checks for the pre-existence of the object - Better KMIP compliance:
- KMIP server operations only support DER format for certificates (#89)
- fix: migrate to num-bigint-dig for bigint (#85)
- Test KMS inside an SGX machine
- Update Covercrypt version to support Policy V2 ([#63])
- Generalize bulk operations using KMIP
Messagesstructure
- Save certs as DER instead of PEM for KMIP compliance
- Fix for #64
- Fix container build on tags
- Serialize the header for each chunk for Covercrypt bulk encryption (#59)
- KMS running inside TEE (SGX or SEV)
- review the
verifysubcommand - force checking the leaf TLS certificate when querying a KMS running inside a TEE
- verify RA-TLS certificate before querying the bootstrap server
- review the TLS certificate generation using the key tied to the TEE
- remove libsgx and create a new dependence to tee_attestation crate
- update KMS server argument regarding the TEE and certbot
- review documentation regarding the KMS usage inside a TEE
- review the
- Activate tracing in CLI tests when binary is instrumented ([#56])
- Trigger public_documentation build on tags
- Added the wildcard user
*to grant access rights to all users on an object - About certificates:
- add validation of the complete chain instead of the leaf and parent certificates
- add verifications before using a certificate:
- check that each certificate is not expired (both chain and leaf certificates)
- check that no certificate is revoked (both chain and leaf certificates)
- check that each certificate has a valid signature (both chain and leaf certificates)
- check that certificate CRL signature is valid
- add RSA X509 certificate support
- add Covercrypt bulk encryption
- KMS CLI
ckms:- can import the Mozilla Common CA Database (CCADB)
- can import a PKCS12 certificate (splitting in 2 KMIP objects: X509 certificate and private key)
- Improved database data structures using Maps and Sets instead of Vectors where uniqueness is required
- Enable bootstrap server for non "enclaves" servers
- Filter Locate request by object type
- Remove merge leftovers
- bootstrap: the KMS server now supports bootstrap mode to facilitate the secure input of secret components, including the database encryption secret and the HTTPS certificate key, directly into the encrypted machine memory, through a secure connection
- Add certificate support:
- in cosmian_kms_server:
- implement
CertifyKMIP operation - in addition, the KMS server will automatically add:
- the system tag
_certonCertificateobject - the system tag
_cert_uid=<certificate_uid>wherecertificate_uidis used as the link between public/private key objects and the related certificate object - the system tag
_cert_spki=<Subject Public Key Info>onCertificateobject where SPKI refers to RFC 5280. The SPKI value identifies uniquely the underlying certificate - the system tag
_cert_ca=<Subject Common Name>on CACertificateobject
- the system tag
- import X509 certificate as PEM and also import private key as PEM
- export generic KMIP key
wrappedby X509 certificate - import a wrapped key with unwrapping on the fly
- encrypt with X509 certificate and decrypt with PKCS8 private key
- implement
- in
ckms, add:- create/destroy certificate
- export/import certificate
- revoke certificate
- in cosmian_kms_server:
- Add the export wrapping with X509 certificate encryption
- Documentation
- tagging: the KMS server now supports user tagging of objects to facilitate their management. Specify as many user tags as needed when creating and importing objects.
In addition, the user server will automatically add a system tag based on the object type:
_sk: for a private key_pk: for a public key_kk: for a symmetric key_uk: for a Covercrypt user decryption key
Use the tags to export objects, locate them, or request data encryption and decryption.
- Added
locateto theckmsclient - Added
Redis-Findexbackend support so that the KMS can encrypt the KMS server data and indexes at the application level. - Added JWE support
- Remove RUSTFLAGS for docker container and python package
- Update sqlx to 0.7 + bitflags and base64-url to version 2
- Support glibc v2.17 when building ckms and cosmian_kms_server
- Incorrect docker tag
- Add description on docker usage
- Added the ability to manipulate EC and Symmetric Keys
- Added ECIES encryption (using Curve 25519) and AES GCM encryption
- Added support for policy specifications
- Reworked Revoke and Destroy to be closer to KMIP definitions
- Revoking and Destroying a public/private key, revokes or destroy all the related keys
- Upgrading of SQLX
- Upgrading of PKCS12 support
- Removal of Eyre in the CLI
- Use of cloudproof_rust as a dependency rather than Covercrypt and Crypto Core directly to avoid version conflicts
- Authentication:
- support for more JWT providers
- support for certificate authentication
- Removal of global static conf and use of proper injection (was hindering testing)
- Authorization: re-factor of endpoints and fix delegation issues around revoke and destroy
- Add link to package.cosmian.com
- Add github ci
- Publish python kms packages
- Refactored the server to simplify traits and separate the operations into smaller files
- Python KMS client (pyo3): export
database_secretandinsecureas parameters
- Update cover crypt in python tests
- Use CoverCrypt v11
- Removed
mysqlcrate used for EdgelessDB (compatible with client SSL connection) - Use workspace dependencies to ease maintenance
- mkdocs-merge could not run with
emoji_indexurl
- Remove unused docker builds
- Improves the installation doc and details the important options
- Makes wording coherent between doc and code
- adds native HTTP/S support by providing certificates
- improves encrypted SQLite support
- removes multiple features on the KMS server and makes them command-line options.
- There is now a single docker (115MB) that covers all cases (except SGX, which will come later)
- removes the use of crypto_base and makes use of cover-crypt 10.0
- Use CoverCrypt v9.0 (post-quantum cryptography) and AbePolicy v3.0
- Write
Policyas bytes andAccessPolicyas string in Vendor Attributes
- Write
- Fix tag matching in
python_publish
- add python interface
- CoverCrypt v9 / CryptoCore v5 / AbePolicy v3.0
- CLI Policy interface (format changed with AbePolicy v2.1)
- add authentication data in header too in encrypt operation
- data to encrypt with CoverCrypt is not a JSON anymore but a custom binary format (
see
DataToEncryptstruct) - decrypted data with CoverCrypt is now a custom binary format (see
DecryptedDatastruct)
- Support
cover_crypt7.1.0
- Rename KMS URL
- Remove AVX flag
- Update
cover_cryptto 7.0.1 - Update crates dependencies
- GPSW support
- TFHE support
- DMCFE support
- Handle CORS request
- Update installation documentation