Build a `CreateKeyPairRequest` for an elliptic curve

Get the user from the request depending on the authentication method.

Returns the `KeyBlock` of that object if any, an error otherwise

Return the key material of a symmetric key, raw or transparent. The PKCS#1 of an RSA Key, etc.

Retrieve a single object from the database. This method retrieves an object identified by its `uid` and applies user and state filters to determine i

Extract the `key_uid` (prefixed by a pattern) from a text

Open a new session with the HSM slot. The session can be read-only or read-write, depending on the `read_write` parameter. # Arguments `read_write` -

This operation requests the server to generate a new public/private key pair and register the two corresponding new Managed Cryptographic Object The r

Returns the current UTC time with milliseconds set to zero. This function is used to normalize timestamps across the KMIP implementation, ensuring co

Load a client config template from `test_data/configs/client/{template}`, patch the `server_url` port to match the running test server, resolve relati

Run a ckms command expecting failure, return the stderr message.

Assert common certificate properties: subject CN, issuer CN, validity, and serial number ≤ 20 bytes.

Retrieve DER bytes of a certificate object.

Insert or update a cached object.

Set the tags on the attributes

Remove all object handles from the cache.

This operation requests that the server returns the Managed Object specified by its Unique Identifier. Only a single object is returned. The response

Spin up a fresh, empty in-process KMS instance with an `SQLite` backend. No network access is required.

Set a link to an object. If a link of the same type already exists, it is removed. There can only be one link of a given type.

Build an ` Import ` request for a generic Object

Issue a PQC certificate via the KMIP `Certify` operation. When `issuer_cert_id` and `issuer_sk_id` are `None` the certificate is self-signed (root CA

Retrieve a single object for a given operation type or the Get operation if not found. When tags are provided, the function will return the first obj

This operation requests the server to perform an encryption operation on the provided data using a Managed Cryptographic Object as the key for the enc

Execute the operation once, returning `true` on success. For `PreSerialized` ops the request bytes are sent without any serialization, and the respon

Determine whether the unique identifier has a crypto-oracle prefix. Supports two HSM UID formats: - Old: `hsm::<slot_id>::<key_id>` → prefix = `"hsm"

This operation requests the server to Import a Managed Object specified by its Unique Identifier. The request specifies the object being imported and

Post-serialization normalization pass. See prior implementation notes in serializer.

Centralises metrics instrumentation boilerplate so that public methods stay focused on their core logic. Accepts a future representing the database o

Validate a chain expressed as a slice of cert IDs. Asserts `Valid`.

Record a benchmark name as skipped/unsupported (for compact output).

Read an object from a KMIP JSON TTLV file # Errors If the file cannot be opened or read, an error is returned.

This request is used to generate a Certificate object for a public key. This request supports the certification of a new public key, as well as the ce

Build a `CreateKeyPairRequest` for a RSA key pair.

Build an Encryption Request to encrypt the provided `plaintext`. The cryptographic scheme is determined by that of the key identified by `key_unique_

Get an object If the request contains a `KeyWrappingData`, the key will be wrapped. If the request contains a `KeyWrapType`, the key will be unwrappe

Convert a KMIP Private key to openssl `PKey<Private>` The supported `KeyFormatType` are: PKCS1 `ECPrivateKey` (SEC1) PKCS8 (not encrypted only) `Tran

TLS + certificate authentication. Configuration is loaded from `test_data/configs/server/cert_auth.toml`.

Returns the `Attributes` of that object if any, an error otherwise

This operation requests the server to perform a decryption operation on the provided data using a Managed Cryptographic Object as the key for the decr

This operation requests the server to perform an encryption operation on the provided data using a Managed Cryptographic Object as the key for the enc

Fetch the element that will be deserialized next Updates the `at_root` status if the deserializer is at the root

Send a `Revoke` request with the given `reason_code` and `cascade` flag. Returns the parsed `RevokeResponse` on success, or a `KmsError` on failure.

Return the response body as a UTF-8 string. # Errors Returns an error if the body is not valid UTF-8.

Create a self-signed CA keypair + certificate using `build_certify_request` with `generate_key_pair = true` and no issuer.

Export an Object from the KMS # Arguments `kms_rest_client` - The KMS client connector `object_id_or_tags` - The KMS object id or tags `params` - Exp

Generate a random nonce for the given symmetric cipher.