Apply rotation policy attributes via `SetAttribute` calls on the given key ID. When `--enroll-keyset` is set, the keyset name is automatically set to

Override the database backend used by `start_default_test_kms_server` via the `KMS_TEST_DB` environment variable. | `KMS_TEST_DB` value

Export a batch of Objects from the KMS The objects are exported in a single request and the response is a list of results. The objects are exported i

Test that any legacy value (`0x8000_000D`) is correctly migrated to `BlockCipherMode::AESKeyWrapPadding` (`0x0000_000C`) when objects are retrieved fr

Build a `SymCipher` from the data encryption algorithm and the DEK length.

Construct the JWE AAD bytes per RFC 7516 §5.1 step 14. - No external `aad`: `ASCII(protected_b64)` - With external `aad`: `ASCII(protected_b64 + "."

Build a `Revoke` request to revoke the key identified by `unique_identifier`

Return the CEK size in bytes for a given content-encryption algorithm. Per RFC 7518 §5.1: - A128GCM → 16 bytes (128 bits) - A192GCM → 24 bytes (192 b

Asymmetrically wrap keys referring to PKCS#11 `CKM_RSA_AES_KEY_WRAP` available at <http://docs.oasis-open.org/pkcs11/pkcs11-curr/v2.40/cos01/pkcs11-cu

Close the session and log out if necessary

Create a symmetric key that can be used for derivation using `KmsClient` directly

Create an EC P-256 keypair and return `(private_uid, public_uid)`.

Create an EC P-256 key pair and return `(private_uid, public_uid)`.

Create a signed JSON Web Token (JWT) for authenticating a KACLS migration request. This token includes standard claims such as `iss` (issuer), `aud`

Create and store a fresh 256-bit AES symmetric key in the given `state`.

Compute a MAC via the CLI. `extra_args` are appended after `["mac", "compute"]`.

Decrypts the ciphertext using the specified key and tweak and returns the plaintext as a `BigUint`. # Parameters - `ciphertext`: A `BigUint` represe

This operation requests the server to delete an attribute associated with a Managed Object. The request contains the Unique Identifier of the Managed

Encrypt plaintext with the given key, returning the JSON encrypt response.

Generate an "Invalid Message" KMIP error response message in TTLV format

Finalize the encryption and return the ciphertext and the tag.

Find objects by their `x-rotate-name` vendor attribute. Queries all registered object stores and returns matching `(uid, attributes)` pairs.

Verify that `find_due_for_rotation` returns exactly the objects that are `Active`, have `rotate_automatic = true`, and whose rotation deadline has alr

Find the first leaf value in a TTLV JSON tree matching the given tag name.

Query the `State` attribute of a key via KMIP `GetAttributes`.

GET tags from a key; returns the parsed response body.

Validates the provided authentication and authorization tokens, and extracts the content. This function takes the authentication and authorization to

Grant access to a user (identified by `access.userid`) to an object (identified by `access.unique_identifier`) which is owned by `owner` (identified b

Grant the ability to `user` to perform the KMIP `operations` on the object identified by its `uid`

Send an HTTP request and return the parsed JSON body, or a descriptive error including the URI and backend name.

Inject `EncryptResponse` artifacts (ciphertext, IV/nonce, tag) into any Decrypt request batch items that have missing or empty placeholder fields. Exi

Build a minimal valid Integer item encoded in TTLV binary format. Layout: [tag 3B][type 1B][length 4B][value 4B][padding 4B] = 16 bytes total. Uses

Returns `true` if `user` is an HSM admin. Wildcard `"*"` grants access to every user.

--------------------------------------------------------------------------- Helper: send a KMIP 1.x `GetAttributeList` and return the advertised names