XML Key Management Specification (XKMS) uses the
web services framework to make it easier for developers to secure inter-application communication using
public key infrastructure
A public key infrastructure (PKI) is a set of roles, policies, hardware, software and procedures needed to create, manage, distribute, use, store and revoke digital certificates and manage public-key encryption. The purpose of a PKI is to facil ...
(PKI).
XML
Extensible Markup Language (XML) is a markup language and file format for storing, transmitting, and reconstructing arbitrary data. It defines a set of rules for encoding documents in a format that is both human-readable and machine-readable. ...
Key Management Specification is a protocol developed by
W3C which describes the distribution and registration of public keys. Services can access an XKMS compliant
server in order to receive updated key information for
encryption
In cryptography, encryption is the process of encoding information. This process converts the original representation of the information, known as plaintext, into an alternative form known as ciphertext. Ideally, only authorized parties can dec ...
and authentication.
Architecture
XKMS consists of two parts:
;X-KISS: XML Key Information Service Specification
;X-KRSS: XML Key Registration Service Specification
The X-KRSS defines the protocols needed to register public key information. X-KRSS can generate the key material, making key recovery easier than when created manually.
The X-KISS outlines the syntax that applications should use to delegate some or all of the tasks needed to process the key information element of an XML signature to a trust service.
In both cases the goal of XKMS is to allow all the complexity of traditional PKI implementations to be offloaded from the client to an external service. While this approach was originally suggested by Diffie and Hellman in their New Directions paper this was generally considered impractical at the time leading to commercial development focusing on the certificate based approach proposed by
Loren Kohnfelder.
Development history
The team that developed the original XKMS proposal submitted to the W3C included
Warwick Ford,
Phillip Hallam-Baker (editor) and
Brian LaMacchia. The architectural approach is closely related to the MIT PGP Key server originally created and maintained by Brian LaMacchia. The realization in XML is closely related to
SAML, the first edition of which was also edited by Hallam-Baker.
At the time XKMS was proposed no security infrastructure was defined for the then entirely new
SOAP
Soap is a salt of a fatty acid used in a variety of cleansing and lubricating products. In a domestic setting, soaps are surfactants usually used for washing, bathing, and other types of housekeeping. In industrial settings, soaps are used ...
protocol for Web Services. As a result, a large part of the XKMS specification is concerned with the definition of security 'bindings' for specific Web Services protocols.
See also
*
XML Signature
XML Signature (also called ''XMLDSig'', ''XML-DSig'', ''XML-Sig'') defines an XML syntax for digital signatures and is defined in the W3C recommendationbr>XML Signature Syntax and Processing Functionally, it has much in common with PKCS #7 but is ...
and
XML Encryption XML Encryption, also known as XML-Enc, is a specification, governed by a W3C recommendation, that defines how to encrypt the contents of an XML element.
Although XML Encryption can be used to encrypt any kind of data, it is nonetheless known as "X ...
, two other W3C standards used by the XKMS protocol.
External links
XKMS at SQLDataXKMS at the W3C
Cryptographic protocols
Computer network security
Cryptography standards
XML-based standards