The Key Management Interoperability Protocol (KMIP) enables communication of cryptographic keys between a key management server and its clients. The keyring_okv  keyring plugin uses the KMIP 1.1 protocol to communicate securely as a client of a KMIP back end. Keyring material is generated exclusively by the back end, not by keyring_okv . The plugin works with these KMIP-compatible products: 

•Oracle Key Vault 

•Gemalto SafeNet KeySecure Appliance 

•Townsend Alliance Key Manager 

The keyring_okv  plugin supports the functions that comprise the standard MySQL Keyring service interface. Keyring operations performed by those functions are accessible at two levels: 

•SQL interface: In SQL statements, call the functions described in Section 6.4.4.14, “General-Purpose Keyring Key-Management Functions” . 

•C interface: In C-language code, call the keyring service functions described in Section 5.6.9.2, “The Keyring Service” . 

Example (using the SQL interface): 

SELECT keyring_key_generate(’MyKey’, ’AES’, 32); SELECT keyring_key_remove(’MyKey’); 

For information about the characteristics of key values permitted by keyring_okv , Section 6.4.4.12, “Supported Keyring Key Types and Lengths” . 

To install keyring_okv , use the general instructions found in Section 6.4.4.3, “Keyring Plugin Installation” , together with the configuration information specific to keyring_okv  found here. 

## General keyring_okv Configuration 

•General keyring_okv Configuration 

•Configuring keyring_okv for Oracle Key Vault 

•Configuring keyring_okv for Gemalto SafeNet KeySecure Appliance 

•Configuring keyring_okv for Townsend Alliance Key Manager 

•Password-Protecting the keyring_okv Key File 

Regardless of which KMIP back end the keyring_okv  plugin uses for keyring storage, the keyring_okv_conf_dir  system variable configures the location of the directory used by keyring_okv for its support files. The default value is empty, so you must set the variable to name a properly configured directory before the plugin can communicate with the KMIP back end. Unless you do so, keyring_okv writes a message to the error log during server startup that it cannot communicate: 

[Warning] Plugin keyring_okv reported: ’For keyring_okv to be initialized, please point the keyring_okv_conf_dir variable to a directory containing Oracle Key Vault configuration file and ssl materials’ 

The keyring_okv_conf_dir  variable must name a directory that contains the following items: 

• okvclient.ora : A file that contains details of the KMIP back end with which keyring_okv communicates. 

• ssl : A directory that contains the certificate and key files required to establish a secure connection with the KMIP back end: CA.pem , cert.pem , and key.pem . If the key file is password-protected, the ssl 

