Credential A Credential is a structure (see Table 3) used for client identification purposes and is not managed by the key management system (e.g., user id/password pairs, Kerberos tokens, etc.). It MAY be used for authentication purposes as indicated in [KMIP-Prof]. Object Encoding REQUIRED Credential Structure Credential Type Enumeration, see Yes 9.1.3.2.1 Credential Value Varies based on Yes Credential Type. Table 3: Credential Object Structure If the Credential Type in the Credential is Username and Password, then Credential Value is a structure as shown in Table 4. The Username field identifies the client, and the Password field is a secret that authenticates the client. Object Encoding REQUIRED Credential Value Structure Username Text String Yes Password Text String No Table 4: Credential Value Structure for the Username and Password Credential If the Credential Type in the Credential is Device, then Credential Value is a structure as shown in Table 5. One or a combination of the Device Serial Number, Network Identifier, Machine Identifier, and Media Identifier SHALL be unique. Server implementations MAY enforce policies on uniqueness for individual fields. A shared secret or password MAY also be used to authenticate the client. The client SHALL provide at least one field. Object Encoding REQUIRED Credential Value Structure Device Serial Text String No Number Password Text String No Device Identifier Text String No Network Identifier Text String No Machine Identifier Text String No Media Identifier Text String No Table 5: Credential Value Structure for the Device Credential If the Credential Type in the Credential is Attestation, then Credential Value is a structure as shown in Table 6. The is obtained from the key management server in a Nonce Object. The Nonce Value Attestation Credential Object can contain a measurement from the client or an assertion from a third party if the server is not capable or willing to verify the attestation data from the client. Neither type of attestation data (Attestation Measurement or Attestation Assertion) is necessary to allow the server to accept either. However, the client SHALL provide attestation data in either the Attestation Measurement or Attestation Assertion fields.
Credential A Credential is a structure (see Table 3) used for client identification purposes and is not managed by the key management system (e.g., user id/password pairs, Kerberos tokens, etc.). It MAY be used for authentication purposes as indicated in [KMIP-Prof]. Object Encoding REQUIRED Credential Structure Credential Type Enumeration, see 9.1.3.2.1 Yes Credential Value Varies based on Credential Type. Yes Table 3: Credential Object Structure If the Credential Type in the Credential is Username and Password, then Credential Value is a structure as shown in Table 4. The Username field identifies the client, and the Password field is a secret that authenticates the client. Object Encoding REQUIRED Credential Value Structure Username Text String Yes Password Text String No Table 4: Credential Value Structure for the Username and Password Credential If the Credential Type in the Credential is Device, then Credential Value is a structure as shown in Table 5. One or a combination of the Device Serial Number, Network Identifier, Machine Identifier, and Media Identifier SHALL be unique. Server implementations MAY enforce policies on uniqueness for individual fields. A shared secret or password MAY also be used to authenticate the client. The client SHALL provide at least one field. Object Encoding REQUIRED Credential Value Structure Device Serial Number Text String No Password Text String No Device Identifier Text String No Network Identifier Text String No Machine Identifier Text String No Media Identifier Text String No Table 5: Credential Value Structure for the Device Credential If the Credential Type in the Credential is Attestation, then Credential Value is a structure as shown in Table 6. The Nonce Value is obtained from the key management server in a Nonce Object. The Attestation Credential Object can contain a measurement from the client or an assertion from a third party if the server is not capable or willing to verify the attestation data from the client. Neither type of attestation data (Attestation Measurement or Attestation Assertion) is necessary to allow the server to accept either. However, the client SHALL provide attestation data in either the Attestation Measurement or Attestation Assertion fields.