A user with special permission can perform various KMS operations using kmsclient, such as encryption, decryption, deletion, search, and both encryption and decryption.
-
Open a terminal window.
-
Change directory where kmsclient.jar is present.
shell> cd /usr/local/topaz/ - Execute sample client to view usage by using the following command:
shell> java -jar kmsclient.jarOutput
$ example:~/topaz> java -jar kmsclient.jar
NOTE: Picked up JDK_JAVA_OPTIONS: --add-opens java.base/java.util=ALL-UNNAMED --add-opens java.base/java.lang=ALL-UNNAMED --add-opens java.base/java.lang.reflect=ALL-UNNAMED --add-opens java.base/java.io=ALL-UNNAMED --add-opens java.management/javax.management.openmbean=ALL-UNNAMED --add-opens java.management/javax.management=ALL-UNNAMED --add-opens java.base/sun.security.provider=ALL-UNNAMED
Invalid number of arguments for operation
Usage: java -jar kmsclient.jar https://<host:encport> <did> <username> <password> DLK [bankid] <keytoken>
java -jar kmsclient.jar https://<host:encport> <did> <username> <password> GAK <key-name> <BDK|LTMK|MAC|TMK|TPK|GPK|Other> <RSA> <1024|2048|4096|8192> <bankid> [terminalid] [terminaltype] [notes] <Hex|Base64>
java -jar kmsclient.jar https://<host:encport> <did> <username> <password> GBK <manufacturer>
java -jar kmsclient.jar https://<host:encport> <did> <username> <password> GIK <manufacturer> <device-serial-number> <return-type> [public-key-token]
java -jar kmsclient.jar https://<host:encport> <did> <username> <password> LBK <key-name> <hex-key-check-value> <manufacturer>
java -jar kmsclient.jar https://<host:encport> <did> <username> <password> LKC <AES|TDES> <128|192|256> <hex-key-component> [kcv] <K-Value> <N-Value> <key-name>
java -jar kmsclient.jar https://<host:encport> <did> <username> <password> RDK <retiringtoken> [parent-token] <key-name> <BDK|LTMK|MAC|TMK|TPK|GPK|Other> <AES|TDES> <128|192|256> <bankid> [terminalid] [terminaltype] [hex-symkey] <kcv> [notes]
java -jar kmsclient.jar https://<host:encport> <did> <username> <password> SDK [parent-token] <key-name> <BDK|LTMK|MAC|TMK|TPK|GPK|Other> <AES|TDES> <128|192|256> <bankid> [terminalid] [terminaltype] [hex-symkey] <kcv> [notes]
java -jar kmsclient.jar https://<host:encport> <did> <username> <password> SPK <key-name> RSA <1024|2048|4092> <public-key> <public-key-encoding> [nonce] [signed-nonce] [signed-nonce-encoding] [signature-digest] <bankid> [terminalid] [terminaltype] [notes]
java -jar kmsclient.jar https://<host:encport> <did> <username> <password> GSK <key-name> <AES|TDES> <128|192|256> <public-key-token> <encoding> <bankid> [terminalid] [terminaltype]
java -jar kmsclient.jar https://<host:encport> <did> <username> <password> UPK <bankid> <keytoken> [newstatus] [newnotes]
java -jar kmsclient.jar https://<host:encport> <did> <username> <password> GMK <keytoken> <Hex|Base64>
java -jar kmsclient.jar GPK <1024|2048|4092>
java -jar kmsclient.jar DSK <rsa-private-key> <encrypted-sym-key> <AES|TDES> <nonce> <encrypted-nonce>
java -jar kmsclient.jar WK <Wrapping Key> <AES|TDES> <128|192|256>
java -jar kmsclient.jar MFR
Here is a brief description of each argument used with kmsclient:
|
Value |
Explanation |
|---|---|
|
did |
Unique domain identifier that belongs to SAKA The URL of the KA where the CCS web service operations will be submitted. For example, the URL can be https://kms.strongkey.com. |
|
https://<host:encport> |
The URL of the KA where the CCS web service operations will be submitted. For example, the URL can be https://kms.strongkey.com. |
|
username |
The username in the encryption domain with authorization to call the web service. |
|
password |
The password of the username above. |
|
bankid |
A numeric identifier for which bank the key is associated with. |
|
keytoken |
Token to reference the ANSI key to operate on. |
|
key-name |
A string identifying multiple key components as belonging to the same set. The value can be any 64-character long string (without spaces and special characters). It is merely used to identify the key components during a “Load BDK” operation. |
|
BDK|LTMK|MAC|TMK|TPK|GPK|Other |
The type of key to be stored in the KA. |
|
RSA |
TBD |
|
1024|2048|4096|8192 |
TBD |
|
terminalid |
An optional numerical identifier for which terminal this ANSI key is associated with. |
|
terminaltype |
An optional string identifier for the type of terminal this ANSI key belongs to. |
|
notes |
Any extra information to be sent when storing a key. Can be NULL if the word “null” is specified. |
|
Hex|Base64 |
TBD |
|
manufacturer |
The Manufacturer ID for the product that will be creating encrypted swipes. |
|
device-serial-number |
The DSN for the device. This must be either an 11- or 15-byte string of hex-encoded data. |
|
return-type |
Determines the manner in which an Initial Key is returned to the calling application. The only currently supported value is to return the Initial Key as KeyComponents. Future implementations will also support returning the Initial Key, encrypted under a previously escrowed public key on KA/ |
|
public-key-token |
Specifies a token in KA that holds a previously escrowed public key which can be used to encrypt keys for export from the appliance. This parameter is optional. |
|
hex-key-check-value |
A KCV as a hex-encoded string. |
|
AES|TDES |
Either the AES or Triple DES algorithm. |
|
128|192|256 |
Available key sizes accepted by the appliance. |
|
hex-key-component |
A key component value submitted as a hex-encoded string. |
|
kcv |
TBD |
|
K-value |
The numerical identifier for a key component in a set of key components. |
|
N-value |
The total number of key components in a set of key components. |
|
retiringtoken |
TBD |
|
parent-token |
The token in which the key encrypting key is stored. Can be NULL if the word “null” is specified. |
|
hex-symkey |
The encrypted key which is to be loaded in KA. Can be null if the word “null” is specified. |
|
public-key |
TBD |
|
public-key-encoding |
TBD |
|
nonce |
TBD |
|
singed-nonce |
TBD |
|
signed-nonce-encoding |
TBD |
|
signature-digest |
TBD |
|
encoding |
TBD |
|
newstatus |
TBD |
|
newnotes |
TBD |