All notable changes to this project will be documented in this file.
- Add Smart card HSM support and bug fixes (#538)
- CLI features:
- added support for SHA1 in RSA key wrapping (#541)
- add Azure functionality to facilitate BYOK (#541)
attributes getadded support to retrieve Object tags only (#541)
- tracing: print function names while using tracing macros. Use cosmian_logger instead of tracing crate (#536)
- When wrapped with
No Encoding, the RSA private key bytes and EC private key bytes are now the PKCS#8 DER bytes (#541) - CLI: fixed broken
attributes get(#541)
- Added Google CSEK and Google CMEK documentation (#541)
- Added Azure BYOK documentation (#541)
- Re-organized documentation (#541)
- Fixing typo in Encrypt/Decrypt requests examples (#545)
- Enable softhsm2 tests (#539)
- Fix python installation on pykmip-tests GH workflow
- Fix race condition on test_privileged_users
- Add auth test with expired cert (#547)
- Server crate publish (#534)
- Add KMIP operations
SignandVerifySignaturefor digital signature support (#511) - Add TLS cipher suites selection (#524)
- (google_cse) Further restrict access to CSE privileged unwrap endpoint (#517)
- Fix potential race condition in Google CSE migration key pair creation when multiple servers start simultaneously (#519)
- Simplify clap JWT Auth configuration (#531)
- Add non-fips UI build (#532)
- Fix Credential parsing in KMIP Request Message (#529)
- Use crypto core for db crypto (#526)
- Cloudproof reexports (#528)
- (percona) Add correction to percona doc (#521)
- (hsm) Added KMS-HSM integration workflow graph (#523)
- Fixes CLI Key Wrapping documentation on export (#530)
- Clarify Gmail CSE CA authority usage (#533)
- Uniformize clippy lints on all crates (#525)
- Create SECURITY.md with vulnerability tracking and reporting guidelines (#527)
- Add support HTTP forward proxy (for intermediate CLI crate) (#509)
- PKCS11: move PKCS#11 docs into cli repository (#510)
- Google CSE: save openssl commands to verify resource hash computation
- In JWT auth, change
audiencetype fromStringtoVec<String>(#491) - Support AES-CBC encryption without padding for Oracle TDE support (#493)
- Add support for existing PKCS12 leaf certificates when creating Google CSE keypairs (#505)
- Support debian 10 for old glibc compatibility (required for Oracle TDE) (#508)
- Add GitHub Copilot instructions for KMS development workflow (#504)
- Test docker container once generated by ci (#481)
- Use machete and publish crates on tags (#499)
- Remove test data folder (#497)
- Reorder crates in Cargo.toml
- Fix docker image name in tests (#500)
- Automate CVE resolution (when possible) by mirroring deny.toml in .cargo/audit.toml
- Remove useless and old UI files (#487)
- Test_kms_server must remain dev-dependency (#486)
- Enable native TLS support for OpenID Connect authentication (#489)
- Display CSE information from UI (#478)
- Fix outdated UI pkg
- Rocky package must be NON-FIPS (#482)
- Add MongoDB documentation (#483)
- Improve User Interface documentation
- Support for TLS 1.3 on the HTTPS port of the KMIP server (#458)
- Fixed RevocationReasonCode in KMIP 1.x (#460)
- Better support of PyKMIP client (#438)
- Support for Percona PostgreSQL TDE (Transparent Data Encryption) (#464)
- Support for Secret Data (#398)
- Fixed an issue with Locate failing when an HSM is present
- Fixed missing attributes when the wrapped object is not in the cache (#462)
- Added support for SoftHsmV2 (#457)
- Implement Register KMIP Operation
- ANSI colors in stdout are now disabled by default but can be re-enabled using a configuration flag
- Handle extension file to define x509 setup extensions for Google CSE keypairs create command
- Fix the default path for the
kms.tomlfile on Windows - Full configuration
kms.tomlfile for Linux packaged distributions - Handle KMIP Dates as OffsetDateTime instead of i64
- Display items ID on Google keypairs creation command
- Missing documentation on the rolling file appender in the server configuration file
- Update README.md to reflect that the KMS now builds in FIPS mode by default
- Test custom JWT used from Google CSE migration endpoints
- Test Import and Register KMIP operations
- Fix error on Google CSE migration authentication
- Support for daily rolling log files to a specified directory
- Invert fips feature (#448)
- Google CSE - Added support for all algorithms in private_key_decrypt
- Google CSE - Added support for all algorithms in private_key_sign
- Align UI version with Cargo workspace
- In UI, fix
IvCounterNonce(#446) - (Linux packages) Save and restore conf during installation
- Interoperability fixes with PyKMIP
- Remove reference of cosmian_gui
- Markdown fixes
- Rename cli repo
- (windows) Reduce verbosity
- Support for MySQL 8.0.42 and higher (#443)
- Fix clap error on cse keypair command
- Support for outbound proxy to fetch the JWKS (JSON Web Key Set) (#439)
- Support for JWKS (JSON Web Key Set) that provides JWK not appropriate for OIDC authentication (#433)
- Safer handling of Google CSE authorization token decoding (#431)
- Support custom JWT authentication for external KACLS using an RSA keypair in the Google CSE migration flow
- Expose the RSA public key via the new
/certsendpoint - Rewrite
/rewrapendpoint to fully support the migration flow logic - Rewrite
/privilegedunwrapendpoint to properly integrate with the migration process - Support for PKCE (Proof Key for Code Exchange) authentication from the CLI with the Cosmian KMS
- Concurrent multi-factor authentication with clear cascading rules (OIDC / Client Certificates / API Token)
- Unclear cascading rules in multi-factor authentication
- Refactor server configuration to include a dedicated google_cse section
- Derive the Google CSE KACLS URL from the public_url configuration value for better flexibility
- Expose user_id in the response from the /token endpoint for improved UI identification
- Add unit tests for Google CSE digest computation, validating against Google's official documentation appendix
- Test custom JWT generation and parsing to ensure compatibility and correctness
- Revise the Google CSE documentation section for clarity and accuracy
- Add a new section on migrating Google CSE data from Drive, including practical steps and examples
- PKCE documentation with configuration examples
- Improved authentication documentation, both client and server side
WARNING: This is a breaking change release. Databases created with version 4.x.x are not compatible with version 5.0.0. Please export your keys using standard formats (PKCS#8, PEM, etc.) and re-import them after upgrading.
- Support for KMIP 1.0, 1.1, 1.2, 1.3, 1.4, 2.0, 2.1 (#412)
- Binary TTLV for all KMIP versions on port 5696
- JSON TTLV for all KMIP versions on port 9998, endpoint /kmip
- VMware support
- Possible automatic key wrapping on Create and Import
- Better telemetry using OTLP and logs to syslog
- Run KMS server with privileged users (#408):
- These users can grant or revoke create access rights for other users
- Without
Createaccess right or privileged status, users can't create or import objects to KMS
- Rationalize SQL implementation (#379)
- Rust KeyBlock implementation not fully compliant with KMIP 2.1 specs (#76)
- Multiple fixes in KMIP 2.1 TTLV formats
- More extensive coverage of KMIP attributes
- Database schema changes
- Add support for Oracle Transparent Database Encryption (TDE) using Oracle Key Vault (#396)
- Add missing artifacts on tags (#407)
- Missing folder assets in DEB/RPM (#406)
- Align Docker build image to the wasm-pack prebuild binary for ARM cross-build
- Add digest and MAC KMIP operations (#370)
- Upgrade Covercrypt to v15 (#382)
- Add CBC encryption mode (#395)
- Add UI (#391)
- Shrink docker images size using slim-bullseye base image (#377)
- Clean unneeded test files (#392)
- RUSTSEC-2025-0009:
ring: Some AES functions may panic when overflow checking is enabled. - RUSTSEC-2025-0022:
openssl: Use-After-Free in Md::fetch and Cipher::fetch
- Move all CLI relative crates on https://github.com/Cosmian/cli (#383)
- Fix Google expected X509 extensions
- Add HSM tests using Utimaco simulator (#380)
- Reuse generic Github workflows (#401)
- Fix rhel9 artifact name
- Utimaco General Purpose HSMs support (#367)
- Fixed HSM base code dangling pointer issue in
releasemode - Fixed unwanted
ValueEnumincosmian sym encrypt - Remove ckms linux packages in favor of cosmian packages (#366)
- Rename binary
cosmian_kms_servertocosmian_kms- reuse the same name as marketplace images
- Clarified installation documentation
- Improved database configuration
- Improved HSM integration documentation
- Add how to release doc (#361)
- Change default port of KMS package from 8080 to 9998 (#364)
- VM marketplace guide examples (#365)
- (google_cse) Update authentication section (#363)
- Allow continue on error (#362)
- (google_cse) Typos in configuring .well-known file (#359)
- Fix publish on package.cosmian.com
- Add server param to disable (if needed) Google CSE JWT token validation (#349)
- Add remove option to
Destroy+ Object not found error message fix (#357)
- Save configuration file outside of clap actions (#351)
- Fix an incorrect message on 'object not found' (#353)
- Fix bad links and mkdocs formatting
- Simple review (#358
- Explain default KMS configuration on CVM (#359
- Better build with mkdocs; faster Mermaid support and better Katex support
- Add CLI bench command (#348)
- Re-expose clap actions for other CLIs (cosmian, ckms_gui) (#339)
- Revisit the mkdocs documentation (#339)
- HSM support (#344)
- support for the Proteccio HSM that provides both
- the ability to perform the Create, Destroy, Export, Encrypt, and Decrypt operations on the HSM
- the ability to create keys in the KMS that are wrapped by a key in the HSM
- the database components are now in a separate crate
server_database. They are now split in 2 implementations: Objects store and Permissions store - a new
interfacescrate gathers interfaces to be implemented by new external components. Interfaces include:- Object Store
- Permissions Store
- Encryption Oracle
- key unique identifiers now support prefixes. Object Stores, Permissions stores, and Encryption Oracles can be registered against the prefixes.
- support for the
SensitiveAttribute in addition to the ability to wrap a key by another key has been added to all keys creations
- support for the Proteccio HSM that provides both
- Make keys non revocable on server (#341)
- Docker for Linux ARM and keep support for MacOS Intel (#343)
- The macOS-12 environment is now deprecated
- Better permissions checking on wrapping and unwrapping
- Add benchmarks on simultaneous encryptions/decryptions
- Maturin build on macos arm - force forward compatibility (#336)
- Launch encrypted GMeet through GCal (#334)
- MacOS-maturin: Upgrade python version from 3.12 to 3.13 (#333)
- Dont panic on indexing slicing (#331)
ckmsinstallation - specifically for Windows (#332)
- Client
ckms: merge attributes handling (set/get/delete) underattributessubcommand (#329)
- Guard on size of ciphertexts for BulkData (#330)
- KMIP Attributes: fix deletion on Links and Vendor Attributes (#329)
- Google Workspace Client-Side-Encryption (CSE)
updates (#319)
- Generate Google S/MIME key-pairs and identities and upload them to Gmail API from ckms CLI (#270)
- Server-side, export cert at PKCS7 format
- Implement missing CSE endpoints
- Wrap/unwrap CSE elements with authenticated encryption
- Export wrapped keys from KMS specifying the cipher mode
- Handle auth for guest users (#271)
- Add SetAttribute/DeleteAttribute KMIP operations (#303)
- Re-enable wrap/unwrap on ckms by linking statically on openssl (#317)
- Added AES GCM-SIV and AES XTS (#328)
- Added the ability to client side encrypt files with
ckmsand a hybrid scheme (#328) - Create Symmetric Key / Private keys with custom unique id (#326)
- Add bulk encrypt / decrypt facility (#318)
- Replace Debug derive trait of KMIP Object by a custom Display impl (#327)
- Documentation: Migrating emails to Gmail CSE (#316)
- Update CSE documentation (Gmail S/MIME) (#316)
- Update KMS build instructions (#320)
- Add test on database backends (#311)
- Reduce CI pipeline duration in debug (#315)
- Add CSE endpoints testing (#319)
- Clippy hardening in crate
kmip(#304)
- Add ReKey KMIP operation (#294)
- Add API token authentication between server and clients (#290)
- Build a generic database upgrade mechanism (#299)
- Export of certificates can now be performed using the certificate id (instead of just the private key id)
- More intuitive PKCS#12 import (#306)
- Support for export under legacy PKCS#12 format (#306)
- Documentation (S/MIME)
- KMIP Attributes:
- Certificates handling/tasks:
- Merge decrypt match in same function (#295)
- Fix Public RSA Key size in get attributes (#275)
- RUSTSEC:
- CLI doc fixes (certificates certify)
- Fix PKCS#12 export of self-signed cert (#305)
- Fix serialization of
Attributesinredis-findex(#307)
- clippy tasks:
- Rename MacOS artifacts giving CPU architecture
- Configure
ckmsto build reqwest with minimal idle connections reuse (#272) - Do not delete tags if none are provided (#276)
- De-activated Google CSE tests when tokens are not supplied through env. var.
- Cleaned-up and improved certificates import tests
- Made test DB backend selectable using env. var.
KMS_TEST_URL
- Add KMIP operation
Validatefor certificates (#247) - Added RSA benchmarks (#251)
- Add OpenTelemetry OTLP protocol support to KMS server (#253)
- Support for multiple certification scenarios and self-signing (#248)
- Create Debian/RPM packages for Ubuntu 2x.04 and RHEL 9 (#264)
- Drop Centos 7 support (#265)
- Replace
cargo auditwithcargo deny(#245) - Replace Linux cross-compiling for Windows with compiling on Windows Github runner (#249)
- Add support for build on MacOS ARM
- Fixed import of symmetric key tag to '_kk' from '_sk'
- Add support for LUKS via PKCS#11 module
- Add support for CKM_RSA_PKCS (PKCS#1 v1.5) for RSA encryption/decryption
- Create Gmail key pairs and identities with
ckmsvia Gmail API (#243)
- Comment out mermaid configuration
- Add Google Workspace CSE endpoints for **encrypted Gmail ** (#192)
- Oauth2 OIDC doc fixes
- Add license to KMS GCP image (#235)
- Re-enable the validation of JWT Issuer URI
- Fix CSE error status code, propagating the right status code instead of generic server code error
- Handle many identity providers in jwt authentication
- New command line argument
--key-usageto define key or certificate usage on import - Exhaustive verification that the key used to perform cryptographic operations is allowed to do them
- KMIP object creation can now precisely define the usage of the key it describes
- Add standalone workflow to test KMS in Cosmian VM (#233)
- Rebase KMS GCP image on Cosmian VM 1.1.0-rc.4
- Remove optimization RUSTFLAGS (#227)
- Rebase KMS GCP image on Cosmian VM 1.1.0-rc.3
- Fixed double quotes problem in cosmian vm test (CI)
- Fixed trailing null byte bug for biguint/bytes conversions (#224)
- Make the CLI compile on Windows and macOS (without openssl installed) (#209)
- Support Veracrypt PKCS11 provider library (#208)
- Update
test_kms.pyto use covercrypt14.0.0(#217)
- Add missing image_licenses in packer for GCP (#219)
- Push GCP images based on Cosmian VM 1.1.0-rc2
ckmsneedskmipdependency with featuresopenssl(#202)
- Push GCP images on cosmian-dev and cosmian-public only once (#203)
- Filter reboot test on GCP/RHEL instance.
- Add build of GCP images (ubuntu/redhat) #191.
- Save KMIP Attributes in a proper column of
Objectstable #166:- Remove all custom tags
_cert_spki,_cert_cn,_cert_issuerand_cert_sk
- Remove all custom tags
- Add support for CoverCrypt
rekey,prune, andPolicyediting methods #179:- Add CLI commands to perform these actions
- Accurate CryptographicUsageMask for KMIP creation (RSA and EC keys) #189 and #187.
- Rework utils/crypto #178.
- Fixing inconsistent crypto consts #190.
- Fix interpolation in error macros #184.
- Move internal KMIP Objects into
Boxto avoid stack memory overflow #200.
- Generalize the refresh of JWKS in the middleware #150.
- CI speed up #173.
- Add support for Microsoft Double Key Encryption (DKE) endpoints #170.
- Re-organized crypto package by algorithm, removed duplicated code #170.
- Add support for FIPS mode for the ckms client #170.
- Documented TOML configuration file for the KMS server #170.
- Overall improvements to the documentation on algorithms and FIPS mode #170.
- CLI: allow multiple operations to be supplied at once for access control #155.
- Business Source License 1.1
- Test and deliver in CI missing FIPS binary (fips.so and openssl.cnf for FIPS) #152
- Load correct openssl provider on run
- Pypi now requires a token to publish #148
- X509 v3 extensions support #120
- Dynamic salt for password derivation, resolving issue #124 #128
- Support Cosmian VM #129
- Make rsa oaep aes a generalized encryption system for use in all kms and not only for key wrapping #130
- ECIES implementation for Hybrid Encryption #134
- Add pyo3 methods for
symmetric
create_key,encrypt,decrypt#135 - Add RSA keys create key pair #137
- Upgrade Rust toolchain to 2024-01-09 #141
- Support keypair generation for curve448 Montgomery and edwards forms #143
- Fix mkdocs formatting
- Support for certificate generation using the Certify KMIP operation and a PKCS#10 or a public key
- Support for most standardized encoding formats on import.export: PKCS#8, PKCS#1, SEC1, X509, PKCS#12
- Improvements to the Locate functionality for attributes and tags
- Support for the Get Attributes KMIP operation
- Database: support for atomic operations
- Replaced part of Rust Crypto with openssl for more standardized module support
- Deactivated automatic certificate verification, which will be reallocated
for the future
ValidateKMIP operation support #102 - Deactivated the non KMIP compliant certificate "quick create feature",
which can now be achieved using the
CertifyKMIP operation #103
- Redis-Findex:
createnow checks for the pre-existence of the object - Better KMIP compliance:
- KMIP server operations only support DER format for certificates (#89)
- fix: migrate to num-bigint-dig for bigint (#85)
- Test KMS inside an SGX machine
- Update Covercrypt version to support Policy V2 ([#63])
- Generalize bulk operations using KMIP
Messagesstructure
- Save certs as DER instead of PEM for KMIP compliance
- Fix for #64
- Fix container build on tags
- Serialize the header for each chunk for Covercrypt bulk encryption (#59)
- KMS running inside TEE (SGX or SEV)
- review the
verifysubcommand - force checking the leaf TLS certificate when querying a KMS running inside a TEE
- verify RA-TLS certificate before querying the bootstrap server
- review the TLS certificate generation using the key tied to the TEE
- remove libsgx and create a new dependence to tee_attestation crate
- update KMS server argument regarding the TEE and certbot
- review documentation regarding the KMS usage inside a TEE
- review the
- Activate tracing in CLI tests when binary is instrumented ([#56])
- Trigger public_documentation build on tags
- Added the wildcard user
*to grant access rights to all users on an object - About certificates:
- add validation of the complete chain instead of the leaf and parent certificates
- add verifications before using a certificate:
- check that each certificate is not expired (both chain and leaf certificates)
- check that no certificate is revoked (both chain and leaf certificates)
- check that each certificate has a valid signature (both chain and leaf certificates)
- check that certificate CRL signature is valid
- add RSA X509 certificate support
- add Covercrypt bulk encryption
- KMS CLI
ckms:- can import the Mozilla Common CA Database (CCADB)
- can import a PKCS12 certificate (splitting in 2 KMIP objects: X509 certificate and private key)
- Improved database data structures using Maps and Sets instead of Vectors where uniqueness is required
- Enable bootstrap server for non "enclaves" servers
- Filter Locate request by object type
- Remove merge leftovers
- bootstrap: the KMS server now supports bootstrap mode to facilitate the secure input of secret components, including the database encryption secret and the HTTPS certificate key, directly into the encrypted machine memory, through a secure connection
- Add certificate support:
- in cosmian_kms_server:
- implement
CertifyKMIP operation - in addition, the KMS server will automatically add:
- the system tag
_certonCertificateobject - the system tag
_cert_uid=<certificate_uid>wherecertificate_uidis used as the link between public/private key objects and the related certificate object - the system tag
_cert_spki=<Subject Public Key Info>onCertificateobject where SPKI refers to RFC 5280. The SPKI value identifies uniquely the underlying certificate - the system tag
_cert_ca=<Subject Common Name>on CACertificateobject
- the system tag
- import X509 certificate as PEM and also import private key as PEM
- export generic KMIP key
wrappedby X509 certificate - import a wrapped key with unwrapping on the fly
- encrypt with X509 certificate and decrypt with PKCS8 private key
- implement
- in
ckms, add:- create/destroy certificate
- export/import certificate
- revoke certificate
- in cosmian_kms_server:
- Add the export wrapping with X509 certificate encryption
- Documentation
- tagging: the KMS server now supports user tagging of objects to facilitate their management. Specify as many user tags as needed when creating and importing objects.
In addition, the user server will automatically add a system tag based on the object type:
_sk: for a private key_pk: for a public key_kk: for a symmetric key_uk: for a Covercrypt user decryption key
Use the tags to export objects, locate them, or request data encryption and decryption.
- Added
locateto theckmsclient - Added
Redis-Findexbackend support so that the KMS can encrypt the KMS server data and indexes at the application level. - Added JWE support
- Remove RUSTFLAGS for docker container and python package
- Update sqlx to 0.7 + bitflags and base64-url to version 2
- Support glibc v2.17 when building ckms and cosmian_kms_server
- Incorrect docker tag
- Add description on docker usage
- Added the ability to manipulate EC and Symmetric Keys
- Added ECIES encryption (using Curve 25519) and AES GCM encryption
- Added support for policy specifications
- Reworked Revoke and Destroy to be closer to KMIP definitions
- Revoking and Destroying a public/private key, revokes or destroy all the related keys
- Upgrading of SQLX
- Upgrading of PKCS12 support
- Removal of Eyre in the CLI
- Use of cloudproof_rust as a dependency rather than Covercrypt and Crypto Core directly to avoid version conflicts
- Authentication:
- support for more JWT providers
- support for certificate authentication
- Removal of global static conf and use of proper injection (was hindering testing)
- Authorization: re-factor of endpoints and fix delegation issues around revoke and destroy
- Add link to package.cosmian.com
- Add github ci
- Publish python kms packages
- Refactored the server to simplify traits and separate the operations into smaller files
- Python KMS client (pyo3): export
database_secretandinsecureas parameters
- Update cover crypt in python tests
- Use CoverCrypt v11
- Removed
mysqlcrate used for EdgelessDB (compatible with client SSL connection) - Use workspace dependencies to ease maintenance
- mkdocs-merge could not run with
emoji_indexurl
- Remove unused docker builds
- Improves the installation doc and details the important options
- Makes wording coherent between doc and code
- adds native HTTP/S support by providing certificates
- improves encrypted SQLite support
- removes multiple features on the KMS server and makes them command-line options.
- There is now a single docker (115MB) that covers all cases (except SGX, which will come later)
- removes the use of crypto_base and makes use of cover-crypt 10.0
- Use CoverCrypt v9.0 (post-quantum cryptography) and AbePolicy v3.0
- Write
Policyas bytes andAccessPolicyas string in Vendor Attributes
- Write
- Fix tag matching in
python_publish
- add python interface
- CoverCrypt v9 / CryptoCore v5 / AbePolicy v3.0
- CLI Policy interface (format changed with AbePolicy v2.1)
- add authentication data in header too in encrypt operation
- data to encrypt with CoverCrypt is not a JSON anymore but a custom binary format (
see
DataToEncryptstruct) - decrypted data with CoverCrypt is now a custom binary format (see
DecryptedDatastruct)
- Support
cover_crypt7.1.0
- Rename KMS URL
- Remove AVX flag
- Update
cover_cryptto 7.0.1 - Update crates dependencies
- GPSW support
- TFHE support
- DMCFE support
- Handle CORS request
- Update installation documentation