[Download] | [Documentation Home] | [Release Note]

WSO2 XKMS Implementation (XKMS 2.0)

XML Key Management Service Specification ( or XKMS) defines a standard way of generating key pairs, storing public key information and retrieving public key information. The XKMS services can be exposed as Web services which allow other applications to delegate some of the key information processing to such services. That allows the client applications of XKMS services to operate without worrying about the Public Key Infrastructure which the XKMS services might be using. XKMS consists of two components. Namely:

Implementation:

XKMS has implemented on top of AXIS2, WSS4J and XML-SECURITY. Thus, the XKMS services are provided with "xkms.aar". In addition to this, client side operations are provided with xkms.jar. If xkms.jar will provide a client side API for components to do XKISS and XKRSS. xkms.aar will provide a framework to plug XKISS/XKRSS functionality via service providers, (Some of these feature are still in experiment), system parameters and via axis2.xml. For XKISS, Locate or Validate services are provided with first from
  1. Service provider with (org.wso2.xkms2.service.LocateService or org.wso2.xkms2.service.ValidateService)http://java.sun.com/j2se/1.4.2/docs/guide/jar/jar.html
  2. System property (org.wso2.xkms2.service.LocateService or org.wso2.xkms2.service.ValidateService)
  3. Axis2 parameter named (org.wso2.xkms2.service.LocateService or org.wso2.xkms2.service.ValidateService)
Once the service implementation has been provided, underline Protocol Exchanger will handle the protocol exchange mechanism. Thus, service only has to concern about the prototype its getting with the corresponding respond withs. Current implementation of Protocol exchanger will handle synchronous and two-phase request protocol. Asynchronous implementation will be available soon. For Locate service following interface should be implemented

public interface LocateService {
    public UnverifiedKeyBinding[] locate(QueryKeyBinding queryKeyBinding,
                                         RespondWith[] respondWiths,
                                         Document document) throws XKMSException ;
}

Service user will be provided with query key binding, respond withs and the W3C DOM Document to work with. User should take care of the unverified key binding its gonna send. For Validate service, user has to implement the following interface
public interface ValidateService {

    public KeyBinding[] validate(QueryKeyBinding queryKeyBinding,
                                 RespondWith[] respondWiths,
                                 Document document);
}

Implementation of validate service is quite tricky. As with Locate service, service will be injected with query key binding, respond withs and DOM document. XKMS framework also provide a Client API. The main class is org.wso2.xkms2.client.XKMSStub.java. For locate and validation it will be as follows,

public List locate(UseKeyWith[] useKeyWiths,
                       RespondWith[] respondWiths,
                       KeyUsage[] keyUsages) throws XKMSException {...}

 public List locate(KeyInfo keyInfo,
                       RespondWith[] respondWiths,
                       KeyUsage[] keyUsages) throws XKMSException {...}

public List validate(KeyInfo keyInfo,
                         UseKeyWith[] useKeyWiths,
                         RespondWith[] respondWiths,
                         KeyUsage[] keyUsages) throws XKMSException {...}

Thus, the List element return by each method will contains either UnverifiedKeyBinding or KeyBinding

XKRSS document will be available soon