<div dir="auto"><span style="color:rgb(0,0,0);font-family:monospace;font-size:medium"><div dir="ltr">There is not much you can do with the existing keys but still, KMIP is something to consider going forward if one is concerned about vendor lock-ins.<div>Needless to say, like anything else, there is a tradeoff.</div><div><br></div><div>Cheers!</div><div>T.</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Jul 31, 2023 at 11:23 PM Jakob Schlyter via ksk-rollover <<a href="mailto:<a href="mailto:ksk-rollover@icann.org">ksk-rollover@icann.org</a>"><a href="mailto:ksk-rollover@icann.org">ksk-rollover@icann.org</a></a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On 2023-07-31 at 14:53, Frederico A C Neves via ksk-rollover wrote:<br></span><br style="color:rgb(0,0,0);font-family:monospace;font-size:medium"><span style="color:rgb(0,0,0);font-family:monospace;font-size:medium"><br></span><br style="color:rgb(0,0,0);font-family:monospace;font-size:medium"><span style="color:rgb(0,0,0);font-family:monospace;font-size:medium">> From our experience besides admin interfaces, standard APIs for<br></span><br style="color:rgb(0,0,0);font-family:monospace;font-size:medium"><span style="color:rgb(0,0,0);font-family:monospace;font-size:medium">> regular operations, generating keys, sign, verify etc... are available<br></span><br style="color:rgb(0,0,0);font-family:monospace;font-size:medium"><span style="color:rgb(0,0,0);font-family:monospace;font-size:medium">> (PKCS#11/KMIP) from multiple vendors. But exporting/importing a key,<br></span><br style="color:rgb(0,0,0);font-family:monospace;font-size:medium"><span style="color:rgb(0,0,0);font-family:monospace;font-size:medium">> specially with the no-export attribute set, among vendors is not<br></span><br style="color:rgb(0,0,0);font-family:monospace;font-size:medium"><span style="color:rgb(0,0,0);font-family:monospace;font-size:medium">> available.<br></span><br style="color:rgb(0,0,0);font-family:monospace;font-size:medium"><span style="color:rgb(0,0,0);font-family:monospace;font-size:medium"><br></span><br style="color:rgb(0,0,0);font-family:monospace;font-size:medium"><span style="color:rgb(0,0,0);font-family:monospace;font-size:medium">I concur; moving keys not marked as CKA_EXTRACTABLE (at time of generation) is generally not supported (due to FIPS requirements).<br></span><br style="color:rgb(0,0,0);font-family:monospace;font-size:medium"><span style="color:rgb(0,0,0);font-family:monospace;font-size:medium"><br></span><br style="color:rgb(0,0,0);font-family:monospace;font-size:medium"><span style="color:rgb(0,0,0);font-family:monospace;font-size:medium">  Â  Â  Â  jakob<br></span><br style="color:rgb(0,0,0);font-family:monospace;font-size:medium"><span style="color:rgb(0,0,0);font-family:monospace;font-size:medium"><br></span><br style="color:rgb(0,0,0);font-family:monospace;font-size:medium"><span style="color:rgb(0,0,0);font-family:monospace;font-size:medium">-- <br></span><br style="color:rgb(0,0,0);font-family:monospace;font-size:medium"><span style="color:rgb(0,0,0);font-family:monospace;font-size:medium">Jakob Schlyter<br></span><br style="color:rgb(0,0,0);font-family:monospace;font-size:medium"><span style="color:rgb(0,0,0);font-family:monospace;font-size:medium">Kirei AB - <a href="<a href="http://www.kirei.se">http://www.kirei.se</a>" rel="noreferrer" target="_blank"><a href="http://www.kirei.se">www.kirei.se</a></a><br></span><br style="color:rgb(0,0,0);font-family:monospace;font-size:medium"><span style="color:rgb(0,0,0);font-family:monospace;font-size:medium">_______________________________________________<br></span><br style="color:rgb(0,0,0);font-family:monospace;font-size:medium"><span style="color:rgb(0,0,0);font-family:monospace;font-size:medium">ksk-rollover mailing list<br></span><br style="color:rgb(0,0,0);font-family:monospace;font-size:medium"><span style="color:rgb(0,0,0);font-family:monospace;font-size:medium"><a href="mailto:<a href="mailto:ksk-rollover@icann.org">ksk-rollover@icann.org</a>" target="_blank"><a href="mailto:ksk-rollover@icann.org">ksk-rollover@icann.org</a></a><br></span><br style="color:rgb(0,0,0);font-family:monospace;font-size:medium"><span style="color:rgb(0,0,0);font-family:monospace;font-size:medium"><a href="<a href="https://mm.icann.org/mailman/listinfo/ksk-rollover">https://mm.icann.org/mailman/listinfo/ksk-rollover</a>" rel="noreferrer" target="_blank"><a href="https://mm.icann.org/mailman/listinfo/ksk-rollover">https://mm.icann.org/mailman/listinfo/ksk-rollover</a></a><br></span><br style="color:rgb(0,0,0);font-family:monospace;font-size:medium"><span style="color:rgb(0,0,0);font-family:monospace;font-size:medium"><br></span><br style="color:rgb(0,0,0);font-family:monospace;font-size:medium"><span style="color:rgb(0,0,0);font-family:monospace;font-size:medium">_______________________________________________<br></span><br style="color:rgb(0,0,0);font-family:monospace;font-size:medium"><span style="color:rgb(0,0,0);font-family:monospace;font-size:medium">By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (<a href="<a href="https://www.icann.org/privacy/policy">https://www.icann.org/privacy/policy</a>" rel="noreferrer" target="_blank"><a href="https://www.icann.org/privacy/policy">https://www.icann.org/privacy/policy</a></a>) and the website Terms of Service (<a href="<a href="https://www.icann.org/privacy/tos">https://www.icann.org/privacy/tos</a>" rel="noreferrer" target="_blank"><a href="https://www.icann.org/privacy/tos">https://www.icann.org/privacy/tos</a></a>). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.<br></span><br style="color:rgb(0,0,0);font-family:monospace;font-size:medium"><span style="color:rgb(0,0,0);font-family:monospace;font-size:medium"></blockquote></div></span></div>