kmip-node

KMIP client for Node.js — connect to any KMIP-compliant key management server.

Supports Thales CipherTrust, IBM SKLM, Entrust KeyControl, Fortanix, HashiCorp Vault Enterprise, and any KMIP 1.4 server.

npm install @cyphera/kmip

Quick Start

const { KmipClient } = require("@cyphera/kmip");

const client = new KmipClient({
  host: "kmip-server.corp.internal",
  clientCert: "/path/to/client.pem",
  clientKey: "/path/to/client-key.pem",
  caCert: "/path/to/ca.pem",
});

// Fetch a key by name (locate + get in one call)
const key = await client.fetchKey("my-encryption-key");
// key is a Buffer of raw key bytes (e.g., 32 bytes for AES-256)

// Or step by step:
const ids = await client.locate("my-key");
const result = await client.get(ids[0]);
console.log(result.keyMaterial); // Buffer

// Create a new AES-256 key on the server
const created = await client.create("new-key-name", "AES", 256);
console.log(created.uniqueIdentifier);

await client.close();

Operations

| Operation | Method | Description | |-----------|--------|-------------| | Locate | client.locate(name) | Find keys by name, returns unique IDs | | Get | client.get(id) | Fetch key material by unique ID | | Create | client.create(name, algo, length) | Create a new symmetric key | | Fetch | client.fetchKey(name) | Locate + Get in one call |

Authentication

KMIP uses mutual TLS (mTLS). Provide:

• Client certificate — identifies your application to the KMS
• Client private key — proves ownership of the certificate
• CA certificate — validates the KMS server's certificate

const client = new KmipClient({
  host: "kmip.corp.internal",
  port: 5696,                    // default KMIP port
  clientCert: "/etc/kmip/client.pem",
  clientKey: "/etc/kmip/client-key.pem",
  caCert: "/etc/kmip/ca.pem",
  timeout: 10000,                // connection timeout (ms)
});

TTLV Codec

The low-level TTLV (Tag-Type-Length-Value) encoder/decoder is also exported for advanced use:

const { encodeTTLV, decodeTTLV, encodeStructure, encodeTextString, Tag, Type } = require("@cyphera/kmip");

// Build custom KMIP messages
const msg = encodeStructure(Tag.RequestMessage, [ ... ]);

// Parse raw KMIP responses
const parsed = decodeTTLV(responseBuffer);

Supported KMS Servers

| Server | KMIP Version | Tested | |--------|-------------|--------| | Thales CipherTrust Manager | 1.x, 2.0 | Planned | | IBM SKLM | 1.x, 2.0 | Planned | | Entrust KeyControl | 1.x, 2.0 | Planned | | Fortanix DSM | 2.0 | Planned | | HashiCorp Vault Enterprise | 1.4 | Planned | | PyKMIP (test server) | 1.0-2.0 | CI |

Zero Dependencies

This library uses only Node.js standard library (tls, fs, Buffer). No external dependencies.

Status

Alpha. KMIP 1.4 operations: Locate, Get, Create.

License

Apache 2.0 — Copyright 2026 Horizon Digital Engineering LLC