README

KMIP client for PHP -- connect to any KMIP-compliant key management server.

Supports Thales CipherTrust, IBM SKLM, Entrust KeyControl, Fortanix, HashiCorp Vault Enterprise, and any KMIP 1.4 server.

composer require cyphera/kmip

Quick Start

<?php

use Cyphera\Kmip\KmipClient;

$client = new KmipClient([
    'host' => 'kmip-server.corp.internal',
    'clientCert' => '/path/to/client.pem',
    'clientKey' => '/path/to/client-key.pem',
    'caCert' => '/path/to/ca.pem',
]);

// Fetch a key by name (locate + get in one call)
$key = $client->fetchKey('my-encryption-key');
// $key is a binary string of raw key bytes (e.g., 32 bytes for AES-256)

// Or step by step:
$ids = $client->locate('my-key');
$result = $client->get($ids[0]);
echo bin2hex($result['key_material']);

// Create a new AES-256 key on the server
$created = $client->create('new-key-name', 'AES', 256);
echo $created['unique_identifier'];

$client->close();

Operations

Authentication

KMIP uses mutual TLS (mTLS). Provide:

• Client certificate -- identifies your application to the KMS
• Client private key -- proves ownership of the certificate
• CA certificate -- validates the KMS server's certificate

$client = new KmipClient([
    'host' => 'kmip.corp.internal',
    'port' => 5696,                          // default KMIP port
    'clientCert' => '/etc/kmip/client.pem',
    'clientKey' => '/etc/kmip/client-key.pem',
    'caCert' => '/etc/kmip/ca.pem',
    'timeout' => 10,                         // connection timeout (seconds)
]);

TTLV Codec

The low-level TTLV (Tag-Type-Length-Value) encoder/decoder is also available for advanced use:

use Cyphera\Kmip\Ttlv;
use Cyphera\Kmip\Tag;

// Build custom KMIP messages
$msg = Ttlv::encodeStructure(Tag::REQUEST_MESSAGE, [...]);

// Parse raw KMIP responses
$parsed = Ttlv::decode($responseBytes);

Supported KMS Servers

Zero Dependencies

This library uses only PHP standard library (pack/unpack, stream_socket_client, ssl). No external dependencies.

Status

Alpha. KMIP 1.4 operations: Locate, Get, Create.

License

Apache 2.0 -- Copyright 2026 Horizon Digital Engineering LLC