{"action":"created","issue":{"url":"https://api.github.com/repos/OpenKMIP/PyKMIP/issues/167","repository_url":"https://api.github.com/repos/OpenKMIP/PyKMIP","labels_url":"https://api.github.com/repos/OpenKMIP/PyKMIP/issues/167/labels{/name}","comments_url":"https://api.github.com/repos/OpenKMIP/PyKMIP/issues/167/comments","events_url":"https://api.github.com/repos/OpenKMIP/PyKMIP/issues/167/events","html_url":"https://github.com/OpenKMIP/PyKMIP/pull/167","id":148714102,"number":167,"title":"links for Managed Cryptographic Objects","user":{"login":"viktorTarasov","id":250674,"avatar_url":"https://avatars.githubusercontent.com/u/250674?v=3","gravatar_id":"","url":"https://api.github.com/users/viktorTarasov","html_url":"https://github.com/viktorTarasov","followers_url":"https://api.github.com/users/viktorTarasov/followers","following_url":"https://api.github.com/users/viktorTarasov/following{/other_user}","gists_url":"https://api.github.com/users/viktorTarasov/gists{/gist_id}","starred_url":"https://api.github.com/users/viktorTarasov/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/viktorTarasov/subscriptions","organizations_url":"https://api.github.com/users/viktorTarasov/orgs","repos_url":"https://api.github.com/users/viktorTarasov/repos","events_url":"https://api.github.com/users/viktorTarasov/events{/privacy}","received_events_url":"https://api.github.com/users/viktorTarasov/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":14,"created_at":"2016-04-15T16:59:52Z","updated_at":"2016-05-09T17:14:16Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/OpenKMIP/PyKMIP/pulls/167","html_url":"https://github.com/OpenKMIP/PyKMIP/pull/167","diff_url":"https://github.com/OpenKMIP/PyKMIP/pull/167.diff","patch_url":"https://github.com/OpenKMIP/PyKMIP/pull/167.patch"},"body":"Add links to managed crypto objects.\r\n\r\nSome unit tests are probably to be added."},"comment":{"url":"https://api.github.com/repos/OpenKMIP/PyKMIP/issues/comments/217927692","html_url":"https://github.com/OpenKMIP/PyKMIP/pull/167#issuecomment-217927692","issue_url":"https://api.github.com/repos/OpenKMIP/PyKMIP/issues/167","id":217927692,"user":{"login":"PeterHamilton","id":8269688,"avatar_url":"https://avatars.githubusercontent.com/u/8269688?v=3","gravatar_id":"","url":"https://api.github.com/users/PeterHamilton","html_url":"https://github.com/PeterHamilton","followers_url":"https://api.github.com/users/PeterHamilton/followers","following_url":"https://api.github.com/users/PeterHamilton/following{/other_user}","gists_url":"https://api.github.com/users/PeterHamilton/gists{/gist_id}","starred_url":"https://api.github.com/users/PeterHamilton/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/PeterHamilton/subscriptions","organizations_url":"https://api.github.com/users/PeterHamilton/orgs","repos_url":"https://api.github.com/users/PeterHamilton/repos","events_url":"https://api.github.com/users/PeterHamilton/events{/privacy}","received_events_url":"https://api.github.com/users/PeterHamilton/received_events","type":"User","site_admin":false},"created_at":"2016-05-09T17:14:16Z","updated_at":"2016-05-09T17:14:16Z","body":"@viktorTarasov Managing links for different cryptographic objects can be tricky, depending on the context in which the objects are being created and in which the link(s) would be created or updated.\r\n\r\nFor public/private keys, it's easy to link the two together if they're created by a call to something like `CreateKeyPair`; just add the link attributes once the keys exist. If the keys are uploaded via `Register`, it is up to the user/client to specify the link attributes, using a template attribute or the `AddAttribute` operation.\r\n\r\nFor certificates or certificate chains, I would also lean toward requiring the user/client to specify the links directly. There is no mechanism in the KMIP spec for auto-loading or creating a certificate chain in one operation; the closest you can get is to issue a request with a batch of operations, either using `Register` for each certificate in the chain, or constructing the chain directly via a set of `CreateKeyPair` / `Certify` / `Sign` operations.\r\n\r\nIn general, auto-linking of cryptographic objects (beyond the scope of something like `CreateKeyPair`) is something I want to avoid, for a couple of reasons. (1) It can impose a performance impact on a heavily loaded server when running an exhaustive search for matching key content. (2) It's possible that information could leak about key existence or key ownership, especially if links cross over user object boundaries. This isn't a big problem right now (we don't support explicit user ownership currently) but it's important to keep in mind when we do add that feature.\r\n\r\nTL;DR I support adding links, I just err on the side of the user/client explicitly being involved more often than not."}}