T4 – Secure Delivery

Version: 0.9.0
Status: Release Candidate
Type: Normative Conformance Test Specification

Copyright © 2026 inside workspace GmbH
This work is licensed under the Creative Commons Attribution 4.0 International (CC BY 4.0) License.

1 Introduction

1.1 Purpose

This specification defines the reference process for the secure delivery of encrypted Knowledge Asset Packages.

Secure Delivery provides the recipient-specific cryptographic material required to access encrypted Package Files after successful Package Validation.

The reference process ensures interoperable delivery of recipient-specific Encrypted File Keys while preserving confidentiality.

1.2 Scope

This specification defines:

• File Key generation,
• recipient-specific File Key encryption,
• KAP-KDM generation,
• KAP-KDM validation,
• File Key recovery,
• Package File decryption.

This specification does not define:

• transport protocols,
• certificate management,
• trust management,
• long-term key management,
• secure storage of private keys.

1.3 Relationship to Other Specifications

This specification forms part of the KAPRI Conformance Test Suite.

It validates requirements defined by:

• S0 – Knowledge Asset Package Architecture Specification
• SC1 – Common Data Types
• S2 – Packing List Schema
• S4 – KAP Key Delivery Message Schema

Package Validation defined by T3 SHALL successfully complete before Secure Delivery is performed.

2 Secure Delivery

2.1 Purpose

Secure Delivery enables an authorized recipient to obtain the symmetric File Keys required to decrypt encrypted Package Files.

2.2 Delivery Workflow

The reference delivery workflow SHALL consist of the following steps.

Generate File Keys
        │
        ▼
Generate Encrypted File Keys
        │
        ▼
Generate KAP-KDM
        │
        ▼
Sign KAP-KDM
        │
        ▼
Validate KAP-KDM
        │
        ▼
Recover File Keys
        │
        ▼
Decrypt Package Files

Each step SHALL successfully complete before the subsequent step is executed.

2.3 Delivery Responsibilities

The delivery process SHALL ensure:

• every encrypted Package File has exactly one File Key,
• every File Key has exactly one Key Identifier,
• every Encrypted File Key references exactly one Key Identifier,
• every KAP-KDM is recipient-specific,
• every KAP-KDM is digitally signed,
• the intended recipient can recover the contained File Keys.

3 Conformance Tests

The reference Secure Delivery process SHALL provide the following executable conformance tests.

TestPurposeT4.1 | Generate File Keys
T4.2 | Encrypt File Keys
T4.3 | Generate KAP-KDM
T4.4 | Sign KAP-KDM
T4.5 | Validate KAP-KDM
T4.6 | Recover File Keys
T4.7 | Decrypt Package Files

4 Test Execution Order

The Secure Delivery tests SHALL be executed in the following order.

T4.1 Generate File Keys
        ↓
T4.2 Encrypt File Keys
        ↓
T4.3 Generate KAP-KDM
        ↓
T4.4 Sign KAP-KDM
        ↓
T4.5 Validate KAP-KDM
        ↓
T4.6 Recover File Keys
        ↓
T4.7 Decrypt Package Files

Each test depends on the successful completion of all preceding tests.

5 Expected Results

The Secure Delivery process SHALL ensure that:

• every encrypted Package File can be decrypted,
• every File Key is correctly associated with its Key Identifier,
• every File Key corresponds to exactly one Key Identifier,
• every KAP-KDM is structurally valid,
• every KAP-KDM is cryptographically valid,
• File Keys can only be recovered by the intended recipient.

6 Conformance

An implementation claiming conformance with this specification SHALL:

• generate recipient-specific KAP-KDMs,
• preserve the association between File Keys and Key Identifiers,
• produce interoperable Encrypted File Keys,
• successfully recover all referenced File Keys,
• successfully decrypt all referenced Package Files.