OpenKCM (Open Key Chain Manager)

openkcm.io

LinuxAPISelf-hosted

Spec score 7.3 #10 of 24 in Encryption Key Management Software

What it is

OpenKCM (Open Key Chain Manager) is a free, open-source key management service for governing encryption keys and protecting data at rest. It supports BYOK key import and HYOK, which keeps master keys in a customer’s infrastructure. Its recursive L1–L4 hierarchy makes data keys dependent on higher-level keys. Governance and policy control are handled by CMK, while Krypton performs cryptographic execution; applications request key operations through the KMIP API.

The Gateway is designed to run near applications, such as in Kubernetes or a cloud VPC, and the same software can operate across AWS, Azure and on-premise environments. Customer root keys can remain in AWS, Azure or GCP key services, or on-premise HSMs, while OpenKCM holds a reference to the L1 key. A kill switch can halt downstream key use by removing that reference or revoking the root key. CMK connects to a corporate identity provider and sends audit logs to SIEM systems. The project’s CMK and Krypton components are actively being developed; encryption and decryption operations are in progress, while audit export, high availability and disaster recovery are planned for 2027.

Spec sheet

Purpose: OpenKCM is an open-source key management service for managing cryptographic keys across services and regions.Read 5 Oct 2026 · openkcm.io
Intended users: The maker identifies cloud-native organizations, enterprises with regional key lifecycle needs, SaaS platforms, and developers of encrypted storage as intended users.Read 5 Oct 2026 · openkcm.io
Deployment: The documentation describes deploying the Gateway near applications in a Kubernetes cluster or cloud VPC, and says the same Gateway software can run across AWS, Azure, and on-premise environments.Read 4 Oct 2026 · openkcm.io
Integrations: The trust model names AWS, Azure, and GCP external KMS services and on-premise Thales or Entrust HSMs as locations for customer root keys.Read 4 Oct 2026 · openkcm.io
License: The OpenKCM GitHub organization lists its CMK and Krypton repositories under the Apache-2.0 license.Read 5 Oct 2026 · github.com
Architecture: OpenKCM separates governance and policy control in CMK from cryptographic execution in Krypton.Read 4 Oct 2026 · openkcm.io
BYOK and HYOK: It supports importing customer keys (BYOK) and keeping master keys in the customer’s own infrastructure (HYOK).Read 5 Oct 2026 · openkcm.io
Cryptographic operations: The Krypton execution plane wraps and unwraps keys using keys temporarily loaded into secure memory.Read 5 Oct 2026 · openkcm.io
Development status: The project documentation says the CMK layer can be tried through its repository instructions and Krypton is in active progress.Read 5 Oct 2026 · github.com
Edge deployment: The Krypton Gateway is described as running in an application environment such as Kubernetes or a VPC.Read 5 Oct 2026 · openkcm.io
External key stores: The trust model names AWS, Azure, and GCP key services and on-premise HSMs as locations for customer root keys.Read 5 Oct 2026 · openkcm.io
Governance and execution: The trust model separates the CMK governance plane from the Krypton cryptographic execution plane.Read 5 Oct 2026 · openkcm.io
Identity and audit: The CMK component connects to a corporate identity provider and outputs audit logs to SIEM systems.Read 5 Oct 2026 · openkcm.io
Key hierarchy: It organizes keys in a recursive L1–L4 hierarchy and describes data keys as dependent on higher-level keys.Read 5 Oct 2026 · openkcm.io
Key management: It supports key hierarchies, importing customer keys through BYOK, and keeping master keys in the customer’s infrastructure through HYOK.Read 4 Oct 2026 · openkcm.io
Key security: The trust model says the customer’s L1 root key remains in the customer’s external KMS or HSM, while OpenKCM holds a reference to it.Read 4 Oct 2026 · openkcm.io
Planned work: The project roadmap lists encryption and decryption operations as in progress, while audit export, high availability, and disaster recovery are planned for 2027.Read 5 Oct 2026 · github.com
Project home: OpenKCM says it is a project of Linux Foundation Europe.Read 5 Oct 2026 · openkcm.io
Project status: The project’s GitHub page says its CMK control plane and Krypton crypto layer are actively being developed and links to documentation and a roadmap.Read 4 Oct 2026 · github.com
Protocol: OpenKCM describes KMIP as its standard API for applications to request key operations.Read 4 Oct 2026 · openkcm.io
Revocation: OpenKCM describes a kill switch that can stop downstream key use by deleting the root-key pointer or revoking the root key.Read 4 Oct 2026 · openkcm.io

Strong points and limits

Strong points

Supports BYOK and HYOK
Customer root keys can remain in external KMS or HSM
KMIP API for application key operations
Apache-2.0 licensed and free

Limits

CMK and Krypton are actively being developed
Encryption and decryption operations are in progress
Audit export, high availability and disaster recovery are planned for 2027

Who it suits

OpenKCM is aimed at regulated-data organizations, enterprises with regional key-management needs, SaaS platforms seeking BYOK or HYOK, and developers of encrypted storage solutions. It fits teams able to deploy and manage a hybrid key service.

Verdict

OpenKCM separates key governance from cryptographic execution and supports customer-managed root keys across cloud and on-premise environments. Its development status and planned operational capabilities are important considerations for deployment.