Bloombase KeyCastle vs OpenStack Barbican

Bloombase KeyCastle manages cryptographic keys and certificate authority certificates, including private signing keys, public verification keys, authentication keys, and data encryption keys. It supports key creation, import, protected storage, verification, validation, inquiry, and deletion. Bloombase says keys stored in KeyCastle cannot technically be retrieved in plain form; its specifications say capacity is limited by available system storage, not a preset key count. Listed algorithms include AES, RSA, SHA hashes, Camellia, SEED, ARIA, and post-quantum options such as CRYSTALS-Kyber and CRYSTALS-Dilithium. KeyCastle supports PKCS#11 hardware security modules, OASIS KMIP, and a listed FIPS 140-2 compliant Bloombase Cryptographic Module. It connects with key services from AWS, Google, IBM, Microsoft Azure, and Oracle. Certificate functions include X.509 and PKCS#12 import and export, validity checks, retrieval, and revocation checks. Administration includes web and command-line consoles, central configuration, SNMP, and syslog. Optional high availability supports active-active or active-standby operation; recovery options include configuration backup and restore and recovery quorums. Pricing is on request, and Bloombase says customers may request a 30-day evaluation kit.

OpenStack Barbican is the OpenStack Key Manager service for storing, provisioning, and managing secrets such as keys, certificates, passwords, and raw binary data. Its barbican-api component provides an OpenStack-native REST API for managing secrets; barbican-worker and barbican-keystone-listener are also part of the service. The listener manages Barbican’s database records for Keystone projects when those projects are deleted. A plugin architecture lets operators connect software secret stores or hardware such as HSMs. Documented options include KMIP, Dogtag, and Vault secret-store plugins, as well as PKCS#11 crypto plugins. With PKCS#11, master encryption and HMAC keys can reside in an HSM. Operators can develop plugins for storage, generation, and event handling, though support status may be stable, experimental, or out-of-tree. The default Simple Crypto plugin stores its single encryption key in plaintext in barbican.conf, so service-node access must be restricted carefully. Container ACL settings do not carry over to associated secrets, and ACL functionality requires Keystone integration. Barbican is free under Apache 2.0; installation guidance assumes a working OpenStack deployment.