Cryptsoft KMIP Server vs OpenStack Barbican

Cryptsoft KMIP Server is a C and Java SDK for developers adding key-management server capability to their own products. The SDK supports KMIP versions 1.0 through 2.1, with KMIP 3.0 support also listed, and Cryptsoft describes it as OASIS KMIP compliant. The company says its SDKs connect with HSMs, key-management servers, cloud services, storage and embedded devices, and support HSM integration and policy control. Keyward is a rebrandable web console for the server; it offers two layouts, theming, passkey sign-in and nine languages, and communicates over native KMIP or REST. Cryptsoft says KMIP 3.0 supports ML-KEM, ML-DSA and SLH-DSA through OpenSSL 3.5+ for C or Bouncy Castle 1.81+ for Java. The server can also deliver quantum key distribution material through KMIP as an ETSI-compliant key management entity. Linux and Windows are listed, with custom platform ports available on request. The product is intended for OEM integration; pricing and licensing details require contacting Cryptsoft.

OpenStack Barbican is the OpenStack Key Manager service for storing, provisioning, and managing secrets such as keys, certificates, passwords, and raw binary data. Its barbican-api component provides an OpenStack-native REST API for managing secrets; barbican-worker and barbican-keystone-listener are also part of the service. The listener manages Barbican’s database records for Keystone projects when those projects are deleted. A plugin architecture lets operators connect software secret stores or hardware such as HSMs. Documented options include KMIP, Dogtag, and Vault secret-store plugins, as well as PKCS#11 crypto plugins. With PKCS#11, master encryption and HMAC keys can reside in an HSM. Operators can develop plugins for storage, generation, and event handling, though support status may be stable, experimental, or out-of-tree. The default Simple Crypto plugin stores its single encryption key in plaintext in barbican.conf, so service-node access must be restricted carefully. Container ACL settings do not carry over to associated secrets, and ACL functionality requires Keystone integration. Barbican is free under Apache 2.0; installation guidance assumes a working OpenStack deployment.