Eviden KMS vs OpenKCM (Open Key Chain Manager)

Eviden KMS centralizes encryption and decryption, key management, and certificate management. Its architecture combines key lifecycle management, an encryption oracle, and public key infrastructure. Administrators can generate, store, rotate, distribute, and revoke keys, and set access policies. The product supports FIPS 140-3 mode and KMIP versions 1.0–1.4 and 2.0–2.1 in binary and JSON formats, but implements a targeted subset rather than the entire KMIP standard. Listed integrations include Trustway Proteccio, Crypt2Pay, Utimaco, Nitrokey HSM 2, and SmartCard HSMs; cloud options include Azure BYOK, GCP CSEK and CMEK, AWS BYOK, and AWS Fargate. It also integrates with Google Workspace Client-Side Encryption, Microsoft 365 Double Key Encryption, and several databases. Deployment options include Debian and RPM packages, Windows and macOS installers, and standard or FIPS Docker images. Its web GUI supports client certificates and OIDC token authentication. Pricing is on request, with per-CPU pricing, connectors included, and any number of servers.

OpenKCM (Open Key Chain Manager) is a free, open-source key management service for governing encryption keys and protecting data at rest. It supports BYOK key import and HYOK, which keeps master keys in a customer’s infrastructure. Its recursive L1–L4 hierarchy makes data keys dependent on higher-level keys. Governance and policy control are handled by CMK, while Krypton performs cryptographic execution; applications request key operations through the KMIP API.

The Gateway is designed to run near applications, such as in Kubernetes or a cloud VPC, and the same software can operate across AWS, Azure and on-premise environments. Customer root keys can remain in AWS, Azure or GCP key services, or on-premise HSMs, while OpenKCM holds a reference to the L1 key. A kill switch can halt downstream key use by removing that reference or revoking the root key. CMK connects to a corporate identity provider and sends audit logs to SIEM systems. The project’s CMK and Krypton components are actively being developed; encryption and decryption operations are in progress, while audit export, high availability and disaster recovery are planned for 2027.