Eviden KMS vs OpenStack Barbican

Eviden KMS centralizes encryption and decryption, key management, and certificate management. Its architecture combines key lifecycle management, an encryption oracle, and public key infrastructure. Administrators can generate, store, rotate, distribute, and revoke keys, and set access policies. The product supports FIPS 140-3 mode and KMIP versions 1.0–1.4 and 2.0–2.1 in binary and JSON formats, but implements a targeted subset rather than the entire KMIP standard. Listed integrations include Trustway Proteccio, Crypt2Pay, Utimaco, Nitrokey HSM 2, and SmartCard HSMs; cloud options include Azure BYOK, GCP CSEK and CMEK, AWS BYOK, and AWS Fargate. It also integrates with Google Workspace Client-Side Encryption, Microsoft 365 Double Key Encryption, and several databases. Deployment options include Debian and RPM packages, Windows and macOS installers, and standard or FIPS Docker images. Its web GUI supports client certificates and OIDC token authentication. Pricing is on request, with per-CPU pricing, connectors included, and any number of servers.

OpenStack Barbican is the OpenStack Key Manager service for storing, provisioning, and managing secrets such as keys, certificates, passwords, and raw binary data. Its barbican-api component provides an OpenStack-native REST API for managing secrets; barbican-worker and barbican-keystone-listener are also part of the service. The listener manages Barbican’s database records for Keystone projects when those projects are deleted. A plugin architecture lets operators connect software secret stores or hardware such as HSMs. Documented options include KMIP, Dogtag, and Vault secret-store plugins, as well as PKCS#11 crypto plugins. With PKCS#11, master encryption and HMAC keys can reside in an HSM. Operators can develop plugins for storage, generation, and event handling, though support status may be stable, experimental, or out-of-tree. The default Simple Crypto plugin stores its single encryption key in plaintext in barbican.conf, so service-node access must be restricted carefully. Container ACL settings do not carry over to associated secrets, and ACL functionality requires Keystone integration. Barbican is free under Apache 2.0; installation guidance assumes a working OpenStack deployment.