KeyRack vs OpenKCM (Open Key Chain Manager)
KeyRack
keyrack.io
OpenKCM (Open Key Chain Manager)
openkcm.ioSide by side
| Figure | KeyRack | OpenKCM (Open Key Chain Manager) |
|---|---|---|
| Price from | Free | — |
| Free plan | Yes | — |
| Free trial | — | — |
| Open source | — | — |
| Linux | — | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 2 | 0 |
| Spec score · Key Management Software | 7.5 (#8) | 7.1 (#11) |
| Deployment | KeyRack is software you deploy in your own infrastructure, rather than a hosted cloud KMS. | The documentation describes deploying the Gateway near applications in a Kubernetes cluster or cloud VPC, and says the same Gateway software can run across AWS, Azure, and on-premise environments. |
| Integrations | The commercial AWS KMS shim accepts standard AWS SDK requests, while the commercial Barbican shim exposes the OpenStack Barbican REST API. | The trust model names AWS, Azure, and GCP external KMS services and on-premise Thales or Entrust HSMs as locations for customer root keys. |
| Intended users | The maker identifies regulated industries, multi-cloud platforms, SaaS providers using HYOK, and OpenStack operators as audiences for KeyRack. | The maker identifies cloud-native organizations, enterprises with regional key lifecycle needs, SaaS platforms, and developers of encrypted storage as intended users. |
| Key hierarchy | It supports KEK-wrapping hierarchies with namespace-scoped rules and cascade operations. | It organizes keys in a recursive L1–L4 hierarchy and describes data keys as dependent on higher-level keys. |
Plans
In their own words
KeyRack
KeyRack is an open-source key management coordination layer that you deploy in your own infrastructure, rather than use as a hosted cloud KMS. It tracks key hierarchies, drives rotation and delegates cryptographic operations to configured backends. Its KEK-wrapping hierarchies support namespace-scoped rules and cascade operations. Authorization is checked on every operation through an external policy decision point such as Cedar or OPA; KeyRack does not bundle an identity provider, but can integrate with OIDC providers including Keycloak, Auth0, Okta, Azure AD and Google Identity Platform. Backend choices include PKCS#11, HashiCorp Vault Transit, a KMIP client and in-process software for development and testing. Audit events can be delivered through NATS, files or stdout, with BLAKE3 hash-chain linking and optional Ed25519 signing. Non-exportable keys in an HSM or Vault provider remain there; exportable keys may leave through authorized export operations. The open-source core costs nothing under AGPL-3.0-or-later. Commercial licensing is available by contacting KeyRack for pricing and evaluation access.
OpenKCM (Open Key Chain Manager)
OpenKCM (Open Key Chain Manager) is a free, open-source key management service for governing encryption keys and protecting data at rest. It supports BYOK key import and HYOK, which keeps master keys in a customer’s infrastructure. Its recursive L1–L4 hierarchy makes data keys dependent on higher-level keys. Governance and policy control are handled by CMK, while Krypton performs cryptographic execution; applications request key operations through the KMIP API.
The Gateway is designed to run near applications, such as in Kubernetes or a cloud VPC, and the same software can operate across AWS, Azure and on-premise environments. Customer root keys can remain in AWS, Azure or GCP key services, or on-premise HSMs, while OpenKCM holds a reference to the L1 key. A kill switch can halt downstream key use by removing that reference or revoking the root key. CMK connects to a corporate identity provider and sends audit logs to SIEM systems. The project’s CMK and Krypton components are actively being developed; encryption and decryption operations are in progress, while audit export, high availability and disaster recovery are planned for 2027.