KeyRack vs Utimaco Enterprise Secure Key Manager

KeyRack is an open-source key management coordination layer that you deploy in your own infrastructure, rather than use as a hosted cloud KMS. It tracks key hierarchies, drives rotation and delegates cryptographic operations to configured backends. Its KEK-wrapping hierarchies support namespace-scoped rules and cascade operations. Authorization is checked on every operation through an external policy decision point such as Cedar or OPA; KeyRack does not bundle an identity provider, but can integrate with OIDC providers including Keycloak, Auth0, Okta, Azure AD and Google Identity Platform. Backend choices include PKCS#11, HashiCorp Vault Transit, a KMIP client and in-process software for development and testing. Audit events can be delivered through NATS, files or stdout, with BLAKE3 hash-chain linking and optional Ed25519 signing. Non-exportable keys in an HSM or Vault provider remain there; exportable keys may leave through authorized export operations. The open-source core costs nothing under AGPL-3.0-or-later. Commercial licensing is available by contacting KeyRack for pricing and evaluation access.

Utimaco Enterprise Secure Key Manager (ESKM) centralizes cryptographic key management across on-premises and cloud environments. It provides policy controls, centralized administration, and audit trails for key lifecycle management, alongside monitoring, recovery, scheduled backups, log rotation, and restore functions. Administrators can use a web GUI or command-line interface. ESKM supports OASIS KMIP, a RESTful API, and a native XML-based KMS protocol; it conforms to KMIP specifications 1.0 through 2.1 and supports client libraries including OpenKMIP and PyKMIP. The product page states capacity for more than 2 million keys, over 25,000 clients, and thousands of nodes per distributed cluster. Four models are available, including a Linux-based virtual appliance and hardware appliances. Physical L3 and L4 models include embedded HSMs identified as FIPS 140-2 Level 3 and Level 4; the virtual L1 is a hardened appliance with FIPS 140-2 Level 1 security. Listed key types include AES, 3-Key Triple DES, HMAC, RSA, and ECDSA. Pricing is on request.