OpenKCM (Open Key Chain Manager) vs SAP Data Custodian Key Management Service

OpenKCM (Open Key Chain Manager) is a free, open-source key management service for governing encryption keys and protecting data at rest. It supports BYOK key import and HYOK, which keeps master keys in a customer’s infrastructure. Its recursive L1–L4 hierarchy makes data keys dependent on higher-level keys. Governance and policy control are handled by CMK, while Krypton performs cryptographic execution; applications request key operations through the KMIP API.

The Gateway is designed to run near applications, such as in Kubernetes or a cloud VPC, and the same software can operate across AWS, Azure and on-premise environments. Customer root keys can remain in AWS, Azure or GCP key services, or on-premise HSMs, while OpenKCM holds a reference to the L1 key. A kill switch can halt downstream key use by removing that reference or revoking the root key. CMK connects to a corporate identity provider and sends audit logs to SIEM systems. The project’s CMK and Krypton components are actively being developed; encryption and decryption operations are in progress, while audit export, high availability and disaster recovery are planned for 2027.

SAP Data Custodian Key Management Service is a cloud service accessed through the web for managing cryptographic keys. It supports three listed key types: AES, RSA, and ECC. Automated key rotation changes keys according to the service’s rotation capability, while key audit logs provide records of key-related activity. The service supports external key control and also lists a combined external-and-other control option, giving organizations more than one way to handle control of keys. Its deployment model is cloud, and its platform is web. SAP sells the service on a paid basis. Pricing is available on request, and no free plan is listed. Organizations can use the service as a web-based cloud option when AES, RSA, or ECC management, rotation, control choices, and audit logging are requirements.