OpenKCMKey Chain Management for cloud services

Cloud customers stay in control of their data: they bring their own key or keep it in their own keystore, decide who may manage it, and withdraw it from every service and region at once. Krypton, the key engine, creates the key hierarchies that protect the data and delivers keys to workloads.

What is OpenKCM?

Customer keys

Crypto

GitHub

🔑 Keys under customer control

Bring your own key material (BYOK), or hold your own key (HYOK) in your own keystore. Disable a key, and every system that uses it is informed.

About CMK

👥 Separation of duties

Each tenant signs in with its own identity provider. Roles keep administration, key management and auditing apart, and sensitive changes can require approval.

Roles and access

🌍 Every region informed

CMK sends key and system changes to the services of every region and tracks the result, so a decision in CMK is enforced where the data lives.

Connect a system

🧱 Krypton

Creates and operates cryptographic key hierarchies and delivers keys to workloads over KMIP. Used by CMK, and usable on its own. In pre-production.

About Krypton

🔌 Pluggable

Keystores and user directories connect through plugins. AWS KMS and SCIM directories are supported today; further keystores can be added as plugins.

Plugins

☸️ Kubernetes-native

Every service ships as a container image with a Helm chart. The documentation covers planning, configuration, hardening and operations.

Deployment planning

Find your way

You are…	Start here	Then
Evaluating OpenKCM for your platform	Overview	Core concepts, Trust model
A customer who manages keys in CMK: tenant administrator, key administrator or auditor	Manage your keys	Keys, Approvals
Building a cloud service that encrypts data with customer keys	Connect a regional system	CMK API, Krypton
Operating the platform that runs CMK	Deployment planning	Install the Registry, Install a regional deployment, Connect a regional tenant, Operations
Contributing to OpenKCM	Contributing	Releases, Roadmap
Looking for help, or reporting a problem or a vulnerability	Community and support	Releases

New to the terms? The glossary explains them all.