Key management
lastmod 2025-11-25created 2022-03-2313 edits
Key management refers to the management of cryptographic keys in a cryptosystem. This includes generation, exchange, storage, use, crypto-shredding (destruction), and replacement of keys. It includes cryptographic protocol design, key servers, user procedures, and other relevant protocols.
Key management concerns keys at the user level, either between users or systems. This is in contrast to key scheduling, which typically refers to the internal handling of keys within the operation of a cipher.
Successful key management is critical to the security of a cryptosystem. It is the more challenging side of cryptography in that it involves aspects of social engineering such as system policy, user training, organizational and departmental interactions, and coordination between all of these elements, in contrast to pure mathematical practices that can be automated.
Categories
- Key management
- Software license manager
- Password manager
- Credential Store
- Secure Coding
- Serial code
- Product key (License key)
- Hashicorp Vault
- AWS Secrets Manager
- Akeyless Vault
- Keywhiz - A system for distributing and managing secrets
- Confidant
- Strongbox
- Azure Key Vault
- Docker:Secret (Docker secrets)
- Knox
- Doppler
- jwt-key-server
- Mailvelope Keyserver - A simple OpenPGP public key server that validates email address ownership of uploaded keys.
- Tatum KMS
- Snipe IT
- FOSSology
- shhgit - Open-source scanner for preventing secret leaks
- Infisical - Open source for encrypting environment variables and sharing them with your team
- Portable Secret - Keeping passwords safe
- Git:Credential
- QtKeychain
- TruffleHog - Open source that continuously scans to keep things like private keys and credentials from leaking
- Secret-tools
- Nebula Secret Management - A secret manager that is an alternative to centralized Vaults such as Hashicorp Vault and Infisical.
- Kanidm - A simple, secure, and fast identity management platform
- gokey - A lightweight password manager that "computes" passwords without any storage