keypti

Keypti is a modular, open-source framework for secure key management and access control designed for distributed and edge computing environments. It provides cryptographic key generation, storage, rotation, and revocation, with hardware-backed safeguards and policy-driven access controls. The goal is to unify key management across cloud, on-premises, and edge devices while preserving strong security guarantees and auditable operations.

Keypti comprises several components: a Key Management Layer that stores keys in a cryptographic module or TPM/HSM; an Access Policy Engine that expresses who or what may access keys under which conditions; a Token and Auditing subsystem that issues short-lived proofs of permission and records authentication events; and client libraries and device agents that enforce policies locally using secure enclaves when available. It supports standard interfaces and can interoperate with existing KMIP and KMS implementations through adapters. It emphasizes modularity, enabling optional hardware roots of trust and software-based fallbacks.

History and development: The project originated in 2019 as part of the Open Trust Initiative, with the first public release in 2021. It has since seen involvement from several companies in the security and IoT space and has released multiple minor versions focused on performance and policy expressiveness. It is maintained by a community-driven governance model with ongoing work on privacy-preserving policy attestations and better cross-domain revocation.

Applications and use cases: Keypti is used to secure keys for IoT devices, containerized microservices, and cross-organization data signing. It enables automated key rotation schemes and audits for regulatory compliance. Limitations include added complexity, potential performance overhead on constrained devices, and the need for careful policy design to avoid misconfigurations.

See also: Key management, public key infrastructure, hardware security module.