Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like to implement a fairly basic but nonetheless robust key server for generating and managing symmetric encryption keys. Are there guidelines or best practices out there that I should peruse? What about open-source key servers? Thanks much.

share|improve this question

Try to use industry standards for key servers and key management. If you try to roll your own at any level, there's a good chance there'll be a weak link at some point which compromises the lot.

NIST have excellent resource for key management in Special Publication 800-57. That's split into 3 parts so have a look for it on Google.

PGP is excellent for asymmetric encryption and there are a number of papers on configuring a PGP server. However, your question asked about symmetric encryption...

The only open source key server I've come across for symmetric encryption key management is StrongAuth's StrongKey Lite Encryption System. You can also use encryption libraries such as mcrypt, Java key store etc but it's always the key management which could expose a weakness. Also, at some point in the code you're going to store the encryption key in plain text...

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.