I would like to implement a fairly basic but nonetheless robust key server for generating and managing symmetric encryption keys. Are there guidelines or best practices out there that I should peruse? What about open-source key servers? Thanks much.


Try to use industry standards for key servers and key management. If you try to roll your own at any level, there's a good chance there'll be a weak link at some point which compromises the lot.

NIST have excellent resource for key management in Special Publication 800-57. That's split into 3 parts so have a look for it on Google.

PGP is excellent for asymmetric encryption and there are a number of papers on configuring a PGP server. However, your question asked about symmetric encryption...

The only open source key server I've come across for symmetric encryption key management is StrongAuth's StrongKey Lite Encryption System. You can also use encryption libraries such as mcrypt, Java key store etc but it's always the key management which could expose a weakness. Also, at some point in the code you're going to store the encryption key in plain text...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.