Network Computing is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them. Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Analysis: Enterprise Key Management: Page 10 of 16

Additionally, PKCS#11 may not address the entire range of mechanisms and keys needed for complete EKM. Key management interoperability on an enterprise scale is not a problem PKCS#11 was meant to solve.

Microsoft's CAPI (CryptoAPI) is another potential piece of the puzzle in that it lets Windows apps be developed for a standard cryptographic interface and have their underlying mechanisms modified by modules. These modules let Windows apps integrate their key management into an EKM platform, but using CAPI solves the problem for Windows-based applications only, and it requires that a piece of the management application be installed on each end point that will use cryptographic features, making for a potentially onerous deployment scenario.

PKI (Public Key Infrastructure) initiatives deal with many issues core to EKM. Indeed, PKI seeks to solve key handling for many current forms of encryption that are identity-based, including secure e-mail and instant messaging, user authentication, and some forms of document rights management. However, PKI technologies aren't built to handle encryption keys not tied to a particular user, as in the case of tape backups, for example.

Almost, But Not Quite

Despite a lack of standards to unite different approaches to key management, several vendors provide tantalizing glimpses of what EKM needs to look like. NeoScale's CryptoStor KeyVault, nCipher's keyAuthority Solution Suite and RSA's Key Manager are all good starts, but they suffer from a lack of a unified industry-standard key-management interface, and none can be dropped into an existing enterprise environment and easily begin managing all the different applications currently doing encryption.