Google tries its hand at cryptography

Google has released a new cryptography tool

Google is taking a step into the field of cryptography, with KeyCzar, an open-source tool that allows developers to use encryption within their applications.

The aim of the tool is to provide developers with a more secure and reliable cryptography tool that can easily be inserted into their code, according to Steve Weiss, the Google security software engineer who helped develop KeyCzar.

"Cryptography is notoriously hard to get right and, if improperly used, can create serious security holes," Weiss wrote in a company blog posting.

Weiss explained that common mistakes, such as using outdated algorithms or not being able to rotate in new encryption keys can render the tools completely useless. The aim of KeyCzar was to simplify those acts and allow developers to not only put cryptography tools in place, but also manage and change encryption keys if need be.

"Keyczar's key versioning system makes it easy to rotate and revoke keys without worrying about backward compatibility or making any changes to source code," Weiss wrote.

Google warns, however, that KeyCzar should not be viewed as a complete cryptography system. It does not contain any actual crypto libraries and does not perform many of the actual cryptography tasks.

"Keyczar is essentially a library and doesn't actually serve keys or certificates," the project's developers said on a 'non-goals' page.

"Keyczar keys are just flat files in a directory."

The first versions of KeyCzar are being made available for download on the Google Code service. The tool is currently limited to the Java and Python programming languages, but Google plans to release a C++ version shortly.

The company is also inviting third parties to get involved with the project. Developers can join through KeyCzar's Google Code page.