There are two options for user-level key stores on Linux:

• GnomeKeyring
• KWallet

This does not address the need for a system-level key store.

If malicious code can run in the context of the user, DPAPI provides no protection, since said malicious code can simply ask DPAPI to decrypt it.

The only scenario it protects against, is if the data or disk is stolen, but the password is not known. The password can be reset easily but this makes the DPAPI protected data inaccessible. An attacker would have to crack the password hash from the Windows credential cache, but be aware that this is generally a very do-able task. If you know that this is what you have to do you can probably do it in most cases.

Your real problem is "how to easily manage the KEK".

DPAPI takes care of key management by piggy-backing on the Windows password. You would need a PAM module to do this on Linux, and there isn't one.

You should consider piggy-backing on whatever the user is already using, e.g. OSX Keychain, KDE's KWallet, Gnome's GnomeKeyring etc, which I believe have APIs.

If you were using Python, you should consider something like this:

• https://pypi.python.org/pypi/keyring