This paper proposes the use of rule based systems, as an aid to system designers, for a study of potential attacks on key management schemes. This approach encourages the designer to consider the system from the attacker's viewpoint and to experiment with a model of the system to examine potential areas of vulnerability. A rule based model of the system is developed and the model is run with inputs comprising details of the information available to the attacker, e.g. plaintext and ciphertext messages that can be tapped etc. The attacker specifies the goal of the attack, e.g. knowledge of a transaction key; the rule based system seeks subgoals which, if satisfied, could lead to the attainment of the goal. In general, the goal cannot be attained, under normal operating circumstances, but the list of subgoals produced can identify information which would be of use to the attacker. This enables the designer to focus attention on specific aspects of the system. The designer can also experiment with the system by postulating that the attacker has gained certain secret information, and testing whether or not this information could enable the attacker to attain the ultimate goal. In addition, the designer can investigate the effect of special circumstances, e.g. appearance of DES semiweak keys or modifications to the system, by suitable additions or modifications to the production of the rule based system. Two systems are studied using the technique, the IBM key management scheme and an EFTPOS key management system proposed by Beker, Friend and Halliden.