Home / Knowledge hub / Key escrow
Knowledge hub
Key escrow
Keeping a copy of an encryption key with a trusted party so data can be recovered.
What it means
Key escrow is the practice of placing a copy of a cryptographic key, or parts of it, in the custody of one or more trusted third parties. NIST calls them escrow agents. If the original key is lost or its owner is unavailable, the escrowed copy can be used to recover the data.
It trades one risk for another. Without a copy, a lost key means lost data for good. With a copy, there is now a second place from which the key could be taken.
Why it matters
Businesses use it because people leave, laptops are wiped and passwords are forgotten. Without a recovery path, years of encrypted files or customer records can become unreadable overnight, which is a business problem as well as a technical one.
The escrow store is also an attractive target. Whoever can request a key from it can read everything the key protects, so its access rules, approvals and logging need to be stricter than those of the systems it backs up.
How it shows up
You meet it in disk and device encryption recovery keys, in managed key services with backup copies, and in contracts where a customer or regulator requires a recovery route. It often hides behind a button labelled recovery.
The mistakes repeat. Recovery keys are kept in a shared drive or a ticket. One administrator can release any key alone. Releases are not logged or reviewed. The recovery process has never been tried. Check who can retrieve a key, how many people must agree, and when it was last tested.
Questions people ask
Key escrow, answered
Is key escrow the same as a backup?
Close, but not identical. A backup copies data. Escrow keeps a copy of the key that unlocks the data, usually with a third party and rules about when it can be released.
Both need protecting, because a backed-up key defeats encryption if it is exposed.
Who should hold escrowed keys?
Someone independent of the people who use the key day to day, under written release rules. That might be a separate team, a managed key service or a specialist custodian.
Splitting a key between several holders, so no single person can use it, is a common safeguard.
Does escrow weaken encryption?
The algorithm is as strong as before. What changes is the number of ways to get the key. Each extra copy and each person able to release it is an extra route to the data.
That is why release controls and logging carry so much weight.
When is key escrow a bad idea?
When the data is so sensitive that no recovery route is acceptable, or when you cannot control who may release the key. Some products deliberately avoid it so that even the provider cannot read customer data.
Decide it deliberately, not by default.
How do we test our escrow set-up?
Run a recovery drill with a non-critical key. Check that the right people can complete it, that the wrong people cannot, and that every step is recorded.
Then confirm the escrowed copy is stored with the same care as the original, including least privilege access.
Sources
Where this comes from
Related
Terms that sit next to this one
Secrets management
Keeping keys, passwords and tokens out of code and in a vault.
Key rotation
Replacing a credential on a schedule so a leaked one has a short life.
Cloud key management
Using the provider's managed service to create, store and rotate encryption keys.
Break-glass account
A powerful emergency account, locked away and loudly monitored when used.
Envelope encryption
Encrypting data with a data key, then encrypting that key with a master key.
Who can release a stored key?
Recovery routes are a quiet way back into data. We find vulnerabilities in your web app and its APIs, and each finding carries the evidence we got by exploiting it. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.