Escrow Interface
The Escrow interface is the separate application that escrow users log in to, through the Escrow tab of the login window, to hold, share, and combine the key parts that recover a user's private key. It opens on a Quick start screen with the three common tasks, and offers a full table of every escrowed user for anything else. The Escrow interface is not Management: Management shows escrow users and certificates to tiCrypt administrators, but only an escrow user, logged in here with an escrow key, can share a key part or recover a key.
Why the Escrow interface exists
Key escrow only protects users if no one, including the people who run tiCrypt, can recover a key alone. tiCrypt therefore keeps escrow users, their keys, and their actions out of the main application. Each key part is encrypted for the escrow users of one group, and only those users can decrypt it with their own escrow key. Without a separate interface built around escrow keys, recovery would depend on tiCrypt accounts and roles, and an administrator who controls those accounts could reach the key parts.
The interface also enforces the group rule in what it shows: you can recover a key only when you hold a key part from every escrow group the key was split across, and you can share only the key parts you hold.
When to use the Escrow interface
- Share a key part: another escrow user is collecting key parts for a recovery and needs the part your group holds.
- Recover a key: you hold a key part from every group for a user who lost their key file or password.
- Share all key parts with another escrow user: a new member joins your group, or a member is being replaced, and needs every key part your group holds.
- Inspect who holds what: use the full Escrow interface table to see which escrow users hold which key parts for a user.
Before you begin
- Your escrow account is active: the site-key administrator signed your registration request and a Super-Admin applied it. See Escrow Users.
- You have your escrow key file and its password.
- For a recovery, your institution has a secure channel, outside tiCrypt, to give the user the new key file and its password.
Log in to the Escrow interface
- Open the Connect Application.
- Select your deployment card.
- In the login window, select the Escrow tab.
- Click Load Key and open your escrow key file, or drag the file onto the login box.
- Enter your password in Password. The field clears itself after 10 seconds without typing.
- Click Login.
Your escrow key stays in memory for the deployment's Private Key Timeout, 20 minutes by default. The user menu, opened from your icon in the toolbar, shows the time left next to a key icon. When it runs out, the message "Your Escrow key has been wiped from memory; re-login to continue" appears and you log in again.
Share a key part
This procedure describes how to give your group's key part for one user to another escrow user.
- On the Quick start screen, click Share a key part.
- Under Step 1, select the user whose key part you want to share. Use Search users... to filter the list. Under each user, the groups whose key part you hold are shown in green with a check mark. Users for whom you hold no key part cannot be selected. While the key parts are still loading, a notice reads "The users' key parts are still loading. A user can be selected once their key parts have arrived."
- Under Step 2, tick the key parts to share.
- Under Select an Escrow user to share with, select the escrow user. Only escrow users who are missing one of the ticked key parts are listed.
- Click Share Key Parts.
Only one share runs at a time. While a share task is running, starting another share from the full Escrow interface shows "Key parts are still being shared: wait for that to finish, then share again", so the same key parts are never added twice.
Recover a user's key
This procedure describes how to rebuild a user's private key once you hold a key part from every escrow group the key was split across.
-
On the Quick start screen, click Recover a key.
-
Under Step 1, select the user. Only users for whom you hold a key part from every group their key was split across are listed; otherwise the list reads "There are no recoverable user keys." While the key parts are still loading, it reads "Loading the users' key parts ..." instead.
-
Under Step 2, read the notice "A new key file will be made for the user. In the future, they must log in with this key file instead of their old one."
-
Under Password Configuration, select one:
- Generate and copy password: tiCrypt generates a random 22-character password.
- Type your own password: enter it in Password and Confirm Password. It must meet the deployment's password strength requirement.
-
Click Recover User Key.
-
If you chose Generate and copy password, the dialog "Recover <name>'s key" opens:
- Check Key file name. The default is the part of the user's email before the @, followed by the date, as in
jdoe_2026-11-10.key.json. The name is required and is limited to 50 characters. - Click Copy new password to clipboard. The password is not shown or stored anywhere else.
- Click Export key. It becomes available only after you copy the password; until then the dialog reads "Copy the new password to export the key".
If you chose Type your own password, no dialog opens, and the key file gets the default name.
- Check Key file name. The default is the part of the user's email before the @, followed by the date, as in
-
If your computer asks where to save the key file, choose a folder and save it.
-
If your deployment stores part of the encryption credentials on the server, the dialog "Finish recovering the key of <name>?" opens. Check that the key file named in the dialog was saved, then click Finish recovery.
jdoe_2026-11-10.key.json. It holds the user's existing private key, encrypted with the new password. On deployments with server-side credentials, a pop-up reads "Key recovery of <name> finished".On deployments with server-side credentials, Finish recovery replaces the credentials the server keeps for the user. Every earlier key file of theirs stops working, and only the file saved in this recovery can log in. A cancelled save dialog cannot be detected, so check the file before you finish. If you cancel instead, nothing changes on the server, the user's earlier key file keeps working, and the file saved in this recovery does not work.
Send the key file and the password to the user over separate secure channels. The user logs in with them and then changes the password. See Change Password.
Share all key parts with another escrow user
This procedure describes how to give every key part your group holds to another member of your group in one step. Bulk sharing works only within your own group; to share with an escrow user outside it, share one key part at a time.
- On the Quick start screen, click Share all key parts with another Escrow user.
- Under Step 1, select the escrow user. Each entry shows "Can share N key(s) from <group>" or "Cannot share any keys", or "Loading key parts ..." while the key parts are still loading.
- Under Step 2, review the notice and the Summary.
- Click Share N Key(s).
The full Escrow interface
Click Exit Quick start Interface on the Quick start screen to open the full table. Click Return to quick start interface in the toolbar to go back.
The following table describes the columns of the full Escrow interface table.
| Column | What it shows |
|---|---|
| Status | "Ready to restore" when you hold a key part from every group the user's key was split across. "Started (i/n)" when you hold i of the n key parts, your own group's and at least one shared with you. "Not started" when you hold only your own group's key part. "Missing your group's key part" when you hold none of your own group's key parts for the user. A key is split across the escrow groups that existed when it was escrowed; a group added later holds no part of it and does not count. |
| Name | The user whose key is escrowed. |
| Login ID | The user's Login ID. |
| One column per escrow group | A check mark when you hold that group's key part for the user. |
Open a row's ⋮ menu, or right-click the row, for these actions:
- Recover user key: rebuilds the user's key, as in Recover a user's key. It appears only when the status is "Ready to restore".
- Share keys with other Escrow users: opens "Share escrow key parts of <user>", where you tick the key parts you hold, select an escrow user, and click Share.
- Show Escrow keys: opens "Escrow keys for user: <name>", a table of which escrow users hold which group's key part for that user.
- Remove key parts shared with me: deletes the key parts other escrow users shared with you for that user, for example after a recovery is finished. Your own group's key part is kept. It appears only when another escrow user shared a key part with you. The server refuses to delete the last copy of a key part, so that one is reported as an error and kept.
Click the Refresh button in the toolbar to reload the table, including users escrowed since you logged in. The table reads "Refreshing ..." while it loads. If the key parts of some users cannot be loaded, the other users still show their status and actions, and an error says how many users failed.
The toolbar button with the tooltip Share all key parts with user in my group opens "Share <group> keys with another <group> user", which shares every key part of your group with another member of your group, as in Share all key parts with another escrow user. It shows "You are not in any group" if your escrow account has no group, and "No other escrow users in the group" if you are its only member.
Your escrow account
The user menu, opened from your icon in the toolbar, holds:
- My Profile: your name, email, and the escrow group you belong to.
- Change password: re-encrypts your escrow key with a new password. See Escrow Users.
- Log out: wipes your escrow key from memory and returns to the login window.
What happens next
Recovery sends nothing to the user. tiCrypt decrypts the key parts with your escrow key, combines them into the Recovery Key, decrypts the user's escrowed private key, and writes it to the new key file under the new password. On deployments that store part of the encryption credentials on the server, Finish recovery also replaces them, so the user's old key file stops working. Nothing changes on the server before you confirm that the new key file was saved.
Errors and resolutions
| Message | Meaning and resolution |
|---|---|
| "File is not an escrow key" | You loaded a user key or a site key on the Escrow tab. Load your escrow key file. |
| "Incorrect password or key file, please try again" | The password does not open this escrow key file. Check the password and that you loaded your own escrow key. |
| "Failed to load own user info", "Failed to load Escrow groups" | Your escrow account may not be active yet. Ask the site-key administrator and a Super-Admin to complete your activation. |
| "There are no recoverable user keys." | You do not hold a key part from every group for any user. Ask one escrow user from each missing group to share their key part with you. |
| "Key recovery failed" | The key could not be rebuilt or exported. Do not send the user any key file from this attempt. Click Refresh, check that the status is still "Ready to restore", and recover the key again. |
| "Key recovery failed. The key file saved just now does not work, because its credentials could not be stored" | The server did not accept the new credentials after Finish recovery. Delete the key file from this attempt and recover the key again. |
| "The key recovery of <name> was not finished: nothing changed on the server, and the key file saved just now does not work" | You cancelled the Finish recovering the key of <name>? dialog. The user's earlier key file still works. Delete the key file from this attempt; recover the key again if the user still needs one. |
| "Key parts are still being shared: wait for that to finish, then share again" | A share task is still running. Wait for it to finish in the task widget, then start the next share. |
| "Failed to refresh escrow data: the key parts of N of M users could not be loaded; first reason: ..." | Some users' key parts did not load. The other users show their status and can be recovered. Click Refresh to load the rest. |
| "Failed to delete N of M shared recovery key fragment(s) of <name>" | Remove key parts shared with me could not delete some key parts. The server keeps the last copy of a key part, so a part no one else holds stays with you. |