tiCrypt

Escrow Interface

AdministratorRequires: An active escrow user account and its escrow key file

The Escrow interface is the separate application that escrow users log in to, through the Escrow tab of the login window, to hold, share, and combine the key parts that recover a user's private key. It opens on a Quick start screen with the three common tasks, and offers a full table of every escrowed user for anything else. The Escrow interface is not Management: Management shows escrow users and certificates to tiCrypt administrators, but only an escrow user, logged in here with an escrow key, can share a key part or recover a key.

Why the Escrow interface exists

Key escrow only protects users if no one, including the people who run tiCrypt, can recover a key alone. tiCrypt therefore keeps escrow users, their keys, and their actions out of the main application. Each key part is encrypted for the escrow users of one group, and only those users can decrypt it with their own escrow key. Without a separate interface built around escrow keys, recovery would depend on tiCrypt accounts and roles, and an administrator who controls those accounts could reach the key parts.

The interface also enforces the group rule in what it shows: you can recover a key only when you hold a key part from every escrow group, and you can share only the key parts you hold.

When to use the Escrow interface

• Share a key part: another escrow user is collecting key parts for a recovery and needs the part your group holds.
• Recover a key: you hold a key part from every group for a user who lost their key file or password.
• Share all key parts with another escrow user: a new member joins your group, or a member is being replaced, and needs every key part your group holds.
• Inspect who holds what: use the full Escrow interface table to see which escrow users hold which key parts for a user.

Before you begin

• Your escrow account is active: the site-key administrator signed your registration request and a Super-Admin applied it. See Escrow Users.
• You have your escrow key file and its password.
• For a recovery, your institution has a secure channel, outside tiCrypt, to give the user the new key file and its password.

Log in to the Escrow interface

1. Open the Connect Application.
2. Select your deployment card.
3. In the login window, select the Escrow tab.
4. Click Load Key and open your escrow key file, or drag the file onto the login box.
5. Enter your password in Password. The field clears itself after 10 seconds without typing.
6. Click Login.

Result: The Escrow interface opens on Quick start Key Escrow Interface.

Your escrow key stays in memory for the deployment's Private Key Timeout, 20 minutes by default. The user menu, opened from your icon in the toolbar, shows the time left next to a key icon. When it runs out, the message "Your Escrow key has been wiped from memory; re-login to continue" appears and you log in again.

Share a key part

This procedure describes how to give your group's key part for one user to another escrow user.

1. On the Quick start screen, click Share a key part.
2. Under Step 1, select the user whose key part you want to share. Use Search users... to filter the list. Under each user, the groups whose key part you hold are shown in green with a check mark. Users for whom you hold no key part cannot be selected.
3. Under Step 2, tick the key parts to share.
4. Under Select an Escrow user to share with, select the escrow user. Only escrow users who are missing one of the ticked key parts are listed.
5. Click Share Key Parts.

Result: A background task, "Sharing N key(s) with <name>", encrypts the key parts for the escrow user you selected.

Recover a user's key

This procedure describes how to rebuild a user's private key once you hold a key part from every escrow group.

1. On the Quick start screen, click Recover a key.
2. Under Step 1, select the user. Only users for whom you hold every group's key part are listed; otherwise the list reads "There are no recoverable user keys."
3. Under Step 2, read the notice "A new key file will be made for the user. In the future, they must log in with this key file instead of their old one."
4. Under Password Configuration, select one:
   • Generate and copy password: tiCrypt generates a random 22-character password.
   • Type your own password: enter it in Password and Confirm Password. It must meet the deployment's password strength requirement.
5. Click Recover User Key.
6. If you chose Generate and copy password, the dialog "Recover <name>'s key" opens:
   1. Check Key file name. The default is the part of the user's email before the @, followed by the date, as in jdoe_2026-10-21.key.json. The name is required and is limited to 50 characters.
   2. Click Copy new password to clipboard. The password is not shown or stored anywhere else.
   3. Click Export key. It becomes available only after you copy the password.

Result: The new key file downloads with .txt added to its name, for example jdoe_2026-10-21.key.json.txt. It holds the user's existing private key, encrypted with the new password.

Send the key file and the password to the user over separate secure channels. The user logs in with them and then changes the password. See Change Password.

Share all key parts with another escrow user

This procedure describes how to give every key part your group holds to another member of your group in one step. Bulk sharing works only within your own group; to share with an escrow user outside it, share one key part at a time.

1. On the Quick start screen, click Share all key parts with another Escrow user.
2. Under Step 1, select the escrow user. Each entry shows "Can share N key(s) from <group>" or "Cannot share any keys".
3. Under Step 2, review the notice and the Summary.
4. Click Share N Key(s).

Result: A background task shares every key part your group holds that the selected escrow user does not have yet.

The full Escrow interface

Click Exit Quick start Interface on the Quick start screen to open the full table. Click Return to quick start interface in the toolbar to go back.

The following table describes the columns of the full Escrow interface table.

Column	What it shows
Status	"Ready to restore" when you hold a key part from every group for the user. "Not started" or "User is not escrowed" when you do not yet hold every group's key part.
Name	The user whose key is escrowed.
Login ID	The user's Login ID.
One column per escrow group	A check mark when you hold that group's key part for the user.

Open a row's ⋮ menu, or right-click the row, for these actions:

• Recover user key: rebuilds the user's key, as in Recover a user's key. It appears only when the status is "Ready to restore".
• Share keys with other Escrow users: opens "Share escrow key parts of <user>", where you tick the key parts you hold, select an escrow user, and click Share.
• Show Escrow keys: opens "Escrow keys for user: <name>", a table of which escrow users hold which group's key part for that user.

The toolbar button with the tooltip Share all key parts with user in my group opens "Share <group> keys with another <group> user", which shares every key part of your group with another member of your group, as in Share all key parts with another escrow user. It shows "You are not in any group" if your escrow account has no group, and "No other escrow users in the group" if you are its only member.

Your escrow account

The user menu, opened from your icon in the toolbar, holds:

• My Profile: your name, email, and the escrow group you belong to.
• Change password: re-encrypts your escrow key with a new password. See Escrow Users.
• Log out: wipes your escrow key from memory and returns to the login window.

What happens next

Recovery sends nothing to the user. tiCrypt decrypts the key parts with your escrow key, combines them into the Recovery Key, decrypts the user's escrowed private key, and writes it to the new key file under the new password. On deployments that store part of the encryption credentials on the server, recovery also replaces them, so the user's old key file stops working.

Errors and resolutions

Message	Meaning and resolution
"File is not an escrow key"	You loaded a user key or a site key on the Escrow tab. Load your escrow key file.
"Incorrect password or key file, please try again"	The password does not open this escrow key file. Check the password and that you loaded your own escrow key.
"Failed to load own user info", "Failed to load Escrow groups"	Your escrow account may not be active yet. Ask the site-key administrator and a Super-Admin to complete your activation.
"There are no recoverable user keys."	You do not hold a key part from every group for any user. Ask one escrow user from each missing group to share their key part with you.

Related

• Escrow Users: register and activate escrow users, and how recovery is organized across groups.
• Escrow Groups: why the recovery key is split across independent groups.
• Site Key: the key that signs every escrow user and group.
• Get Started: register an escrow user account.