tiCrypt

Escrow Users

Prerequisites

User Role:

Super-Admin

Permission Requirements

• Key Escrow
  • Put their own private key in escrow
  • Check whether their own key is in escrow
• Key Escrow Administration
  • View all keys in escrow
  • View escrow recovery keys
  • Delete keys from escrow, with their recovery parts
  • View escrow groups
  • View escrow users
  • View escrow public keys
  • View the history of escrow actions approved with a Sitekey

View Escrow Users

1. Go to the Management icon in the top left taskbar.
2. Navigate to the Escrow section.
3. Click the Escrow Users in the left panel.
4. View a list of all escrow users in the system.

The table lists each escrow user's User, Email, Groups, Status, Created, Department, and Position. It requires the View escrow users permission. The Groups column is filled only if you also have View escrow groups and View escrow public keys.

Create a New Escrow User Account

The escrow user registers their own account through the Connect Application, on the Escrow tab, selecting the escrow group they were assigned. See Register an escrow user account for the full procedure.

Tell them which escrow group they belong to before they start. It is the first thing the wizard asks, and they cannot proceed without it.

Once they have registered, activate the account as described below.

Delegate Escrow Permissions

Escrow permissions are granted through a user's permission profile, and are separate from the escrow accounts themselves. This is how an administrator gets visibility into escrow without becoming an escrow user.

1. Log in with an Admin or Super-Admin role.
2. Go to Management in the top toolbar.
3. Select the Users section.
4. Select Users.
5. Find and select the admin user you are delegating to.
6. Click the Open full menu button in the top right panel.
7. Select Open Overlay.
8. In the overlay, select the Profile & Permissions card in the left panel.
9. Go to the Key Escrow and Key Escrow Administration sections.
10. Set the permissions. The recommended set is:

• Put their own private key in escrow
• Check whether their own key is in escrow
• View all keys in escrow
• View escrow recovery keys
• Delete keys from escrow, with their recovery parts: leave unchecked
• View escrow groups
• View escrow users
• View escrow public keys
• View the history of escrow actions approved with a Sitekey

11. Click Save in the top right panel.

warning

The Delete keys from escrow, with their recovery parts permission is the one to withhold. Deleting an escrowed key removes the only recovery path for that user's data. Reserve it for Super-Admins.

caution

Only Admins and Super-Admins should manage escrow permissions at all.

Activate a New Escrow User

Registration creates nothing on the server. It leaves two files on the escrow user's computer:

• Key file: <First> <Last> (Escrow).key.json, which holds the escrow user's private key. It stays with the escrow user and is never sent to anyone.
• Request file: create-escrow-user(<First> <Last>).csr.json, which holds three unsigned requests: add the escrow user, register their public key, and add that key to the escrow group they selected.

The account exists once the site-key admin signs the requests and a Super-Admin applies them.

To Escrow User

1. Send the request file create-escrow-user(<First> <Last>).csr.json to the Site-key Admin. Do not send your key file.

To Site-key Admin

2. Open Connect Application.
3. Select your deployment card.
4. In the login window, select the Sitekey tab.
5. Click Load Key and open your site-key file, sitekey.prv.json, or drag it onto the login box. The Sitekey tab asks for no password; you enter it when you sign.
6. On Site key Management, click Upload and sign escrow user request and select the request file. You can also drag request files anywhere on the page.
7. Under Uploaded certificates, check the three cards: Add Key Escrow User, New Escrow Public Key, and Add Key to Escrow Group. To sign more requests in the same batch, click Upload another certificate.
8. Enter your site-key password in Global site key password. The field clears itself after 5 seconds without typing.
9. Click Sign all and download. Every card is signed and saved in one file, signed-certificates.json, and a message reads "Exported N certificates to signed-certificates.json".
10. Send signed-certificates.json to a Super-Admin.

To Super-Admin

11. Go to the Management icon in the top left taskbar.
12. Navigate to the Escrow section.
13. Click the Escrow Certificates in the left panel.
14. Click the Execute signed certificates button in the top right panel.
15. In the Apply signed actions dialog, click Browse Files and select signed-certificates.json, or drag it into the box. The box is shown only while the dialog is empty, so select every file you want to apply at once.
16. Click Apply.

To Escrow User

17. Log in on the Escrow tab with your own key file and password. See Escrow Interface.

Result: The escrow user appears in Escrow Users, and the three applied certificates appear in Escrow Certificates. A message reads "Applied 3 certificates".

Nothing is sent back to the escrow user: the signed file is applied in Management, and the escrow user keeps logging in with the key file they created at registration.

note

Apply applies the certificates in order and stops at the first one the server rejects. The rejected certificate shows the error, and the ones after it are not applied.

Delete an Existing Escrow User

To Super-Admin

1. Go to the Management icon in the top left taskbar.
2. Navigate to the Escrow section.
3. Click the Escrow Users in the left panel.
4. Select the escrow users you want to delete.
5. Click the Create deletion request button in the top right panel. The request downloads as delete-<name>.csr.json, with the spaces in the escrow user's name replaced by hyphens, or as delete-<N>-Escrow-users.csr.json for several users, and a message reads "Downloaded CSR: send to SiteKey admin for approval".
6. Send the deletion request to the Site-key Admin.

To Site-key Admin

7. Open Connect Application.
8. Select your deployment card.
9. In the login window, select the Sitekey tab.
10. Click Load Key and open your site-key file, sitekey.prv.json.
11. On Site key Management, click Upload and sign escrow user request and select the deletion request.
12. Under Uploaded certificates, check the Delete Escrow User card for each user: ID, Name, Email, Department, and Position.
13. Enter your site-key password in Global site key password.
14. Click Sign all and download to save the signed requests as signed-certificates.json.
15. Send signed-certificates.json back to the Super-Admin.

To Super-Admin

16. Go to the Management icon in the top left taskbar.
17. Navigate to the Escrow section.
18. Click the Escrow Certificates in the left panel.
19. Click the Execute signed certificates button in the top right panel.
20. In the Apply signed actions dialog, click Browse Files and select signed-certificates.json.
21. Click Apply.

Result: The escrow user is removed from Escrow Users.

note

The deletion request holds the User ID of each escrow user, with their Name, Email, Department, and Position for the Site-key Admin to check. The signed certificate serves as an order to remove an escrow user. The Site-key Admin must coordinate with the Super-Admin to add or remove escrow users. Only signed orders from the Site-key Admin can create or delete escrow users.

Recover a User's Private Key

Key recovery, also called de-escrowing, is the reason escrow users exist. It reverses enrollment: each escrow group contributes the key part it holds, the key parts are combined to reconstruct the Recovery Key, and the Recovery Key decrypts the user's stored private key.

Before you begin

• The user's key was enrolled in escrow. A key that was never escrowed cannot be recovered by any means, and no procedure here changes that.
• Every escrow group can produce a participating member. Any one member of a group can act for it, because all members of a group hold the same key part. A group that can field nobody stops recovery outright.
• An escrow user is available to receive the key parts and perform the reconstruction. It can be any escrow user, including one who is not a member of any contributing group.
• Your institution has a way to hand the recovered key and a new password to the user securely, outside tiCrypt.

Who does what

Participant	Contribution
One escrow user per group	Supplies their group's key part. It does not matter which member, only that every group is represented.
A receiving escrow user	Collects the key parts from every group and reconstructs the Recovery Key. Any escrow user can do this once they hold every key part; they do not need to belong to a contributing group.
Administrator	Nothing cryptographic. Administrators can require escrow on an account, but they do not take part in recovery and cannot decrypt the result.

How recovery proceeds

1. One escrow user from each group logs in through the Escrow tab of the Connect Application and shares their group's key part with the escrow user who will perform the recovery.
2. Once that escrow user holds a key part from every group, the key parts combine to reconstruct the Recovery Key.
3. The Recovery Key decrypts the user's stored private key.
4. The escrow user who recovered the key writes it to a new key file under a new password, either generated by tiCrypt or typed in, and the key file and password are passed to the user through a channel outside tiCrypt. Each institution decides what channel is acceptable for this.
5. The user signs in with the recovered key file and that password, then sets a new password. Changing the password writes a new key file for the same private key, encrypted with the new password.

Result: The user has access again with a new key file and a password only they know. On deployments that store part of the encryption credentials on the server, the recovered key file stops working once the user changes the password, which limits what the handover in step 4 was worth if it was intercepted. Elsewhere it still opens with the temporary password, so the user deletes every copy of it.

Recovery needs one member from every group

Recovery needs breadth, not depth. Three members of one group cannot substitute for one member each from three groups, because those three people all hold the same key part. If a group has lost every member, the keys enrolled against that group cannot be recovered.

info

For the steps in the Escrow interface, see Share a key part and Recover a user's key.

Bulk Email Escrow Users

bulk-action

1. Go to the Management icon in the top left taskbar.
2. Navigate to the Escrow section.
3. Click the Escrow Users in the left panel.
4. Select the escrow user(s) you want to send a bulk email to.
5. Click the Bulk Email button in the top right panel.
6. In the pop-up, click Copy to copy the emails or click Download to download the emails.
7. Once done, click Close.

Change the Password of an Escrow User

To Escrow User

1. Log in to the Escrow interface. See Escrow Interface.
2. Click your icon in the toolbar to open the user menu.
3. Select Change password.
4. In the dialog, enter Current Password, New Password, and Confirm New Password.
5. Click Apply.

Result: The dialog title changes to "Password changed!", a message reads "Password changed successfully", and the new key file downloads as escrow-key-<yyyy-mm-dd>.key.json.

note

Use the new key file and the new password to log in next time. Delete every copy of the old key file, and back up the new one in secure locations.