Last updated: September 14, 2026tiCrypt

Escrow Groups

Understanding Key Escrow

In tiCrypt, each user's data is encrypted with their private key. If a user loses their private key and password, their data is permanently unrecoverable. Key escrow provides a recovery mechanism by encrypting a backup of the user's private key with a separate recovery key, then splitting that recovery key across multiple independent groups, so no single person or group can unilaterally recover it.

Escrow, the site key, and tiCrypt are three separate systems

All three are reached through the Connect Application using the same login steps, so they look like one product with three views. They are not. Each has its own accounts, its own keys, and its own authority.

An escrow user is not a tiCrypt user with extra permissions. A Site Key Admin administers neither of the other two. An account in one system grants nothing in the other two.

Escrow users are kept separate from system administrators by design: the people who run the platform do not take part in recovery.

How escrow works:

1. The Site Key Admin (an offline authority) creates and signs escrow group certificates.
2. A Super Admin imports the signed certificates and creates the escrow groups in tiCrypt.
3. Escrow users are organized into a minimum of three groups per deployment. Each group receives one key part of the recovery key, and every member of a group holds that same key part, so any one member can supply it.
4. When an administrator marks a user for escrow, the user's next login generates one key part per escrow group, combines them into the recovery key, encrypts the user's private key with it, and then discards the recovery key.
5. Recovery requires one representative from each escrow group to contribute their key part. A missing key part from any single group makes recovery cryptographically impossible.

Setup order:

1. Register a Site Key Admin account (see Site Key)
2. Create escrow groups (this page)
3. Register escrow users (see Escrow Users)
4. Sign certificates (see Escrow Certificates)

caution

Complete escrow setup early in deployment. Without escrow, any user who loses their private key permanently loses access to all their encrypted data.

Design Principles

Principle	What it means
Cryptographic security	Encryption and digital signatures take priority over access control lists
Separation of duties	Recovery requires multiple authorized people, so a single compromised credential grants nothing
Limited administrator role	System and tiCrypt administrators have minimal involvement in recovery

Who Does What

Role	In key escrow
Escrow users	Hold their group's key part and contribute it during recovery
Site-Key Administrator	Assigns escrow users to groups and signs the orders that create them
tiCrypt administrators	Mark accounts for escrow. They do not take part in recovery

What Happens at Enrollment

Enrollment runs in the user's own session, not on the server. When an administrator marks an account as requiring escrow, the user's next login opens a restricted session that does the following:

1. Initiation. An administrator sets the user's state to Active and escrow on next login.
2. Group lookup. The session pulls escrow group membership and member public keys from the server.
3. Key part generation. A separate AES-256 key part is generated for each escrow group.
4. Recovery Key creation. The key parts are combined into a single AES-256 Recovery Key.
5. Encryption. The user's private key is encrypted with the Recovery Key, and the Recovery Key is then discarded. It is never stored anywhere.
6. Key part distribution. Each group's key part is encrypted with the public key of every member of that group, so any one member can supply it.
7. Storage. The encrypted private key and the encrypted key parts go to the server.

The server therefore holds the encrypted private key and the encrypted key parts, and never holds the Recovery Key that would open them.

What Recovery Requires

Recovery reverses enrollment. One member from each escrow group contributes their group's key part; combining every group's key part reconstructs the Recovery Key, which decrypts the user's private key.

Because every member of a group holds that same key part, a group can participate as long as any one of its members is available. What recovery cannot survive is an entire group being unable to produce anyone.

caution

If any escrow group cannot produce a participating member, the lost user's private key cannot be recovered. This is why group membership is worth auditing before you need it, not after.

Access Escrow Groups

• There is no front-end access to escrow groups because they are decentralized in tiCrypt.
• Escrow groups operate through offline meetings among members who know each other in person.

Create a New Escrow Group

To Site-key Admin

1. Open Connect Application.
2. Select your deployment card.
3. In the login window, select the Site-key category.
4. Click Load key on the login page.
5. In the pop-up, select your site-key file from your local machine, and click Open.
6. Enter your account password.
7. Click Login.
8. In the site-key dashboard, click the Add escrow group button in the top left.
9. In the pop-up, enter the escrow group name.
10. Click Create Request.
11. Under the New Escrow Group card, tick Sign to sign the group certificate.
12. Enter your password in the field in the top right panel.
13. Click Sign all.
14. Select the signed escrow group card in the top right panel.
15. In the pop-up, click Export to download it locally.
16. Send the signed escrow group file to a Super-Admin.

To Super-Admin

1. Go to the Management icon in the top left taskbar.
2. Navigate to the Escrow section.
3. Click Escrow Certificates in the left panel.
4. Click the Execute signed certificates button in the top right panel.
5. In the pop-up, click Browse Files.
6. Select the escrow certificate file from your local machine and click Open.
7. To execute, click Apply.

Add Escrow Users to an Existing Escrow Group

• When an escrow user account is registered, the escrow user selects the group assigned to them by the Site Key Admin.
• A deployment needs at least three escrow groups before any key can be enrolled in escrow. Recovery draws one member from each group, so the groups must be independent of one another.

Share Key Parts With a New Group Member

A new group member does not automatically hold the group's key parts. An existing member re-shares them.

An escrow user can share key parts with an entire group at once, or with an individual escrow user.

caution

Until this is done, the new member cannot act for the group. Do it when membership changes, not when a recovery is already needed.

Change or Remove an Escrow Group

Escrow groups cannot be edited or deleted. No Management action, signed order, or support procedure renames a group or removes it. Changing the group structure means creating an entirely new set of groups.

Decide the layout before creating the first group: how many groups, what boundary each represents, and who staffs it. Three is the minimum, and the groups must be independent of one another.

Membership does change. See Add or Remove an Escrow User.

Add or Remove an Escrow User

Escrow users can be added and removed. The change takes two people:

1. The Site Key signs the request.
2. A Super Admin uploads the signed request into Management.

These are separate steps. Neither party can complete the change alone.

caution

A new member holds no key parts until an existing member re-shares them, and cannot act for the group until then. See Share Key Parts With a New Group Member.

Re-share before removing anyone. If every member of a group leaves first, no one can pass the group's key parts to a replacement, and groups cannot be recreated.