Site Key
The site key is a private key held by one person, the Site-Key Administrator, and used only to sign digital orders that authorize escrow actions. It is what makes escrow group and escrow user changes trustworthy: a Super-Admin can execute an order, but only the site key can authorize one.
To register a site-key admin account, see Get Started.
The site key, key escrow, and tiCrypt are three separate systems
All three are reached through the Connect Application using the same login steps, which is why they are mistaken for one system with three views. Each has its own accounts, keys, and authority.
As Site-Key Admin you are not a tiCrypt administrator, and a tiCrypt Super-Admin is not a site-key authority. See Understanding Key Escrow.
What the Site Key Authorizes
| Activity | What the Site-Key Admin does |
|---|---|
| Key pair generation | Generates the public-private site-key pair through the site-key front end |
| Private key stewardship | Keeps the private site key secure. It underpins escrow keys and, through them, user keys |
| Escrow group creation | Creates escrow groups. Groups cannot be edited or deleted once created, so decide the layout up front. See Escrow Groups |
| Escrow user management | Signs requests to add and remove escrow users. A Super-Admin then uploads the signed request into Management. Neither step alone changes anything |
The site key is:
- Counter-signed by Tera Insights before it does anything. The generated public key file (
sitekey.pub.json) stays inactive until then. - Fully dissociated from the tiCrypt backend. Site-key administration needs no backend access, and the system has no record of where the site key resides.
- Never shared, never transmitted, never copied off the machine it lives on.
- Used only to sign digital orders authorizing escrow user assignments and group administration.
What moves between people is the signed order, never the key. After signing an order, send the order to the tiCrypt Super-Admin by email or on removable media. The private site key stays where it is.
The site key is the root of the escrow chain of trust. If it is disclosed, every certificate it has ever signed becomes untrustworthy, and the key has to be reissued and counter-signed again. Keep it on an air-gapped machine and transfer only the signed orders it produces.
There is a single site-key admin in every deployment. If that person leaves the organization, a new set of site keys is produced.
Activate a New Site Key
Site keys are generated when the Site-Key Admin account is registered. Only Tera Insights can activate one. Send the public key file for counter-signing; the key does nothing until it comes back signed.
Registration runs in the Connect Application, on the Sitekey tab, through Create new sitekey. See Register a site-key admin account. The wizard has two steps, Sitekey and Set up a password, and produces two files:
| File | What it holds | What you do with it |
|---|---|---|
sitekey.pub.json | The site key's public key | Send it to Tera Insights for counter-signing. |
sitekey.prv.json | The private site key, encrypted with your password, and the address of this deployment | Keep it, and back it up. There is no way to recover it. |
Continue to sitekey becomes available once you have downloaded both files.
Sign In with the Site Key
- Open Connect Application.
- Select your deployment card.
- In the login window, select the Sitekey tab.
- Click Load Key and open
sitekey.prv.json, or drag it onto the login box.
The Sitekey tab asks for no password. The private site key stays encrypted until you sign: you enter the password in Global site key password each time you click Sign all and download, and the field clears itself after 5 seconds without typing. To return to the login window, click the Exit button that shows a logout arrow in the toolbar.
A site-key file works only on the deployment it was created for. Loading it on another deployment shows "Uploaded key is for a different URL". A file that is not a site key shows "Not a valid sitekey".
For the signing procedures, see Activate a New Escrow User, Delete an Existing Escrow User, and Create a New Escrow Group.
When a user's key is escrowed, or an escrow user shares a key part, tiCrypt checks that each escrow key was signed by a site key that Tera Insights counter-signed. A deployment file can restrict the accepted site keys with escrowSiteKeyIDs. A failed check is written to the browser console only, and does not stop escrow.
Reassign the Site Key
Avoid reassigning the site key unless it is necessary. When it is, resend the public key to Tera Insights for re-signature.
Whenever you sign:
- Perform the signing offline, in a secure environment.
- Control and monitor who can become an escrow user.
- Work with the escrow groups to recover user private keys.