Site Key
The site key is a private key held by one person, the Site-Key Administrator, and used only to sign digital orders that authorize escrow actions. It is what makes escrow group and escrow user changes trustworthy: a Super-Admin can execute an order, but only the site key can authorize one.
To register a site-key admin account, see Get Started.
The site key, key escrow, and tiCrypt are three separate systems
All three are reached through the Connect Application using the same login steps, which is why they are mistaken for one system with three views. Each has its own accounts, keys, and authority.
As Site-Key Admin you are not a tiCrypt administrator, and a tiCrypt Super-Admin is not a site-key authority. See Understanding Key Escrow.
What the Site Key Authorizes
| Activity | What the Site-Key Admin does |
|---|---|
| Key pair generation | Generates the public-private site-key pair through the site-key front end |
| Private key stewardship | Keeps the private site key secure. It underpins escrow keys and, through them, user keys |
| Escrow group creation | Creates escrow groups. Groups cannot be edited or deleted once created, so decide the layout up front. See Escrow Groups |
| Escrow user management | Signs requests to add and remove escrow users. A Super-Admin then uploads the signed request into Management. Neither step alone changes anything |
The site key is:
- Counter-signed by Tera Insights before it does anything. The generated public key file (
pub.json) stays inactive until then. - Fully dissociated from the tiCrypt backend. Site-key administration needs no backend access, and the system has no record of where the site key resides.
- Never shared, never transmitted, never copied off the machine it lives on.
- Used only to sign digital orders authorizing escrow user assignments and group administration.
What moves between people is the signed order, never the key. After signing an order, send the order to the tiCrypt Super-Admin by email or on removable media. The private site key stays where it is.
The site key is the root of the escrow chain of trust. If it is disclosed, every certificate it has ever signed becomes untrustworthy, and the key has to be reissued and counter-signed again. Keep it on an air-gapped machine and transfer only the signed orders it produces.
There is a single site-key admin in every deployment. If that person leaves the organization, a new set of site keys is produced.
Activate a New Site Key
Site keys are generated when the Site-Key Admin account is registered. Only Tera Insights can activate one. Send the public key file for counter-signing; the key does nothing until it comes back signed.
Reassign the Site Key
Avoid reassigning the site key unless it is necessary. When it is, resend the public key to Tera Insights for re-signature.
Whenever you sign:
- Perform the signing offline, in a secure environment.
- Control and monitor who can become an escrow user.
- Work with the escrow groups to recover user private keys.