Get Started
Access to tiCrypt begins the same way for every account type: install the Connect Application, register an account, then sign in with the key file that registration generates. The account type you register determines what you can do once you are in. It does not change how you sign in.
Account types
Identify yours before you start.
| Account type | Positions that use it | What it does |
|---|---|---|
| User | Principal investigator, research staff, postdoc, graduate researcher, lab assistant, lab manager, data custodian, HPC analyst, system administrator, compliance officer | Works with files and virtual machines inside the secure enclave |
| Admin | Lab manager, HPC or system administrator, compliance officer, departmental IT | Not a separate registration. Register as a user; an existing admin then assigns the Admin role and a permission profile |
| Site-key admin | One designated security administrator per deployment | Signs escrow certificates. Operates outside tiCrypt with its own login |
| Escrow user | Members of escrow groups responsible for key recovery | Holds one escrow group's key part of the recovery key |
Almost every position registers the same way, as a User account. Sub-Admin and Admin are roles an existing administrator assigns afterwards, not different registrations, which is why a job title can appear on more than one row above. Only Site-key admin and Escrow user are separate registrations.
For the full mapping of a position to its role, permissions and typical VM role, see Institutional Role Mapping.
If your administrator told you to create a tiCrypt account, you want a User account. Follow this page straight through.
1. Install the Connect Application
You can only get the installer from your host institution or from Tera Insights.
Minimum requirements
- Processor: 8 cores
- Memory: 32 GB RAM
- Operating system: macOS, Windows, or any modern Linux distribution (Red Hat Enterprise Linux 8 or later, Fedora 40 or later, Ubuntu 24 or later, or equivalent)
- App storage: 44.1 MB
- Machine storage and graphics: based on intended use
- Network: an internet connection
- Browsers: Google Chrome or Mozilla Firefox
The Connect Application does not run on mobile devices or tablets.
macOS
- Open the Connect Application.dmg installer.
- Click Continue.
- Review the storage requirement and click Install.
- Enter your password when prompted, then click OK to allow access.
- Click Close.
Windows
Windows has two installers for the same application. Use the .msix package. If your computer's policy blocks MSIX packages, for example because app sideloading or the Microsoft Store is turned off, use the .exe installer instead. Install only one of them on a computer: they do not replace each other, and with both installed the Start menu lists the Connect Application twice. Both keep your deployments, application versions and settings.
MSIX package
- Open the Connect Application .msix package.
- In the App Installer window, click Install (Update if an older version is already installed).
.exe installer
- Open tiCryptConnectInstaller-version.exe.
- Click Next.
- If you are an administrator, choose Install for anyone using this computer or Install just for me, then click Next. Without administrator rights the Connect Application installs for you only, and this page does not appear.
- Click Install.
- Click Finish. Leave Start tiCrypt Connect selected to open the application.
To install it with a deployment tool such as Intune or Configuration Manager, run tiCryptConnectInstaller-<version>.exe /S /AllUsers, or /S /CurrentUser to install for the user who runs it. Exit code 2 means nothing was installed because the Connect Application was running.
Linux
Fedora 40+
dnf install <URL_TO_RPM>
Ubuntu 24+
wget <URL_TO_DEB>
dpkg -i <DOWNLOADED_FILE>
2. Register your account
Registration generates a private key, stored in a key file on your device. That key encrypts and decrypts all your data.
- Back up the key file in more than one secure location.
- Never share it with anyone, including administrators.
- Changing your password generates a new key file. Delete every copy of the old one: if your deployment stores encryption credentials on the server, the old file stops working, and otherwise it still opens with the old password.
If you lose both your password and your key file, your data cannot be recovered unless your deployment has key escrow configured.
Start the same way whichever account you are creating:
- Open the Connect Application.
- Select your deployment card.
- In the login window, select the tab for your account type.
- Click the create account link in the footer below the login box.
The tab and link differ by account type, and so does what happens at the end:
| Account type | Tab | Link | Activated by |
|---|---|---|---|
| User | tiCrypt (the first tab, which shows your deployment's name) | Create new user account | An administrator |
| Escrow user | Escrow | Create new escrow account | The site-key administrator signs the request and a Super-Admin applies it |
| Site-key admin | Sitekey | Create new sitekey | Tera Insights, by counter-signing |
Each wizard has a Back to login link in the top left until registration finishes.
Register a user account
- If your deployment requires multi-factor authentication, the wizard opens on Multi-factor. Click Link MFA Account and complete the sign-in in the window that opens. If your deployment requires two or more factors, complete each sign-in it asks for. Fields that your identity provider supplies are filled in for you and cannot be edited.
- Under Fill out your information, enter your Login ID, First Name, and Last Name, and any optional information, then click Next.
- Under Set up your password, enter your password in Password and Confirm Password, then click Next. The bar under the fields shows the password's strength.
- Under Review, check your details. To change something, click the header of that step.
- Click Register. tiCrypt creates the account and saves your key file in the same step. In the Connect Application a save dialog opens: choose a folder and click Save. This is the file you must back up.
- Read the completion screen, which states "Your account has been successfully created, but not activated." If the key file did not save, click Redownload on the Private key card before you leave the page, then click Back to login.
- Ask an administrator to activate your account. You cannot log in until they do.
<login-id>_<yyyy-mm-dd>.key.json, where <login-id> is the part of your Login ID before the @ and the date is the day you registered.The following table describes the fields of the user registration form.
| Field | Required | Rules |
|---|---|---|
| Login ID | Yes | Usually your organization or institution email. Up to 120 characters. Your deployment can restrict Login IDs to a pattern, such as your institution's email domain; an ID that does not match shows "Must be a valid Login ID". |
| First Name, Last Name | Yes | Up to 40 characters each. Letters, spaces, apostrophes, hyphens, periods, and commas, as in Jean-Luc or J. R. |
| Contact Email (optional) | No | A valid email address where you can be reached, if it differs from your Login ID. Up to 120 characters. |
| Department (optional), Position (optional) | No | Up to 40 characters each. Cannot contain any of / \ | " : * ? < > { }. |
| Notes for the Admin (optional) | No | Who you are and any context the administrator needs to activate your account. Up to 250 characters, without <, >, {, or }. Administrators see this note on your account. |
| Password, Confirm Password | Yes | Up to 64 characters unless your deployment sets another limit. There is no requirement for special characters or capital letters, but the password must reach the strength your deployment requires. The two entries must match. |
The password encrypts your private key inside the key file. tiCrypt does not store the password, so an administrator cannot look it up or reset it. If you forget it, see Change Password.
Register an escrow user account
An escrow account is separate from any tiCrypt account, even when both use the same email address. Registration creates nothing on the server. It produces a key file and a request that the site-key administrator signs.
- Under Escrow group, select your group from the Escrow group list, then click Next. Ask your administrator which group you belong to before you begin.
- Under Fill out your information, enter your Email Address, First name, and Last name, and optionally Department (optional) and Position (optional), then click Next.
- Under Set up your password, enter your password in Password and Confirm Password, then click Next.
- Under Review, check the group and your details, then click Finish registration.
- Click Download on both cards: the Private key card saves your key file,
<First> <Last> (Escrow).key.json, and the Certificate card saves the request file,create-escrow-user(<First> <Last>).csr.json. Until both files are downloaded, the last button reads "Download both files to continue"; it then becomes Continue to escrow. - Send the request file to the site-key administrator. Your account is created when the signed request is applied in Management. See Escrow Users.
There is no way to recover an escrow key file. Back it up before you leave the page.
Register a site-key admin account
- Read the Sitekey step, which describes the role, and click Next.
- Under Set up a password, enter your password in Password and Confirm Password, then click Next.
- Click Download on both cards: the Public key card saves
sitekey.pub.json, which you send to Tera Insights for counter-signing, and the Private key card savessitekey.prv.json, which you keep. Continue to sitekey becomes available once both files are downloaded.
There is no way to recover the site-key private key file. See Site Key for how to store it.
If registration fails
| Message | Meaning and resolution |
|---|---|
| "Sorry, that login ID is taken. Restarting registration." | Another account already uses that Login ID. The page reloads; register again with a different Login ID. |
| "Must be a valid ID or email" | The Login ID contains a character that is not accepted. Check it for typing errors, or ask an administrator which format your deployment expects. |
| "It appears that your deployment's registration token is incorrect. Please contact a system administrator to get a valid deployment file." | Your deployment card does not carry a valid registration token. Ask a system administrator for a current deployment file. |
| "It appears the authentication service on the server has crashed and cannot currently accept registration requests. Please contact a system administrator." | The server cannot accept registrations at the moment. Contact a system administrator. |
| "Your private key was not saved, click Redownload before leaving this page" | The account exists, but the key file was not saved. Click Redownload on the completion screen. Without the key file you cannot log in. |
tiCrypt assigns each key a unique color and icon on the login page. It is generated automatically and cannot be changed. It exists so you can tell multiple keys apart.
3. Log in
Once your account is active:
- Open the Connect Application.
- Select your deployment card.
- Click Load Key and open your key file, named
<login-id>_<yyyy-mm-dd>.key.json. You can also drag the file onto the login box. The key you load is selected. - If the Connect Application holds more than one key, click the account selector, which shows your email and a chevron, and select your account.
- Enter your private key password in Password. The field clears itself after 10 seconds without typing.
- Click the Login button.
On deployments that require multi-factor authentication, users also complete an MFA prompt when they log in.
After you log in, your deployment can show a CUI acknowledgement, the terms of service, and a "Since you last logged in" summary before the Vault opens. See Sign-In Notices.
The footer under the login box shows when this account last logged in on this computer, for example "Last logged in 2 days ago". After a failed attempt it shows "Last failed login:" and, after several, how many attempts failed and since when. Ten wrong passwords in a row remove the key from the Connect Application on this computer, and you need your key file to log in again. See Private Keys.
Escrow users log in on the Escrow tab: click Load Key, open the escrow key file, enter the password, and click Login. Site-key admins log in on the Sitekey tab by loading sitekey.prv.json. That tab asks for no password: the site-key password is entered only when signing.
Where to go next
| If you are a | Go to |
|---|---|
| Researcher or analyst | Research for files, virtual machines, and drives |
| Administrator | Governance for users, teams, projects, and key custody |
| Escrow user | Escrow Interface and Escrow Users |
| Site-key admin | Site Key |
| System administrator | Deploy & Operate |
Managing more than one key or deployment, or checking which version you are running, is covered in Connect Application and Private Keys. If something goes wrong during any of the three steps above, see Troubleshooting.