Vault key escrow (a key kept offline)

With key escrow, every vault key generation is also sealed to a key your organization keeps offline. The vault can then be recovered without the service's KMS key, for example when leaving the service or after a disaster.

Before you start

Generate the key pair on an offline computer with the authguard-pam-gateway escrow-keygen tool. It prints the public key (1,624 base64 characters) and the fingerprint (64 hexadecimal characters). Keep the private key offline, in at least two safe places, following the recovery procedure your provider gives you.

How do I register the key?

1. Open «PAM» › «Key escrow».
2. Paste the «Public key (base64)» and the «Fingerprint (64 hexadecimal characters)».
3. Choose «Ask a second administrator to register». Registration is always four-eyes.
4. Another administrator approves under «Dual control». The console then shows the key was registered by one administrator and confirmed by another.

What happens next?

• Every existing vault key generation is sealed to the escrow key; new ones are sealed as they are created.
• The console shows how many generations are sealed to the escrow key.
• If «Some vault key generations are not sealed to the escrow key yet.» appears, choose «Seal the remaining generations».

Changing the key

Registering a new key retires the previous one. Do it four-eyes too.

Recovery

Recovering from the offline key is a procedure of the service's operator, using the escrow-recover tool. Agree it with your provider before you need it.