Key Escrow

One of the important things when it comes to cryptography and keeping things secure is making sure that we're managing our keys correctly. It would be devastating if one of our pre-shared keys or one of our private keys got into the wrong hands. It could cause a lot of problems with confidentiality or integrity. It also could be a problem if we lose these keys. So we need to make sure we manage the keys. We also might need to manage who has access to these keys. Well, that's what a key escrow is for.

Escrow from a Legal Perspective

Let's talk about escrow from a legal perspective. Think of it as some sort of third-party entity that's going to be trusted with an asset.

I'm going to use home buying as an example, because in the home buying process an escrow account is usually used. So we're going to say that this is the escrow account right here. We have a homeowner who wants to sell their home and we've got a buyer who wants to buy that home, and so they're going to drop a contract, and that contract is going to list out the price of the home and all the details of the home. Part of that contract, since it takes weeks and maybe even months to purchase a home, part of that contract requires that the buyer is going to put down a certain amount of money that they would lose if they just walked away from the deal. This gives them a certain amount of guarantee that they're going to stick with the deal and follow through with the deal. But you wouldn't want to just give that money over to the seller right away, so instead it goes to an escrow account, and the details of the contract list out at what conditions that money can get paid to the seller, or how that money would come back to the buyer if the deal doesn't go through.

Now think about it the same way from a company perspective. You've got two companies that are doing business together and they each have different assets that they bring to the table, and what they want to do is they don't want to just hand these assets over to each other, but there needs to be a certain amount of guarantee that they even have those assets. So what they would use is some sort of escrow, for verification that they have the asset and it's ready to be turned over on the condition that certain things are met, certain conditions are met.

An Escrow Account I Worked With

Let me give you an example of an escrow account that I used to work with. What I worked for was a company, a software as a service company, and we developed code, and that code was the value that we brought, that we delivered. We worked with another company that sold our product, and so it was mutually beneficial. We both were making money off of this.

Now the problem is that they relied on our code for them to make their money, and if something happened to us, then what would happen is they could be in danger of going out of business. And so we didn't want to give them the code, because then they could just steal the code and they wouldn't need us anymore. So what we did is, within the contract we signed about this partnership, is we would turn over the code to an escrow account. So I would actually package up this code in removable media and send it off to this third-party escrow account and it would be stored there. Now in the condition where my company that I worked for, if it were to go under, then that code would then be released to this other company so that they weren't in danger of losing their business.

Key Escrow in Cryptography

When it comes to cryptography, these keys are an asset and they guard assets. So what happens is that it could put some sort of partnership in danger. So we may use some sort of key escrow, where we turn the key over to some sort of third-party entity, and in the condition that certain conditions are met, those keys could be turned over to that other entity.

Key Escrow as a Technical Solution

Now let's jump out of the legal term and talk about technology solutions that also may use this term key escrow. A good example of this is BitLocker. What happens is we have a Windows machine that has BitLocker on it and it stores the key on the machine itself. Well, that's great as long as that machine is working. But if that machine goes offline and it has the key on it and we still need to have access to that data, that causes a problem. And so what we may do is we may take this key and store it in a database. So we put it into a database, and what we can call that database is a key escrow. So that could be an example of a technical solution that we call a key escrow as well.