What is key escrow?
Encrypted data is only as available as its key. If an employee leaves, a smart card is lost or a laptop is reimaged, data encrypted with the only copy of a key becomes permanently unreadable. Key escrow prevents that by keeping a protected copy of the key with a trusted party, the escrow agent, which may be an internal security system or an outside organization. Key recovery is the controlled process of getting the key back out when an approved reason exists, such as reading a departed employee's encrypted files, meeting a legal hold or supporting an investigation.
Where key escrow shows up
- Certificate authorities: Microsoft Active Directory Certificate Services calls it key archival. When it is enabled on an encryption certificate template, the client sends an encrypted copy of its private key to the CA, which stores it encrypted to the certificates of designated key recovery agents (KRAs).
- Full-disk encryption: BitLocker recovery keys are commonly backed up to Active Directory or Microsoft Entra ID, and macOS FileVault recovery keys can be escrowed with an MDM service.
- Government proposals: the U.S. Clipper chip, announced in 1993, would have placed a copy of each device's key with government agencies. It was abandoned after technical flaws and strong public opposition, and the debate over government access to keys continues.
Protecting the escrow
An escrow store can unlock everything it holds, which makes it one of the most valuable targets in an organization. Common controls:
- Separation of duties: the person who extracts an archived key is not the person who can decrypt it. In AD CS, a CA officer runs
certutil -getkeyto retrieve the encrypted blob, and only a key recovery agent can runcertutil -recoverkeyto turn it into a usable PFX file. - M-of-N control: recovery needs several custodians out of a larger group, for example any 3 of 5, often enforced by an HSM or by splitting the key into shares.
- Documented approval: a ticket signed off by HR, legal or management before any recovery.
- Logging and review: every recovery is recorded and audited.
Escrow encryption keys, not signing keys
Escrow suits keys that protect data, because losing them means losing the data. It does not suit signing keys. A digital signature provides non-repudiation only if the signer is the sole holder of the private key; if the organization keeps a copy, anyone with escrow access could sign in that person's name, and the person could plausibly deny any signature. Lost signing keys need no recovery anyway: the user gets a new key pair, and old signatures still verify with the old public key. Many PKIs therefore issue each person two key pairs, one for signing and one for encryption, and escrow only the encryption key.
Key escrow vs. key backup vs. key recovery
A key backup is any copy kept for disaster recovery, often held by the key's owner. Key escrow specifically places the copy with a trusted third party or controlled system, under rules about who may release it and why. Key recovery is the act of retrieving an escrowed or backed-up key. When a question says a third party holds copies of keys for later access, the term it wants is escrow.
Key escrow on the CompTIA Security+ exam
Key escrow is listed in SY0-801 objective 1.3, next to public and private keys, as part of choosing a cryptographic solution. Wording such as "recover data encrypted by an employee who left", "a third party holds a copy of the keys" or "a legal requirement to decrypt archived email" points to key escrow. "No single administrator can recover a key" points to M-of-N or dual control. If the scenario also needs signatures to stay provable, the answer is separate key pairs with only the encryption key escrowed. Distractors include certificate revocation, which ends trust rather than restoring access, and an HSM on its own, which protects keys but is not by itself a recovery process.