From the definition of key escrow (a method to store important cryptographic keys providing data-at-rest protection), it sounds very similar to that of secure storage which could be basically software-based or hardware-based (TPM/HSM). But, I could not figure out any differences or similarities between these two on the internet.

Are key-escrow and secure storage the one and the same or not? Or is it just a marketing terminology?


1 Answer 1


An escrow isn't a method, its more of an agreement. merriam webster defines the term escrow as

a deed, a bond, money, or a piece of property held in trust by a third party to be turned over to the grantee only upon fulfillment of a condition

So in the case of key escrows, you simply entrust your cryptographic keys to the key escrow provider to turn over to someone when a specific condition is fulfilled. In the case of a commercial key escrow, the condition is just that they confirm that the entity asking for the keys is authorized to access them. In case of a law enforcement key escrow, the condition would be that the LEOs have a valid warrant. Note that a key escrow by itself does not provide any protection. Protecting the keys is up to the key escrow provider.

An HSM on the other hand is a physical device that is designed to protect data (usually cryptographic keys). So, although a key escrow provider might be using an HSM to store escrowed keys, the two are fundamentally different things.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .