From what I understand Key Escrow is where a copy of they key is stored in a safe place so they can be recovered later.

But in the context of PKI, a Recovery Agent can also recover private keys.

How are they different? Does a Recovery Agent use a Key Escrow?


A "Key Escrow" is used in cases where a third-party needs access to encrypted data, as defined by law (so if you get a court order to decrypt data), while a "Recovery Agent" is someone who is permitted to decrypt another user's data in case of emergency and has a key that can accomplish the decryption.

So in effect, the key escrow is someone who holds the keys for each user, while a recovery agent has a master key.

Edit: "Recovery Agent" is actually defined by Windows too, so you can access EFS-protected files of other users. See: http://searchitchannel.techtarget.com/definition/data-recovery-agent-DRA for details.

  • 1
    Strictly speaking, the "Key Escrow" isn't just something that's implemented for legal reasons. It could just be the way the company chose to implement their recovery process. Other than that, the distinction between Escrow vs. Agent is pretty accurate here. – Iszi May 17 '13 at 14:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy