key escrow vs secure storage(software/TPM/HSM)

Question

From the definition of key escrow (a method to store important cryptographic keys providing data-at-rest protection), it sounds very similar to that of secure storage which could be basically software-based or hardware-based (TPM/HSM). But, I could not figure out any differences or similarities between these two on the internet.

Are key-escrow and secure storage the one and the same or not? Or is it just a marketing terminology?

Where did you get the definition of key escrow from? – nobody Dec 21 '20 at 09:05 — nobody, Dec 21 '20 at 09:05
https://jumpcloud.com/blog/key-escrow – Baranikumar Venkatesan Dec 21 '20 at 09:55 — Baranikumar Venkatesan, Dec 21 '20 at 09:55

score 1 · Accepted Answer · answered Dec 21 '20 at 10:28

An escrow isn't a method, its more of an agreement. merriam webster defines the term escrow as

a deed, a bond, money, or a piece of property held in trust by a third party to be turned over to the grantee only upon fulfillment of a condition

So in the case of key escrows, you simply entrust your cryptographic keys to the key escrow provider to turn over to someone when a specific condition is fulfilled. In the case of a commercial key escrow, the condition is just that they confirm that the entity asking for the keys is authorized to access them. In case of a law enforcement key escrow, the condition would be that the LEOs have a valid warrant. Note that a key escrow by itself does not provide any protection. Protecting the keys is up to the key escrow provider.

An HSM on the other hand is a physical device that is designed to protect data (usually cryptographic keys). So, although a key escrow provider might be using an HSM to store escrowed keys, the two are fundamentally different things.

key escrow vs secure storage(software/TPM/HSM)

1 Answers1