Create a key escrow user¶

The StoredSafe appliance can be configured with several key escrow users. The key escrow
user/s can be used in an emergency situation to recover otherwise lost data. The use
of key escrow is entirely optional and completely up to each customers discretion and policy.

Key escrow might be needed in several situations, such as:

- A user forgets his login passphrase
- A user with sole access to some information leaves the company

The StoredSafe appliance supports up to 100 simultaneous key escrow users.

Create a key escrow user

This process will create a escrow user for StoredSafe, it's a process in several stages:

- Create a new GnuPG key pair
- Export the GnuPG secret key to a USB memory stick
- Import the GnuPG public key to StoredSafe
- Activate the new escrow user

Stage 1: Create a new GnuPG key pair

Full name <Not set>: Escrow User
Email <Not set>: escrow@corp.com

NOTE: Store this passphrase securely since it can potentially read all information in StoredSafe.

Passphrase: <passphrase stored on yubikey #1><passphrase stored on yubikey #2>
Re-enter passphrase: <passphrase stored on yubikey #1><passphrase stored on yubikey #2>

Press once on the Yubikey assigned to the key escrow user.
Yubikey client id <Not set>: cccccccxyzzyrbhtchtrunehdgihdglvlfdtgigevlek

Name: Escrow User
Email: escrow@corp.com
Passphrase: <not shown>
Yubikey client id: cccccccxyzzy

Is the above configuration correct? (<Y>/n): 

Stage 2: Export the GnuPG secret key to a USB memory stick

Insert a USB disk and press enter when ready. Ready? (<Y>/n): 

It is essential to the system security of StoredSafe to ensure to
move (copy and remove) the secret keys manually before using the system.

Ready to copy the secret key to "/mnt/usb"? (<Y>/n): 
Copying the secret key to "/mnt/usb/escrow.corp.com.sec.key" 
Comparing SHA256 checksum on "secring.gpg" and "escrow.corp.com.sec.key" ... SHA256 checksum matches.

Ready to remove the GnuPG secret key from StoredSafe? (<Y>/n): 
Successfully removed the GnuPG secret key from StoredSafe.

Stage 3: Import the GnuPG public key to StoredSafe

Ready to import the GnuPG public key for "Escrow User"? (<Y>/n): 
Successfully imported the GnuPG public key for "Escrow User".

Stage 4: Activate the new escrow user

Import "Escrow User" into the StoredSafe user database table? (<Y>/n): 
Successfully imported "Escrow User" into the StoredSafe user database table.

Press any key to continue