Cryptographic Information Recovery Using Key Recovery

Abstract

A note to readers: the authors consider that all techniques for key recovery may be viewed as having a position on a broad continuum. The only way to avoid misunderstanding is to identify particular techniques by listing their specific characteristics, rather than using multiply-defined terms. Different characteristics have advantages in different environments, so there is no ‘best’ key recovery technique. The paper notes some typical advantages and disadvantages of several techniques but should not be construed as an endorsement of any particular technique relative to another. Similarly, the authors recognize that terminology may vary from country to country. Cryptographic information recovery techniques provide for the recovery of plaintext from encrypted data. This (exceptional) need arises when the cryptographic keys involved are not available. For example, data files may have been encrypted using a key derived from a now forgotten or misplaced password. Overlapping and confusing terminology has been applied to the techniques of information recovery, including key escrow, key backup, key recovery, and trusted third party (ttp), all of which refer to methods for retrieving, recovering, or re-constructing keys. Even the underlying concept of ‘trust’ has broad meaning. Instead of attempting to ‘define’ these terms precisely, a continuum of functionality is defined. Several generic technologies, together with desirable characteristics of cryptographic information/key recovery techniques, are described.