Commercial key escrow service

Definition

A commercial key escrow service is

“

[a] person who holds the private key of a subscriber and other pertinent information pursuant to an escrow agreement or similar contract binding upon the subscriber, the terms of which require one or more agents to hold the subscriber's private key for the benefit of subscriber, an employer, or other party, upon provisions set forth in the agreement. The subscriber may have originally entered into the escrow agreement voluntarily, or the subscriber's entry into a binding contract may have been required as a condition upon the commencement or continuation of an employment relationship or vendor relationship with a customer, or other relationship with a third party. The purpose of the escrow arrangement may be to ensure the recovery (by the subscriber, employer, customer, or other third party) of the private key of the subscriber and other pertinent information, upon the death, disability, departure, or recalcitrance of a subscriber who is an employee. Where a key pair is used for digital signatures only (i.e., the same key pair is not also used for data encryption) there is unlikely to be any reason to recover a subscriber's key which becomes permanently unavailable. Rather, the appropriate remedy will likely be to revoke any certificates issued with respect to the public key. To the extent the key pair could also be used for encryption of information, or to the extent a private key used for creating digital signatures becomes only temporarily unavailable, the key escrow service should serve to complement key security. A private key escrow service must use only trustworthy systems, and the service must endeavor to minimize the potential compromise of the subscriber's private key, whether used for digital signature or for encryption purposes.

”