Two key copies are not two file copies

Lesson map

Lesson 12. Map, example, EX058.

flowchart TD
  K["Recovery key"] --> C["Cloud account"]
  K --> S["Printed copy in the office safe"]
  F["Documents"] --> V["Cloud file service, with versions"]
  C --> X{"Does a key copy restore a file?"}
  V --> X
  X -->|No| D["Keep the two stores distinct"]

The key unwraps a volume. The file service returns a document.

Logical drawing

key custody
    cloud account
    paper in the office safe
    not on the laptop
file recovery
    recycle bin and previous versions
people named for admin passwords
    Leah and the deputy manager
people named for the safe
    nobody

Learning outcomes

After this chapter, you should be able to:

1. Explain why the recovery key is stored twice and off the laptop.
2. Keep key custody distinct from document restore.
3. Refuse to move the deputy manager onto the safe, or to print a key.

12.1 Escrow of the key is availability of the unwrap, not availability of the documents.

A recovery key answers a narrow failure. The TPM will not unseal, the volume will not open, and the food bank still needs its own data. Chapter 3 stores that key in two places: the food bank's cloud account, and a printed copy in the office safe. Two places matter because either store can be unreachable. If the cloud account is down, the paper in the safe is the remaining unwrap path. If that paper is locked in a building no trustee can enter tonight, the cloud account is the remaining path. Neither copy is written on the laptop. A key that lives only on the laptop cannot be reached when that laptop is the machine asking for the key. That is the mistake chapter 3 already marks.

The key does not contain the documents. Unwrapping the volume reveals whatever was on the disk. Returning a single file that a volunteer deleted, or an older revision of a document that was overwritten, is the cloud file service's job, as chapter 10 separates the recycle bin from previous versions. A reader who "backs up the laptop" by photocopying the recovery key a third time has not copied the documents. A reader who deletes the paper because the files are in the cloud has removed the unwrap path for a laptop whose measurements change. Both confusions mix SC-28's at-rest problem with the backup problem.

Authority is also unassigned. The deputy manager shares the separate administrator passwords with Leah, and those secrets sit in the password manager. The book never says the deputy manager can open the safe. It never names a safe combination, a key identifier, or a photograph. Microsoft documents a numerical recovery password as a form BitLocker can use. This manuscript does not display a key, so it does not display a length, a grouping, or a single digit. Inventing "the 48-digit key from the safe" would turn a vendor's general format into Fenwick evidence. If both the cloud copy and the paper were lost, a laptop that asked for recovery would stay unreadable to the food bank as well as to a thief. That availability limit is the reason the two copies exist. It is not a procedure for extracting secrets from a TPM.

12.2 Worked example

Lesson table; scroll horizontally to read all columns →

Synthetic case. The safe has no combination in the book. The cloud account has no vendor name.

Errors and limits

Two copies raise the chance that the food bank can unwrap its own disk. They do not raise the number of document versions.

Apply

• EX058 — Which store? The recovery key is in the cloud account and on paper in the safe. Documents come back through the file service. May the deputy manager be written down as the safe's holder, and may the key be printed in the note?
  Show marking criteria

  Rubric: 3 = no; key copies stay the cloud account and the safe, off the laptop, with no digits and no combination; the deputy manager stays on the admin passwords only; file restore stays the file service;; 2 = the key and the files stay different stores;; 1 = one store;; 0 = none.