GuidesBe a trustee for a backup key
On this page0

Guide

Be a trustee for a backup key

You have been asked to hold one part of a key that protects your company's backups. Make your key file, send back the part that is safe to share, keep the kit you are given, and take part in one test.

For: AnyonePlan: All plans

Before you start

  • An administrator at your company has told you that you are a trustee and has sent you a file named “zonitix-key-recovery.html”. You need no technical knowledge and no special role in Zonitix.
  • A computer you will still be able to use in a few years, and a safe place for two files that is not your work mailbox: for example a password manager or an encrypted USB stick kept at home.
  • About the job itself: your company’s backups are locked with a key. That key is cut into three parts and given to three people. Any two of you together can rebuild it; one part alone opens nothing. You hold one part.
Your administrator may be working to a date. Zonitix gives a company 14 days from its first verified backup to hand out the parts of both keys, and locks for everyone if that date passes, until it is done. Steps 1 to 4 below are your share of that: do them when you are asked, so the administrator can finish.
Everything on this page is done in a file that opens in your web browser. It is not a website: it works with no internet connection, and its first line reads “Offline. Nothing you type here leaves this page.”

Make your key and send back the public part

  1. Step 1: Open the file you were sent

    Save “zonitix-key-recovery.html” to your computer and double-click it. It opens in your browser under the heading “Zonitix — Key Recovery”. This is the Recovery Kit, with nothing of yours in it yet.

  2. Step 2: Generate your key pair

    Scroll to the last box, “Before a disaster · Create a holder key”, and click “Generate a key pair”. It can take up to a minute. A green box then shows “Key” followed by a short code, and a block of text headed “Public key”.

    You now have two matching things. The private key is yours alone: it is the only thing that can open your part of the backup key. The public key can only lock, never unlock, so it is safe to send to anyone.

  3. Step 3: Save both files before you close the page

    Click “Save private key” and then “Save public key”. Two files are saved, with names that start “zonitix-holder-” and end “-PRIVATE.pem” and “-public.pem”.

    The private key is shown once and is not stored anywhere. Move the file ending “-PRIVATE.pem” to your safe place now. Nobody can get it back for you if it is lost, and it is not a password you can remember instead.

  4. Step 4: Send the public key to your administrator

    Send the administrator the file ending “-public.pem”, or copy the whole “Public key” block from the page, including the lines “-----BEGIN PUBLIC KEY-----” and “-----END PUBLIC KEY-----”. Email is fine for this.

    Never send the file ending “-PRIVATE.pem” to anyone, including the administrator and Zonitix. If you sent it by mistake, say so and repeat steps 2 to 4 to make a new pair.

Keep the kit you are given

  1. Step 5: Receive your own kit

    When all three trustees have sent a public key and a second administrator has approved, your administrator gives you a second file. Its name starts “zonitix-recovery-kit-” and ends with your number, for example “-share-2.html”. It is the same tool as before, now with your part of the key inside it, locked so that only your private key file can open it.

    You may be given two kits, one for each of the two keys your company protects: the “Backup encryption key” and the “Application data key”. The same private key file can serve for both.

  2. Step 6: Check it is yours and store it

    Open the kit. The box “Your kit” at the top shows your name and “share” number, the name of the key, and a fingerprint: a short code that identifies the key and is safe to write down.

    Keep the kit and your private key file where you will still have them in five years. Keep your kit away from the other trustees’ kits: not the same drive, vault or mailbox. Any two kits, with their private key files, are the key.

Take part in the test

  1. Step 7: Rebuild the key once, with a second trustee

    Until two trustees have proved the parts work, the administrator’s screen shows the key as “NEVER TESTED”. The administrator will ask you and one other trustee to do the test together, sitting at the same computer.

    What each of you brings: your own kit and your own private key file, for example on your own USB stick. You take both away again afterwards. The page warns “Only run this during a real recovery.” A test that your administrator has arranged, with both of you knowing about it, is the other time it is used.

    Then, one action at a time:

    1. First trustee: open your own kit. Under “Step 1 · Two trustees, two shares”, your part is already filled in as “Trustee A — sealed share”, and the fingerprint is filled in too.
    2. First trustee: choose your private key file under “Trustee A — private key file”.
    3. Second trustee: open your own kit file on the same computer, from your own stick, next to the first trustee’s.
    4. Second trustee: copy the long block printed under “YOUR SEALED SHARE” and paste it into “Trustee B — sealed share” in the first trustee’s kit. That block is locked, so you may instead email it to the first trustee beforehand.
    5. Second trustee: choose your own private key file, from your own stick, under “Trustee B — private key file”.

    Each file is read in the page and is never uploaded. A private key file is never emailed or copied to the other trustee, in a test or at any other time: both files have to be chosen on this one computer, which is why you sit together.

  2. Step 8: Read out the fingerprint

    Click “Recover key”. A green line then reads “Fingerprint MATCHES — this is the right key.” Above it the page prints “fingerprint” and a 16-character code. Read that code to your administrator, who types it into Zonitix to record the test.

    The page also shows the rebuilt key itself, under “Recovered key”. In a test nobody needs it. Do not copy it, photograph it or save the page; close the browser window once the fingerprint has been read out. The box “Step 2 · Put it back” is not part of a test: leave it alone.

What you should see

You hold two things, stored apart from the other trustees’ copies: your private key file, and one kit for each key you were made a trustee of.

Your administrator sees “PROTECTED” next to the key on SystemBackups & Recovery, with your name listed under it and the date of the test you took part in. You do not need access to that screen yourself.

After that there is nothing to do until you are asked: for another test, or because the key really has to be rebuilt. In either case two trustees act together, as in steps 7 and 8, and your administrator leads.

If something goes wrong

You lost your private key file, or you are not sure where it is
Tell an administrator straight away. Your part of the key cannot be opened without that file, and nobody can recover the file. The administrator shares the key out again ("Re-share" on the Key escrow card), which gives every trustee a new kit.
You lost the kit but still have the private key file
Tell an administrator. Kits are shown once and are not kept on the server, so a lost kit cannot be downloaded again. The key has to be shared out again.
You are leaving the company, or no longer want to be a trustee
Tell an administrator before you go, so they can share the key out again to people they can still reach. When a trustee’s Zonitix account is offboarded, the Key escrow card marks that key for re-sharing.
"This share was sealed to key …, but this file is key …. Find the matching key file."
You chose a private key file that does not belong to this kit, for example an older one. Choose the file whose name carries the same code the message asks for.
"That file is not a private key."
You chose the file ending -public.pem, or a different file. Choose the one ending -PRIVATE.pem.
A red line says "Fingerprint does NOT match"
The two parts may not be from the same key, for example one kit is for the Backup encryption key and the other for the Application data key. Check both kits name the same key in "Your kit" and try again. If they do and it still fails, tell your administrator; do not carry on.
Someone you do not know asks you for your kit or your private key file
Do not send either. Check with an administrator you know, by phone or in person. A real recovery is led by your own administrator and always involves a second trustee.

Still stuck? See When something goes wrong, or Contact Zonitix support.

Where next

Previous
Set up backups
Next
Restore from a backup