Zonitix — Key Recovery

Offline. Nothing you type here leaves this page.

Only run this during a real recovery. Reconstructing the key is exactly what an attacker would do. Everyone who holds a share should know this is happening.

Step 1 · Two trustees, two shares

Each trustee pastes their own sealed share, then supplies whatever locks it — a passphrase, or a private key file. You do not need to know which: paste the share and this page will ask for the right one. Ideally each trustee does their own — nobody needs to learn anyone else's passphrase or hold anyone else's key.

Paste the share above and this will say what it needs.
Paste the share above and this will say what it needs.

Recorded when escrow was set up. If it matches, this is definitely the right key.

Step 2 · Put it back

On the rebuilt server, write the recovered value to the matching secret file and redeploy. The file must contain the key and nothing else — no trailing newline.

printf '%s' "<recovered value>" > .secrets/<key_name>
chmod 600 .secrets/<key_name> then ./deploy.sh

If the fingerprint did not match, stop. Deploying a wrong key will fail to decrypt everything it touches, and the signer treats an undecryptable value as tampered rather than falling back.

Before a disaster · Create a holder key

Only for a key-file holder — a custody desk, escrow agent or anyone who would rather hold a file in an HSM or a safe than remember a passphrase. Most holders do not need this: a passphrase is fine, and this is the harder option to look after. Do this once, before escrow is set up, on the machine that will keep the key.

RSA-4096. Generated by this browser, offline — it may take up to a minute.