Encrypted backups: where to keep the keys so you can restore

Encrypted backups are only useful if you can still get the key during a disaster. OWASP's key management guidance says data encrypted with lost keys cannot be recovered, so a secure key backup capability is essential, especially for long term encrypted data stores. Keep keys apart from the backups they protect.

Two failure modes

1. The key is lost. The backup is unreadable forever.
2. The key sits with the backup. An attacker who steals the backup also steals the key, and encryption achieved nothing.

You need a design that avoids both.

What OWASP says

• Key backup is essential, since lost keys mean unrecoverable data.
• Encrypt the key backup database using at least a FIPS 140-2 or 140-3 validated module.
• Escrow can help with investigations and re-provisioning. Signing keys should never be escrowed. Encryption keys may be.
• Store keys in a vault such as an HSM or isolated cryptographic service, never in plaintext, and never in source repositories or build artifacts.
• Encrypt keys with key encryption keys of equal or greater strength before storing offline or exporting.
• Apply integrity protection to stored keys.

OWASP also says retired keys should be kept for a time in case old backups need decrypting. Retention of old keys has to match your backup retention, otherwise old backups become unreadable on schedule.

A workable design

1. Use a key service for backup keys, with access separate from the backup storage account.
2. Keep an encrypted export of key material in a second location and a second administrative boundary.
3. Require two people to retrieve the emergency copy, and log each retrieval.
4. Document the recovery steps and keep them where they can be reached when systems are down.
5. Align key retention with backup retention.
6. Test: restore from backup using only the documented emergency path. See a backup restore drill.

Tie to deletion

If you rely on destroying keys to delete data, this design must be able to destroy every copy. See crypto-shredding.

A scenario to test your design

Imagine your main cloud account is locked after a credential compromise. The backups are intact in a second account, but the key service that wrapped their keys lives in the first. Can you restore? If the answer depends on one person's phone or a document stored in the locked account, you have found the weakness. Walk through who holds the emergency copy, where the recovery steps live, and how long retrieval takes. Run the walk-through as a tabletop first, then as a real restore in your drill. Repeat when staff or accounts change, because key custody quietly rots when people leave.

Quick check

Sources

• OWASP Key Management Cheat Sheet
• OWASP Cryptographic Storage Cheat Sheet
• CISA #StopRansomware Guide

Last reviewed: 19 October 2026.