Skip to main content
Commerce Security Authority
Category: Key Management

Split Knowledge

Simply put

Split knowledge is a security method in which the information needed to perform a sensitive task, such as reconstructing a cryptographic key, is divided among two or more people so that no single person holds enough to use it alone. Each individual possesses only a component that reveals no usable information about the full key on its own. It is commonly paired with dual control, but the two are distinct concepts.

Formal definition

Split knowledge is a key-management process in which a cryptographic key is divided into multiple key components, each held separately such that any individual component conveys no knowledge of the original key. The intent is that no single person has access to, or can derive, a plaintext encryption key in use; reconstruction requires the combination of components held by separate custodians. In PCI DSS, split knowledge is addressed alongside dual control as a control over manual clear-text cryptographic key-management operations, though it should not be conflated with dual control: split knowledge governs how key material is partitioned among custodians, while dual control governs the requirement that more than one person participate in a given operation. Requirement numbering and wording for these controls differ across PCI DSS versions, so practitioners should confirm the applicable requirement against the current published standard rather than assuming a fixed number.

Why it matters

Manual clear-text key-management operations represent one of the highest-risk moments in a cryptographic system, because they are among the few points where key material may exist in a form a person could observe, copy, or exfiltrate. Split knowledge helps reduce the risk that any single individual can obtain or reconstruct a usable plaintext key, whether through malicious intent, coercion, or error. By ensuring that each custodian holds only a component that conveys no knowledge of the full key, the method is intended to limit the impact of a single compromised or dishonest custodian.

Split knowledge matters most where organizations perform manual key operations rather than relying entirely on hardware security modules that generate, store, and manage keys without human exposure to clear-text material. In these manual scenarios, the partitioning of key components among separate custodians is a core assumption underlying the trust placed in the broader key hierarchy. A failure to properly separate components, or a situation where one person effectively controls multiple components, can quietly undermine that assumption without producing any obvious operational symptom.

Split knowledge should not be treated as a standalone safeguard. It addresses how key material is partitioned among people, but it does not by itself govern how many people must participate in a given operation, which is the role of dual control. The two are commonly paired precisely because each addresses a different aspect of custodian risk, and confusing one for the other can leave gaps in a key-management program.

Who it's relevant to

Key custodians and key-management operators
Individuals designated to hold key components must understand that they possess only a portion of the key and that their component conveys no usable knowledge of the full key on its own. They are responsible for protecting their component and for maintaining separation from other custodians so that no single person can assemble a plaintext key.
Compliance officers and QSAs
Those validating PCI DSS compliance must confirm that split knowledge is correctly implemented for manual clear-text key-management operations and that it is not conflated with dual control. Because requirement numbering and wording differ across PCI DSS versions, they should assess the control against the current published standard rather than a fixed requirement number, and confirm that custodian assignments genuinely prevent any single person from reconstructing a key.
Cryptographic architects and security engineers
Teams designing key hierarchies decide whether manual key operations are needed at all and, where they are, how split knowledge and dual control are combined. They should recognize the distinction between the two controls and consider whether hardware security modules can reduce reliance on manual clear-text handling, which changes the operational context in which split knowledge applies.
Security and operations managers
Managers responsible for staffing key ceremonies and defining separation-of-duties policies must ensure that custodian roles are assigned so that no individual controls enough components to reconstruct a key, and that these assignments are maintained through personnel changes, absences, and reorganizations.

Inside Split Knowledge

Component Separation
Split knowledge divides a cryptographic key (or other secret) into two or more parts, called components or shares, such that no single individual has knowledge of or access to the complete key. Each custodian holds only their assigned component.
Key Custodians
Individually authorized personnel who are each responsible for a single key component. Custodians are typically required to formally acknowledge their responsibilities, and their duties are separated so that no one person can reconstruct the full key alone.
Relationship to Dual Control
Split knowledge is frequently paired with dual control, which requires two or more people to act together to perform a sensitive operation. Split knowledge ensures no individual knows the whole secret, while dual control ensures no individual can act alone; the two concepts are complementary but distinct.
Applicability to Clear-Text Key Material
Split knowledge and dual control are generally applied to the management of clear-text cryptographic key material, such as during manual key generation, entry, or backup, rather than to keys that remain protected within a secure cryptographic device.
Governing Standards Context
Split knowledge appears in requirements for protecting cryptographic keys within PCI DSS, and is treated in greater operational depth in standards focused on key and PIN management such as PCI PIN and PCI P2PE. The specific obligations differ by standard, so readers should confirm requirements against the current published version of the applicable standard.

Common questions

Answers to the questions practitioners most commonly ask about Split Knowledge.

Does split knowledge mean the encryption key itself is broken into pieces that are stored separately?
Not necessarily. Split knowledge is a principle stating that no single person has knowledge of a complete cryptographic key or of enough key components to reconstruct the key. It is often implemented alongside dual control, but the specific mechanism—whether that involves distinct key components, shares, or other techniques—depends on the implementation. The label 'split knowledge' describes the security property (no one individual can access the full secret), not a single prescribed method of dividing a key. Confirm the actual mechanism against the relevant standard and your key-management procedures rather than assuming key fragments are physically stored in separate places.
Is split knowledge the same thing as dual control?
No, they are distinct but complementary concepts that are frequently applied together. Split knowledge ensures that no single individual has knowledge of, or access to, all the components needed to reconstruct a key. Dual control requires that a process needs two or more people to complete, so that no single person can perform a sensitive operation alone. A procedure can require dual control without split knowledge, and the two principles address different aspects of separating trust. Cryptographic key-management controls commonly require both so that neither a single person's knowledge nor a single person's action is sufficient to expose or use a clear-text key. Confirm the specific requirements against the current published standard, as wording and numbering differ between versions.
At which points in the key lifecycle should split knowledge be applied?
Split knowledge is most relevant wherever clear-text key material or key components could be exposed—for example, during key generation, manual key entry or loading, key component distribution, and any manual key-management operation involving clear-text secrets. It is generally not applied to fully automated key exchanges that use approved protocols and never expose clear-text key material to individuals. Map your key lifecycle stages against your applicable requirements to identify where split knowledge and dual control must be enforced, and confirm the details against the current published standard governing your environment.
How can we document and evidence split knowledge for an assessment?
Evidence typically includes written key-management procedures that describe how split knowledge is enforced, records identifying custodian roles, signed acknowledgments of custodian responsibilities, and logs or ceremony documentation showing that key operations were performed under the required conditions. Assessors generally look for procedural documentation plus observed or recorded evidence that no single custodian could access or reconstruct a full key. The exact evidence expected depends on the standard being assessed and the assessor's approach, so confirm requirements against the current published standard rather than assuming a fixed checklist.
How does the number of key custodians affect split knowledge implementation?
Split knowledge requires at least two custodians so that no single individual holds enough information to reconstruct a key, and organizations often designate additional custodians to support availability and backup coverage. Adding custodians can improve operational resilience but also expands the population that must be trained, controlled, and monitored. The appropriate number is a balance between availability, separation of duties, and administrative overhead, and any threshold or share-based scheme should be defined in your key-management procedures and validated against the applicable standard.
Does using a hardware security module (HSM) or automated key management remove the need for split knowledge?
It depends on whether clear-text key material or components are ever exposed to individuals. When keys are generated, stored, and exchanged entirely within HSMs or through approved automated methods that never present clear-text key material to a person, manual split-knowledge controls may not apply to those operations. However, any manual step—such as loading a master key, distributing components, or recovery procedures—can reintroduce the need for split knowledge and dual control. Review your specific processes to identify where clear-text exposure could occur, and confirm the treatment against the current published standard for your environment.

Common misconceptions

Split knowledge and dual control are the same thing.
They address different objectives. Split knowledge ensures that no single person has knowledge of a complete secret, while dual control requires the participation of two or more people to complete a sensitive process. A system can implement one without the other, though they are commonly combined for key management.
Split knowledge protects keys that are already stored inside a hardware security module.
Split knowledge is intended primarily for handling clear-text key components during operations such as manual key entry or backup. Keys that remain protected within a secure cryptographic device rely on the device's own protections, not on split knowledge among human custodians.
Applying split knowledge by itself guarantees keys cannot be compromised.
Split knowledge helps reduce the risk that a single individual can misuse or disclose a full key, but it does not eliminate risk. Weak custodian vetting, poor component storage, collusion, or flawed procedures can still lead to compromise, so it must be combined with other controls.

Best practices

Assign each key component to a separate, individually authorized custodian and ensure that no single custodian ever has access to enough components to reconstruct the full key.
Combine split knowledge with dual control so that both knowledge of the secret and the ability to act on it are distributed across multiple people.
Require custodians to formally acknowledge their responsibilities and maintain documented records of component assignments and any transfers.
Store each key component using physically and logically separated protections, so that compromise of one storage location does not expose the complete key.
Apply split knowledge specifically to clear-text key material handling, such as manual key generation, entry, and backup, and rely on secure cryptographic device protections where keys never appear in clear text.
Verify custodian separation, procedures, and applicable obligations against the current published version of the relevant standard (for example PCI DSS, PCI PIN, or PCI P2PE), since requirements differ by standard and version.