Escrow compatible key generation

A method of managing encryption keys creates a new encryption key as a predictable and retrospectively repeatable function of a current encryption key. Information is then encrypted or authenticated using the new encryption key. In one embodiment, the generation of a new encryption key is triggered as a function of the amount of information encrypted or authenticated using the current encryption key. In a further embodiment, the new encryption key is created by using the current encryption key to encrypt a pre-agreed block of information, which may be an appropriate-length representation of the current encryption key. In a further embodiment, the current encryption key and a time-independent method of creating a new encryption key is escrowed.