An apparatus for cryptographic key management for managing access control, the apparatus comprising: processing circuitry, the processing circuitry including a processor and a memory, the memory containing instructions that, when executed by the processor, configure the processor to: divide a key into a plurality of portions of the key; receive pre-encryption contextual data for each of a plurality of devices, the pre-encryption contextual data indicating at least one attribute of a respective device of the plurality of devices before an encryption of the plurality of portions of the key is performed; encrypt the plurality of portions of the key based at least on the pre-encryption contextual data of the plurality of devices to make the plurality of the portions of the key dependent at least on contextual data corresponding to pre-encryption contextual data; distribute each of the plurality of encrypted portions of the key to a respective device of the plurality of devices for storage and retrieval; receive post-encryption contextual data for at least one of the plurality of devices, the post-encryption contextual data indicating at least one attribute of a respective device of the plurality of devices after the encryption of the plurality of portions of the key is performed; receive at least one of the plurality of encrypted portions of the key; generate a reconstructed key based on: the post-encryption contextual data for at least one of the plurality of devices; and the received at least one of the plurality of encrypted portions of the key; and the reconstructed key corresponding to the key if at least a portion of the post-encryption contextual data corresponds to the pre-encryption contextual data. divide a key into a plurality of portions of the key; receive pre-encryption contextual data for each of a plurality of devices, the pre-encryption contextual data indicating at least one attribute of a respective device of the plurality of devices before an encryption of the plurality of portions of the key is performed; encrypt the plurality of portions of the key based at least on the pre-encryption contextual data of the plurality of devices to make the plurality of the portions of the key dependent at least on contextual data corresponding to pre-encryption contextual data; distribute each of the plurality of encrypted portions of the key to a respective device of the plurality of devices for storage and retrieval; receive post-encryption contextual data for at least one of the plurality of devices, the post-encryption contextual data indicating at least one attribute of a respective device of the plurality of devices after the encryption of the plurality of portions of the key is performed; receive at least one of the plurality of encrypted portions of the key; generate a reconstructed key based on: the post-encryption contextual data for at least one of the plurality of devices; and the received at least one of the plurality of encrypted portions of the key; and the post-encryption contextual data for at least one of the plurality of devices; and the received at least one of the plurality of encrypted portions of the key; and the reconstructed key corresponding to the key if at least a portion of the post-encryption contextual data corresponds to the pre-encryption contextual data.