A single-use authentication method for accessing encrypted data stored on a protected volume of a first computer, comprising: generating a key protector by encrypting a volume-specific cryptographic key needed to decrypt the encrypted data stored on the protected volume with a public key of a randomly-generated asymmetric public and private key pair; storing the key protector in a portion of the protected volume of the first computer for subsequent emergency access when the first computer needs to decrypt the protected volume by bypassing a system safeguard for the protected volume, wherein the key protector is stored along with an identifier that indicates that the key protector is a one-time use key protector and key protector attributes, wherein the identifier and the key protector attributes are distributed along with the public key; and responsive to detecting an attempt to access the protected volume, performing the following steps by the first computer: obtaining the private key from a server over a network, wherein the key protector attributes uniquely identify the server to be contacted, and wherein the private key is obtained from the server after a successful performance of a challenge-response interaction; decrypting the key protector using the private key to obtain the volume-specific cryptographic key; determining, based on the identifier stored along with the key protector, whether the key protector is a one-time use key protector; and deleting the key protector from the local memory of the first computer after the single use thereof, when the identifier indicates that the key protector is a one-time use key protector; wherein a new key protector is automatically provisioned to be used for obtaining subsequent access to the encrypted volume. generating a key protector by encrypting a volume-specific cryptographic key needed to decrypt the encrypted data stored on the protected volume with a public key of a randomly-generated asymmetric public and private key pair; storing the key protector in a portion of the protected volume of the first computer for subsequent emergency access when the first computer needs to decrypt the protected volume by bypassing a system safeguard for the protected volume, wherein the key protector is stored along with an identifier that indicates that the key protector is a one-time use key protector and key protector attributes, wherein the identifier and the key protector attributes are distributed along with the public key; and responsive to detecting an attempt to access the protected volume, performing the following steps by the first computer: obtaining the private key from a server over a network, wherein the key protector attributes uniquely identify the server to be contacted, and wherein the private key is obtained from the server after a successful performance of a challenge-response interaction; decrypting the key protector using the private key to obtain the volume-specific cryptographic key; determining, based on the identifier stored along with the key protector, whether the key protector is a one-time use key protector; and deleting the key protector from the local memory of the first computer after the single use thereof, when the identifier indicates that the key protector is a one-time use key protector; wherein a new key protector is automatically provisioned to be used for obtaining subsequent access to the encrypted volume. obtaining the private key from a server over a network, wherein the key protector attributes uniquely identify the server to be contacted, and wherein the private key is obtained from the server after a successful performance of a challenge-response interaction; decrypting the key protector using the private key to obtain the volume-specific cryptographic key; determining, based on the identifier stored along with the key protector, whether the key protector is a one-time use key protector; and deleting the key protector from the local memory of the first computer after the single use thereof, when the identifier indicates that the key protector is a one-time use key protector; wherein a new key protector is automatically provisioned to be used for obtaining subsequent access to the encrypted volume.