An apparatus for cryptographic key management for managing access control, the apparatus comprising: processing circuitry , the processing circuitry including a processor and a memory , the memory containing instructions that, when executed by the processor , configure the processor to: divide a key into a plurality of portions of the key; receive pre-encryption contextual data for each of a plurality of devices , the pre-encryption contextual data indicating at least one attribute of a respective device of the plurality of devices before an encryption of the plurality of portions of the key is performed; encrypt the plurality of portions of the key based at least on the pre-encryption contextual data of the plurality of devices to make the plurality of the portions of the key dependent at least on contextual data corresponding to pre-encryption contextual data; distribute each of the plurality of encrypted portions of the key to a respective device of the plurality of devices for storage and retrieval; receive post-encryption contextual data for at least one of the plurality of devices , the post-encryption contextual data indicating at least one attribute of a respective device of the plurality of devices after the encryption of the plurality of portions of the key is performed; receive at least one of the plurality of encrypted portions of the key; generate a reconstructed key based on: the post-encryption contextual data for at least one of the plurality of devices ; and the received at least one of the plurality of encrypted portions of the key; and the reconstructed key corresponding to the key if at least a portion of the post-encryption contextual data corresponds to the pre-encryption contextual data. divide a key into a plurality of portions of the key; receive pre-encryption contextual data for each of a plurality of devices , the pre-encryption contextual data indicating at least one attribute of a respective device of the plurality of devices before an encryption of the plurality of portions of the key is performed; encrypt the plurality of portions of the key based at least on the pre-encryption contextual data of the plurality of devices to make the plurality of the portions of the key dependent at least on contextual data corresponding to pre-encryption contextual data; distribute each of the plurality of encrypted portions of the key to a respective device of the plurality of devices for storage and retrieval; receive post-encryption contextual data for at least one of the plurality of devices , the post-encryption contextual data indicating at least one attribute of a respective device of the plurality of devices after the encryption of the plurality of portions of the key is performed; receive at least one of the plurality of encrypted portions of the key; generate a reconstructed key based on: the post-encryption contextual data for at least one of the plurality of devices ; and the received at least one of the plurality of encrypted portions of the key; and the post-encryption contextual data for at least one of the plurality of devices ; and the received at least one of the plurality of encrypted portions of the key; and the reconstructed key corresponding to the key if at least a portion of the post-encryption contextual data corresponds to the pre-encryption contextual data. <EOS>