User-friendly, secure and auditable cryptography administration system

A computer-implemented method comprising:

• by one or more hardware computer processors executing program instructions:
• generating an encrypted data value from one or more raw data values with a selected cryptography algorithm, wherein at least a portion of the encrypted data value comprises a channel identifier that points to a location in storage comprising a cryptography key for decrypting the encrypted data value, wherein another portion of the encrypted data value comprises an encrypted data portion corresponding to the one or more raw data values;
• generating a license comprising one or more permissions to decrypt the encrypted data value;
• configuring the license with a justification prompt for receiving a justification for performing a cryptographic operation;
• configuring the justification prompt to solicit the justification responsive to a request to perform the cryptographic operation;
• configuring the license to allow the request responsive to receipt of the justification;
• and
• storing the license with information for generating the justification prompt in the location in storage accessible by the channel identifier of the encrypted data value.

Non-transitory computer-readable media including computer-executable instructions that, when executed by a computing system, cause the computing system to perform operations comprising:

• generating an encrypted data value from one or more raw data values with a selected cryptography algorithm, wherein at least a portion of the encrypted data value comprises a channel identifier that points to a location in storage comprising a cryptography key for decrypting the encrypted data value, wherein another portion of the encrypted data value comprises an encrypted data portion corresponding to the one or more raw data values;
• generating a license comprising one or more permissions to decrypt the encrypted data value;
• configuring the license with a justification prompt for receiving a justification for performing a cryptographic operation;
• configuring the justification prompt to solicit the justification responsive to a request to perform the cryptographic operation;
• configuring the license to deny the request without the justification;
• and
• storing the license with information for generating the justification prompt in the location in storage accessible by the channel identifier of the encrypted data value.