Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to develop an application that will allow a user to create a public/private key pair, and encrypt it symmetrically with a key such that once they enter their password, they will be able to decrypt the key pair and retrieve its contents.

However, it is desirable for someone else that they trust to be able to decrypt the key as well, in case they lose access or have a reason for someone to be able to access the key pair (like a joint account).

Let's say that a user John has given Adam, Emily, and Scott access to the key pair, but it turns out that John no longer trusts Emily and wants to invalidate her access. Since she has already seen the private key, he has to generate a new one, but wants to do it in such a way that Adam and Scott will still have access without having to enter their password or do anything additional.

How can this be accomplished? Is this possible?

share|improve this question
This sounds like key escrow. – rath Mar 23 '14 at 17:31
up vote 3 down vote accepted

Sure. Encrypt John's private key under Adam, Emily, and Scott's public key. When you revoke Emily and change John's keypair, encrypt John's new private key under Adam and Scott's public key. If Adam or Scott need access, they can decrypt. After the key change they will still have access and still be able to decrypt it, same as they were able to before.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.