I am very new to cryptography, and am having a lot of trouble googling my way to an answer to the following problem.

We have an external party (telephony provider) recording phonecalls for us. We would like to make very sure these can only be listened to when appropriate. The ideal solution would be for the external party to encrypt them using a key, that can not be used for decrypting them. We would then deposit the decryption key with a third party (ie. lawyer). That would mean that if I wanted to listen to a conversation illicitly, I'd have to convince both the telephony provider to hand over the recording and the lawyer to hand over the decryption key. separate instances, who would not know each others identities.

Does such an encryption scheme exist?

I've looked at asymmetrical decryption like RSA, but from my reading of http://logos.cs.uic.edu/340%20Notes/rsa.html it would seem like if I encrypt using a public key, then knowing that public key should be enough to decrypt a file, even without knowing the private key? Or am I misunderstanding this?

  • 3
    $\begingroup$ No, knowing the public key precisely is not enough to decrypt arbitrary ciphertexts. Note however that a malicious entity may copy the data (and transfer it somewhere unencrypted) before encrypting it and this (nearly?) always works... $\endgroup$
    – SEJPM
    Jan 6, 2018 at 15:51
  • 1
    $\begingroup$ The problem is that asymmetric key encryption is designed to encrypt short data, data shorter then the key. The usual manor of handling this is hybrid encryption where the data is encrypted with symmetric key encryption such as AES with a random key and that key is encrypted with asymmetric key encryption. The catch is the encryption party could save the symmetric key when performing the encryption. That is similar to the argument by SEJPM but easier to save than the entire message. But if this is important you need to hire a seasoned cryptographic expert, if it is a toy project "go for it." $\endgroup$
    – zaph
    Jan 6, 2018 at 22:02
  • 1
    $\begingroup$ The problem I see is that if the external party is not trustworthy, then they can simply keep a copy of the raw recording, and any encryption scheme you come up with becomes irrevelant. $\endgroup$ Jan 7, 2018 at 3:27
  • $\begingroup$ Who would generate the keys? Since in your scenario no single entity is supposed to know both keys, you need to trust the key generator to properly discard the key(s) they are not supposed to know. $\endgroup$
    – fkraiem
    Jan 7, 2018 at 3:36
  • $\begingroup$ All good comments. The problem isn’t that the telephony provider is not trustworthy as such, but we would like to set up as much protection as is realistically possible against hackers, disgruntled employees with access to the file server etc. $\endgroup$
    – BjaRule
    Jan 7, 2018 at 12:09

1 Answer 1


Yes, you're misunderstanding how public key encryption (such as RSA) works. Indeed, the entire point of public-key encryption schemes is that the public key can be used to encrypt data, but not to decrypt it; for decryption, the private key is required.

However, there's a catch that you should be aware of: the public-key encryption schemes we currently know of are generally not suitable for directly encrypting large amounts of data, because:

  1. they're really slow, especially when compared to symmetric encryption schemes like AES; and
  2. they tend to produce ciphertext that is larger than the encrypted plaintext, often significantly so.

The usual solution to these problems is to use hybrid encryption. Basically, what programs like PGP / GnuPG do to "encrypt a file with RSA" is that they generate a random "message key" for a fast symmetric cipher like AES, encrypt the file with that AES key, then encrypt the AES key (which is short, only 16 to 32 bytes) with RSA, and finally join the two ciphertexts together (along with various kinds of metadata) as the encrypted output file.

As long as the intermediate AES key used to encrypt the data is safely discarded, the only way to decrypt the encrypted file is to first extract the encrypted AES key from the encrypted file, decrypt it with the RSA private key, and then decrypt the actual data with the decrypted AES key. But in principle, a malicious encryptor could save a copy of the AES key (or simply generate it according to some deterministic pseudorandom algorithm that they can later repeat), and thereby retain "back door" access to the encrypted files.

Of course, in principle a malicious encryptor could also simply save a copy of the unencrypted data before encrypting it, so in that sense, the problem is unavoidable. However, a bunch of 32-byte AES keys is a lot easier to conceal than several mega/giga/terabytes of audio recordings (and an "accidental bug" in the AES key generation code that makes it at least partially repeatable could be even easier to hide, and to explain away if found).

In practice, giving your telephony provider an RSA public key and your lawyer the corresponding private key (or, better yet, asking your lawyer to generate an RSA keypair and to send you and your provider the public key), and having the provider encrypt the audio files with that key using standard off-the-shelf software like PGP / GnuPG is probably good enough.

While it would be theoretically possible for the provider to modify the software to insert a backdoor into it, that would take some non-trivial effort and programming / crypto knowledge, and would risk being caught in an audit (since any such modified software would stand out if compared to the standard version of the same program). And in any case, they'd have to do that before encrypting the files they want to be able to decrypt; as long as they're initially honest, they won't be able to later decrypt any honestly encrypted files even if they later turn malicious (and/or are compromised by someone else).

  • 1
    $\begingroup$ This seems like the way to go for us. I am assuming a standard program like GnuPG will automatically make sure to discard the unencrypted symmetric key? $\endgroup$
    – BjaRule
    Jan 7, 2018 at 11:45
  • $\begingroup$ Yes, they will. If written carefully, they'll even go to some lengths to ensure that it will actually be irrecoverably erased from the system (e.g. by preventing the OS from ever swapping it to disk). I have not actually personally confirmed how or whether PGP or GPG do that, but I'd be surprised if they didn't. $\endgroup$ Jan 7, 2018 at 12:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.