I am new to cryptography.

I have a package to be shared with Bob which is something like below:

Package contains: data.zip and Application


  • data.zip is encrypted
  • Application will have logic to decrypt the data

Bob will run Application and it will decrypt the data.zip.

Now for the decryption key, I understand that I can maintain a key store where I can keep the key securely which my Application will access and get the key.

But in my case Bob will execute the Application offline.

Building the Application with the decryption key doesn't make sense as Bob can easily take the key or logic to form the key from Application.

In this scenario how can I handle the decryption part? what is the ideal solution and how where should I keep the key?

  • 2
    $\begingroup$ Congratulation, you correctly identified a limitation of crypto: decryption requires a secret, and it needs to be stored safely. I'm sorry that we only have limited options for this. Some of the best involve hardware: Smart Card, HSM, TPM. Others involve Bob memorizing a passphrase/password and keying it in. There are hybrids (e.g. One Time Password generator with a PIN). And then biometry can be thrown in the mix. It would help if you limited your scope. And I'm not sure the question will end on-topic for crypto-SE; have you thought of security-SE? $\endgroup$ – fgrieu Oct 2 '20 at 10:29