0

Are there any best practices around distributing an encrypted package to multiple end user systems, specially if the end system are offline ones, in context of asymetric cryptography?

Is it a must to create unique public/private key sets [ per end user system] and encrypt the same package many times uniquely with the public keys, resulting in a specific package per end user system? How will this scale?

Will it be a good practice to sign the original private key [ corresponding to public keys used to encrypt the package] with senders private keys and then encrypt using end user systems public keys and share it directly with end users, through trusted communication?

Or encrypt the private key with end user systems public key, sign with senders private key and re-encrypt[symmetric] this with the hash of certain string uniquely identifying a end user system? This hash should be programtically reproducible using system unique identifiers later during decryption processes. This way, to retrieve the original private key to decrypt the package, it will require both a corresponding public key[end user clients] as well as end user machine [the hash of string to be generated at runtime on end user system.] and senders public key to manage the authenticity?

Improve this question
3
  • I asked this question originally on stackoverflow.com/questions/51886470/… and was asked to post here instead. Thank you.
    – Deepak Chaudhary
    Commented Aug 17, 2018 at 18:04
  • It would be helpful if you could expand on your goals and what threats you're trying to protect against.
    – AndrolGenhald
    Commented Aug 17, 2018 at 18:15
  • Thank you @AndrolGenhald. I am looking for a solution path where ideally I would not want to build a new solution packages per end-user client [might range between 1 to large number, managing that number of builds will be a challenge]. Possibly 1 package that can be sent to multiple end user clients and then somehow sent keys via means specific to each client [ for ex- encrypt keys with specific client key set ]
    – Deepak Chaudhary
    Commented Aug 17, 2018 at 18:21

1 Answer 1

Reset to default
1

You can programatically generate a symmetric key on every client, and generate the same key on the packaging server. Generate a keypair and distribute a single public key to each client.

When you generate a new package, encrypt it with the symmetric key, sign with your private key, and distribute. On the client side, check the signature with the public key, and if the package passes the check, use the generated symmetric key to decrypt.

If you don't need to create a unique package to each client, you can distribute the public key, and encrypt the package with your private key. Sign the resulting file and distribute. After receiving the file, the client checks the signature, and decrypts the file. Side effect is that every client can decrypt every package, but if the clients are offline and isolated from each other (or don't know each other), it should not be a big issue.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .