Let's say I have a closed user group and want to send them encrypted data over an insecure channel. I have previously had access to their devices and could have installed a decryption key. Is there any way to make sure that the decryption key can only be used on those devices?

I am not asking how to prevent key leakage in general, as that would be an overly broad question. Rather I am wondering if there is a way to lock down a key to a certain hardware environment?

Bitcoin wallets are a potential example. Some vendors (e. g. Trezor) claim that they can generate keys internally and the keys never leave the device. Does something like that exist for general-purpose encryption/decryption of data?


A smart card sounds like what you need. It's designed to let users decrypt whatever data they want with its onboard key for as long as they have it, but it doesn't let them extract the key itself from it. Note that this won't prevent users from leaking the decrypted data afterwards; this would be equivalent to effective DRM and is basically impossible.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.