PGP has a method for handling this that (in your case) would go something like:
To protect the data:
- Application knows user's public key (Ku)
- Application generates "Hello world."
- Application generates good symmetric encryption key (Ks)
- Application uses Ks to encrypt "Hello world."
- Application makes a copy of Ks that's encrypted with Ku
- Application makes a copy of Ks that's encrypted with application's public key (Ka)
- Application stores encrypted string and both encrypted passwords
To retrieve the data:
- Application delivers the copy of Ks encrypted with Ku
- User decrypts it using their private key
- Application uses the decrypted Ks to decrypt the data and display for user.
Because there's a copy of Ks encrypted with Ka, the application can decrypt the data without the user as long as the application's private key is available.
As @CBHacking stated in comments, it's highly advisable you find an existing well-tested crypto system that will suit your needs. Roll-your-own crypto is an easy way to make embarrassing mistakes. Speaking as someone who implemented the first non-plaintext password storage at my company, there are plenty of options created by people who understand this stuff way better than we do.