Is it possible to encrypt data server side and then decrypt it client side; without the client having the ability to encrypt the data themselves after decrypting?

I'm working on a license manager which needs to be able to read the contents of the encrypted file, but ideally we don't want the client to have the ability to create their own encrypted license file.

  • 2
  • No, the public key will not enough. The client can work on the code and extract the keys.
    – kelalaka
    Nov 27, 2019 at 21:46
  • 2
    Could you use a digital signature to meet your goal? The server could sign the license using its private key, then the client could verify the signature using the server's public key. But, the client would not have the ability to sign licenses, being that the client does not have the server's private key.
    – mti2935
    Nov 27, 2019 at 22:17
  • 1
    @kelalaka Can you calculate a private key from a public key? If so, please publish the whitepaper.
    – user163495
    Nov 28, 2019 at 13:18
  • @MechMK1 My point is; the software running on the client machine therefore a dedicated hacker can extract everything. I'm not talking about breaking the public-key cryptosystem, I'm talking about reverse engineering.
    – kelalaka
    Nov 28, 2019 at 14:38

1 Answer 1


You are probably mistaking encrypting for signing!

Being able to decrypt something does not imply that the encrypted data comes from a trusted source, which is what you likely want from a licensing software.

Rather, what you should do is to sign the license key, and allow the client to verify the license. This can be done using public-key cryptography. Your server would contain the private key, with the ability to sign data, and your clients would contain the public key, with the ability to verify a signature.


... it should be noted that what you are trying to do is a DRM scheme, and theses schemes are impossible to do with any reasonable guarantee of security, at least if all the "interesting" bits happening on the client.

Your program, in essence, looks like this:


You can make this more complicated and throw some obfuscation at it, but it won't change the fundamental nature of the approach. And an attacker, eager to circumvent your licensing, will find a way to execute startTheCoolStuff() without a valid license.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .