Hello i am developing an app that collects some private data from my clients. My clients wont like it if i am able to read the data. So the data is encrypted in cleint side with a key say "xyz",which is auto generated when client install the app/make a account and only with this key can someone read this data. Now when the client login from a new device i want the client to generate the key, and use it to retrieve the data . How do i do that? I cant save xyz in server since then i will have both key and encrypted data, I cant generate xyz with password or User details since i will have them and i knows how to create the key from that data

Is there a way to achieve this without saying to client Trust me am truest worthy. Or make your own key!?


1 Answer 1


The usual way is to use a two-level key.

You encrypt the data with key_data, which should probably be a symmetric key.

You keep a separate key-file where key_data is encrypted with the key from the devices (key_dev1, key_dev2, ...)

You do not know the key_data; it must be generated by the first access. You also do not know the key_dev1,... because they are on the device of the client.

The client can decrypt the key_data with an existing device, and pass it to a new device which encrypts it with its new device key before uploading it to your key-file.

Of course, something needs to be done with key management by your client; you may want to facilitate this. Be careful that you never get the decrypted key_data on your devices though. enter image description here

  • thank you its still confusing but thanks a lot for your help
    – Genzo
    Oct 14, 2020 at 8:23
  • Maybe the picture helps. Oct 15, 2020 at 7:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.