I have a file that is encrypted on the server with a private key. I need to transfer the file through a users phone to a device that does not have an internet connection. In order for the offline device to decrypt the file I need a way to send the private key securely. Is there a way to do this that does not blatantly expose the private key? I have full control of the server and offline device.

Update: The file on the server would ideally be encrypted before there is any communication with the offline device. The key used to encrypt/decrypt the file is not encrypted currently.

  • Does the offline device have openssl installed? If not, does it have a web browser installed, which can be used to load a locally stored web page?
    – mti2935
    Aug 30, 2023 at 22:02
  • Is the key encrypted ?
    – LvB
    Aug 30, 2023 at 22:02
  • You can use PBKDF2 to derive a key encryption key to encrypt the secret key that encrypts the file. Then send the encrypted file and key blob to the device.
    – defalt
    Aug 31, 2023 at 8:27
  • Can you create a private/public key pair on the offline device? If so, go ahead and share the private key with the server to have the server encrypt the secret with the public key.
    – not2savvy
    Aug 31, 2023 at 12:16
  • Using openssl on the offline device to create a private/public key pair that gets shared with the server to encrypt the server's private key might be our best option. I would prefer to complete all communication between the phone and server before interfacing with the offline device because the user might lose their data connection. This might be an unrealistic requirement for this all to work though.
    – GiantZOC
    Aug 31, 2023 at 20:50

1 Answer 1


Let us assume, for the moment, the phone is just being used as a USB-stick, rather than anything more clever.

  1. Generate a public/private key-pair on the offline device.
  2. Transfer the public key from the pair onto the phone from the offline device.
  3. Transfer the public key from the phone to the server.
  4. Generate a symmetric key on the server
  5. Encrypt the data file with the symmetric key
  6. Encrypt the symmetric key with the public key
  7. Transfer the encrypted symmetric key + data file from the server to the phone
  8. Transfer the encrypted symmetric key + data file from the phone to the offline device.
  9. Decrypt the symmetric key using the private key
  10. Decrypt the data file using the symmetric key

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .