Retained-Key Encryption

Abstract

This paper presents a synchronous encryption key management model that does not require the sender to disclose the encryption key in order to effect decryption. This eliminates the need for key exchange mechanisms, giving the sender improved control over their keys. The retained-key model is presented as being a software application that handles the initiation of a secure communication channel between sender and receiver, and facilitates user authentication by a trusted third party—presumably, the software’s vendor. This model is not intended to replace public/private key-based mechanisms, as they serve an important role in message signing and authentication. Rather, it seeks to provide an alternative means of decrypting messages in a secure fashion while allowing the sender to avoid the need to disclose the message’s key.