Patent ID: 7802096

Claim:
An apparatus to encrypt a payload, comprising: a session key generator configured to generate a session key; a hasher configured to generate a hash of the session key; a fallback key generator configured to generate one or more fallback keys, each fallback key configured to enable decryption of the payload; a payload encryptor configured to: encrypt the payload using the session key, and store in a file the encrypted payload; receive one or more user passwords, each user password configured to enable decryption of the payload; for each of the one or more user passwords: encrypt both the session key and the hash of the session key using the user password, and append to the file: the hash of the session key encrypted with the user password, and the session key encrypted with the user password; for each of the one or more fallback keys: encrypt both the session key and the hash of the session key using the fallback key, and append to the file: the hash of the session key encrypted with the fallback key, and the session key encrypted with the fallback key; upon receiving an indication that a decryption of the payload, using the one or more user passwords, was unsuccessful, provide one of the one or more fallback keys.