Sending secure communications using a local ephemeral key pool

A system comprising:

• an interface configured to transmit a request to a first server for a first user's profile information, receive a response from the first server that comprises the first user's profile information, transmit a first encrypted communication, a key identifier, and an encrypted first encryption key to the first user, and receive a second encrypted communication from the first user;
• a processor configured to generate a first encryption key, derive a key-encrypting key based on a first ephemeral public key and an application identifier associated with the first user's profile, encrypt a first communication using the first encryption key to generate the first encrypted communication, encrypt the first encryption key using the key-encrypting key to generate the encrypted first encryption key to generate the first encrypted communication, and decrypt the second encrypted communication to generate a decrypted second communication, wherein the application identifier is a random identifier generated by a secure communication application on the first device and that identifies the first device and the secure communication application to the first server;
• and
• a memory configured to store the first user's profile information, a first plurality of private keys and identifiers, and a second plurality of public keys and identifiers.

A non-transitory computer-readable medium comprising instructions that when, executed by at least one processor, perform the steps of:

• transmitting a request for a first user profile to a first server;
• determining whether a response to the request has been received from the first server;
• retrieving information for the first user from a storage on a first device when no response has been received from the first server, wherein the information comprises a first ephemeral public key and a key identifier;
• generating a first encryption key;
• deriving a key-encrypting key using the first ephemeral public key and an application identifier associated with the first user profile, wherein the application identifier is a random identifier generated by a secure communication application on the first device and identifies the first device and the secure communication application to the first server;
• encrypting a first communication to the first user using the first encryption key to generate a first encrypted communication;
• encrypting the first encryption key using the key-encrypting key;
• and
• transmitting the first encrypted communication, the key identifier, and the encrypted first encryption key to the first user.