Abstract: Differential work factor cryptographic method, system, and data structure for reducing but not eliminating the work factor required by an authority to break an encrypted message encrypted with a secret encryption key. The secret key is split into at least two partial keys such that knowledge of a first of the partial keys reduces but does not eliminate the work factor required to break the encrypted message. The first partial key is encrypted using a public key of the authority. The encrypted first partial key is provided with the encrypted message to enable the authority, upon obtaining the message, to decrypt the encrypted first partial key using the authority's private key and to break the message using the first partial key. In preferred embodiments, the first partial key is encrypted with additional information which can be reconstructed by the recipient, such as a hash of the secret encryption key, a hash of the secret key concatenated with a salt, all or part of the salt, and control information.