->They could use mcrypt with AES 256 CBC, store the encrypted data along with the IV, then upon the need of decryption , ask for the key to complete the process.
Encrypting with a separate key from the decryption key is called "public key cryptography" (RSA, etc; not AES) and it's a reasonable...