Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

What I am picturing is something like this:

Block A: "Hello, how are you today?"

Block B: "The weather reminds me of summer."

I encode this, giving me two keys and a resulting encrypted block e.g.

AP: 2da93742a7340ad12372aff
BP: 023cd97d40293d7c4027947
DATA: ksdjhfksdjhf0wddfg74059r7sdhdkfh

Whereas decrypting with AP would give me "Hello, how are you today?" and with BP would correspond to "The weather reminds me of summer.".

share|improve this question
    
Based on your tags it looks like you're trying to have one key bring out an innocuous message, while another keys bring out something more secret. Is that what you're trying to do? –  Jeff Aug 14 '13 at 21:53
    
Yes exactly. But having it be transparent so to speak. –  jett Aug 15 '13 at 16:53
2  
You might also be interested in some of the history and discussion around TrueCrypt hidden volumes. The ability to return an innocuous message with a given key does not always remove suspicion that there is another message in the encrypted data. Deniability is complicated, be careful. truecrypt.org/docs/hidden-volume –  Jeff Aug 16 '13 at 17:42
add comment

2 Answers

up vote 4 down vote accepted

It is possible that you have some additional implicit constraints that invalidate the following solution. But as the question currently stands the following might give you what you are looking for:

Assume we have a authenticated symmetric encryption scheme. (Say encrypt-then-mac with a blockcipher in a suitable mode.)

We get our two messages $m_0,m_1$ and two keys $k_0,k_1$. To make things simpler, we assume that the messages have the same length and that our encryption scheme will output ciphertexts of the same length for inputs of the same length.

We encrypt $c_0 \leftarrow \mathsf{Enc}(k_0,m_0)$ and $c_1 \leftarrow \mathsf{Enc}(k_1,m_1)$. We then choose a random bit $b \in \{0,1\}$ and output the ciphertext $c=c_b\Vert c_{1-b}$.

To decrypt, given a key $k$ and a ciphertext $c$, we split $c$ into two halves, and try to decrypt each half. As the encryption scheme is authenticated, decryption will only be successful for the half actually encrypted under $k$ except with negligible probability. We then simply output this message.

The CPA security of this scheme easily reduces the the CPA security of the authenticated encryption scheme. If we need CCA security, it should be enough to add an additional MAC over the complete ciphertext with a third key, and include that third key as part of what you call AP and BP, i.e. the two keys.

The Security of the encryption scheme ensures that given one of the keys you can decrypt only exactly one of the messages. Furthermore, because the order of the ciphertexts is random, you cannot learn whether your key/message is the first or second one.

share|improve this answer
add comment

A one-time pad would meet your requirements, but is impractical.

If the key length is much shorter than the message length, and the ciphertext length is not much longer than the plaintext length, it is known that the problem is unsolvable in practice.

You might also be interested in non-committing encryption.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.