0
$\begingroup$

Given an encryption scheme $\Pi = (G,E,D)$, either public or private, is there a name or a property to emphasize that for $c\gets \Pi.E(k,m)$, where $k$ is a key and $m$ is a message, we want $m^\prime \neq \bot$ where $m^\prime \gets \Pi.D(k^\prime, c)$ with $k\neq k^\prime$? ($\bot$ here means empty)

Schemes such as Stream-Cipher (i.e., $E(k,m) = G(k)\oplus m$ with $G$ being a pseudorandom generator), RSA, ElGamal, etc. exhibit that property. At first, I thought it might be related to the notion of malleability, but a malleable encryption scheme allows one to compute a function $f(m)$ for a message $m$ given a ciphertext $c$ that encrypts $m$. Hence, it seems with malleable encryption, the same key is used.

Improve this question
$\endgroup$
2
  • 3
    $\begingroup$ "RSA ... exhibit[s] that property"; actually, the Bleichenbacker attack on RSA PKCS #1 encryption can be viewed as exploiting the lack of that property - that is, it assumes that the attacker can distinguish a decryption that results in a padding failure (hence, $\bot$) and a decryption that results in something... $\endgroup$
    – poncho
    Commented Feb 2, 2023 at 4:27
  • $\begingroup$ The definition of deniable encryption might be of relevance here. $\endgroup$
    – tylo
    Commented Feb 2, 2023 at 18:38

1 Answer 1

Reset to default
1
$\begingroup$

If as you write "we want" this property, then I think the property is called key equivocation, which is supposed to make it harder for an attacker to distinguish the correct key from wrong ones.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.