# Is there a name for an encryption scheme that do not return $\bot$ when a different key is used during decryption?

Given an encryption scheme $$\Pi = (G,E,D)$$, either public or private, is there a name or a property to emphasize that for $$c\gets \Pi.E(k,m)$$, where $$k$$ is a key and $$m$$ is a message, we want $$m^\prime \neq \bot$$ where $$m^\prime \gets \Pi.D(k^\prime, c)$$ with $$k\neq k^\prime$$? ($$\bot$$ here means empty)

Schemes such as Stream-Cipher (i.e., $$E(k,m) = G(k)\oplus m$$ with $$G$$ being a pseudorandom generator), RSA, ElGamal, etc. exhibit that property. At first, I thought it might be related to the notion of malleability, but a malleable encryption scheme allows one to compute a function $$f(m)$$ for a message $$m$$ given a ciphertext $$c$$ that encrypts $$m$$. Hence, it seems with malleable encryption, the same key is used.

• "RSA ... exhibit[s] that property"; actually, the Bleichenbacker attack on RSA PKCS #1 encryption can be viewed as exploiting the lack of that property - that is, it assumes that the attacker can distinguish a decryption that results in a padding failure (hence, $\bot$) and a decryption that results in something... Feb 2 at 4:27
• The definition of deniable encryption might be of relevance here.
– tylo
Feb 2 at 18:38