I stumbled on the concept of Deniable encryption on Wikipedia, with the following scenario:
Deniable encryption allows the sender of an encrypted message to deny sending that message. This requires a trusted third party. A possible scenario works like this:
- Bob suspects his wife Alice is engaged in adultery. That being the case, Alice wants to communicate with her secret lover Carl. She creates two keys, one intended to be kept secret, the other intended to be sacrificed. She passes the secret key (or both) to Carl.
- Alice constructs an innocuous message M1 for Carl (intended to be revealed to Bob in case of discovery) and an incriminating love letter M2 to Carl. She constructs a cipher-text C out of both messages M1, M2 and emails it to Carl.
- Carl uses his key to decrypt M2 (and possibly M1, in order to read the fake message, too).
- Bob finds out about the email to Carl, becomes suspicious and forces Alice to decrypt the message.
- Alice uses the sacrificial key and reveals the innocuous message M1 to Bob. Since Bob does not know about the other key, he might assume there is no message M2.
I would like to have examples of ciphers providing this property. The Wikipedia page only gives softwares like filesystems.