Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
How can I determine how to do this if I want to require a particular passphrase for its decryption? Obviously, I don't want something simple like ROT. I want to use cascade ciphers to accomplish this, something like AES, Serpent or Twofish.
What's asked is not possible if we add three constraints:
Proof: suppose what's asked is possible with these three constraints. Using the same passphrase, encipher a variant of the menu to that local pizza place, in the same hypothetical method that gives the prescribed data rendering as the lyrics to Star Spangled Banner. The deciphering program of 1 has no way to decide which of the two menus it should output.
If we remove any of these constraints, what's asked is easy.
Argument for 1: Consider a decryption program that uses the help of an online server to retrieve the original text stored there, using the desired output as key.
Argument for 2: Consider a program that outputs the lyrics to Star Spangled Banner whenever the original text is a specific menu to a local pizza place, and otherwise performs as a normal encryption program; add a few easy technicalities.
Argument for 3: Consider an encryption program that accepts as additional input a text file with the desired output; and outputs a PDF or JPEG file that shows the text of that desired output, but contains in a comment field (not rendered by a PDF or JPEG viewer) the result of the encryption of the original text under the passphrase, per some standard encryption method. The decryption program will first extract the comment field, then use the standard decryption method. We can perfect the illusion by replacing the passphrase with the SHA-256 hash of the passphrase followed by the PDF or JPEG output file less its comment field.
There are countless ways to work around requirement 3; some even use a standard method modified in a detail. For example, with AES-CBC, it is easy to specially chose an IV such that a given 16-byte plaintext block enciphers to a given 16-byte ciphertext block under a given key, with no change to the decryption program. That's apparently how the idea illustrated in Angecryption started.
An entropy argument gives us a limit to how far we can go while meeting requirements 1 and 2: regardless of how clever we are in working around 3, the ciphertext is bound to be at least as big as we can losslessly compress the combination of the input and desired output, minus the entropy in the passphrase.
Since you tagged one time pads, I'll mention that this is easy to do with a OTP. It's just a matter of choosing the key letter that maps the plaintext letter to the desired ciphertext letter.
As a simple example, here's a small one I did with pencil and paper using NSA's DIANA reciprocal OTP system. I skipped spaces to make it easier.
Ciphertext: OHSAYCANYOUSEE
Key: ZSPSXUKYILMTRD
Here's the table I used
To decrypt it, look at the conversion table, find the key ketter on the left of the table, then find the ciphertext letter in its corresponding row. The letter below it is the plaintext. Repeat for each and you have the entire plaintext message.
If you wanted to use a specific passphrase, you could encrypt the key using that passphrase as a pad, provided it's the same length. Decryption would then be
Decrypt the key using the passphrase as a pad
Decrypt message using the key
Note that the security guarantees of the OTP system require random keys, so if your passphrase is not random, they will not apply, nor would I trust this as anything but a fun toy that keeps most casual attackers at bay.
