5
$\begingroup$

I recently came across following idea, does anyone know a name and if it is actually used?

A wants to send B a message (A and B know both have a common secret key) and C wants to intercept it (without the knowledge of the key)

Now we assume they have an encryption method that let's you define two distinct messages for two distinct keys that both are encoded in the same cyphertext.

With this method A can send the secret message "it is raining tomorrow" encrypted with the secret key, but A can also include the message "it is not raining tomorrow" with another key.

If C manages to intercept the message and manages to find one or both of the keys, they still don't know anything, as there are two contradicting messages. But since B knows which key was used, they can use the correct message.

If such an method exists, wouldn't it very secure, or are there any problems that come with it? The only problem I can think of is obiously the size of the cyphertext, and depending on the complexity of the messages you might have to find a lot of messages to completely "diffuse" the meaning.

Sorry for the probably not very fitting tags, I did not find any better ones, as this is just a relativel vague question.

Improve this question
$\endgroup$
2
  • 2
    $\begingroup$ In practice modern crypto is usually assumed to be secure in the first place and that keys are not recoverable and as such such a protocol would be considered a waste of space given that it linearly increases bandwith, time and storage complexity. $\endgroup$
    – SEJPM
    Jan 18, 2017 at 18:25
  • 2
    $\begingroup$ Another way to look at it is that the real key is the knowledge as to which key is the real one. $\endgroup$
    – poncho
    Jan 18, 2017 at 20:19

1 Answer 1

Reset to default
5
$\begingroup$

This functionality is usually called deniable encryption. It is feasible for (innocuous/incriminating) pairs of a few messages.

Wikipedia:

Deniable encryption makes it impossible to prove the existence of the plaintext message without the proper encryption key. This may be done by allowing an encrypted message to be decrypted to different sensible plaintexts, depending on the key used. This allows the sender to have plausible deniability if compelled to give up his or her encryption key. The notion of "deniable encryption" was used by Julian Assange and Ralf Weinmann in the Rubberhose filesystem and explored in detail in a paper by Ran Canetti, Cynthia Dwork, Moni Naor, and Rafail Ostrovsky in 1996.

There are related questions and answers, e.g., is-there-an-encryption-decryption-algorithm-that-can-give-two-different-outputs, and deniable-encryption-from-simple-primitives as well as a few others.

Improve this answer
$\endgroup$
1
  • $\begingroup$ Has anyone actually implemented any of these deniable encryption schemes? $\endgroup$
    – Derek
    Mar 9, 2017 at 2:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.