I recently came across the following idea, does anyone know a name and if it is used?

A wants to send B a message (A and B know both have a common secret key) and C wants to intercept it (without the knowledge of the key)

Now we assume they have an encryption method that lets you define two distinct messages for two distinct keys that both are encoded in the same cyphertext.

With this method A can send the secret message "It is raining tomorrow" encrypted with the secret key, but A can also include the message "it is not raining tomorrow" with another key.

If C manages to intercept the message and manages to find one or both of the keys, they still don't know anything, as there are two contradicting messages. But since B knows which key was used, they can use the correct message.

If such a method exists, wouldn't it be very secure, or are there any problems that come with it? The only problem I can think of is obviously the size of the cyphertext, and depending on the complexity of the messages you might have to find a lot of messages to completely "diffuse" the meaning.

  • 2
    $\begingroup$ In practice modern crypto is usually assumed to be secure in the first place and that keys are not recoverable and as such such a protocol would be considered a waste of space given that it linearly increases bandwith, time and storage complexity. $\endgroup$
    – SEJPM
    Commented Jan 18, 2017 at 18:25
  • 2
    $\begingroup$ Another way to look at it is that the real key is the knowledge as to which key is the real one. $\endgroup$
    – poncho
    Commented Jan 18, 2017 at 20:19

1 Answer 1


This functionality is usually called deniable encryption. It is feasible for (innocuous/incriminating) pairs of a few messages.


Deniable encryption makes it impossible to prove the existence of the plaintext message without the proper encryption key. This may be done by allowing an encrypted message to be decrypted to different sensible plaintexts, depending on the key used. This allows the sender to have plausible deniability if compelled to give up his or her encryption key. The notion of "deniable encryption" was used by Julian Assange and Ralf Weinmann in the Rubberhose filesystem and explored in detail in a paper by Ran Canetti, Cynthia Dwork, Moni Naor, and Rafail Ostrovsky in 1996.

There are related questions and answers, e.g., is-there-an-encryption-decryption-algorithm-that-can-give-two-different-outputs, and deniable-encryption-from-simple-primitives as well as a few others.

  • $\begingroup$ Has anyone actually implemented any of these deniable encryption schemes? $\endgroup$
    – Derek
    Commented Mar 9, 2017 at 2:02
  • $\begingroup$ you are right it already exist I have use different methods over an encryption that I took somewhere and I found different messages depending of the key or description technique $\endgroup$ Commented Feb 4 at 10:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.