I am completely new to cryptography and am interested in encrypting two basic text strings into one encrypted text that can be accessed separately with two different keys (preferably using something easily accessible like 256bit AES). For example:

Text1= I like peanut butter

Key1= Password1

Text2= I'm allergic to peanut butter

Key2= Password2

Output: 5UniWN0MjkPvUbLImrQUP68W4tpwOBMp2nrDqV73xeY

This output is just Text1+Key1, but is there a way that I can get both to work simultaneously so if Key1 is used, Text1 is returned, but if Key2 is used, Text2 is returned?

From my understanding, this is called deniable encryption and I was wondering where I could find a generator.

Thanks so much in advance!


1 Answer 1


If you aren't concerned with integrity guarantees, one easy way of accomplishing this is via AES-CTR encryption. For a given ciphertext, decrypting with any AES key results in a valid plaintext.

That being said, you should be concerned with integrity guarantees. I'm not recommending deploying any crypto which does not meet standard security notions like IND-CCA2.

  • 3
    $\begingroup$ As far as I can tell, AES-CTR does not allow deniable encryption as in the question. $\endgroup$
    – fgrieu
    Commented Aug 16, 2017 at 21:15
  • $\begingroup$ I have been unable to find anything helpful so far $\endgroup$
    – Munson
    Commented Aug 16, 2017 at 21:37
  • 1
    $\begingroup$ Sorry, I think I misunderstood what functionality you wanted. AES-CTR will decrypt correctly under different keys but there is no efficient algorithm to produce two keys that decrypt a ciphertext to chosen values. In fact, such an algorithm would (I think) imply an attack on AES. $\endgroup$
    – pg1989
    Commented Aug 16, 2017 at 22:01
  • $\begingroup$ Indeed, such a scheme requires ciphertext expansion and by design it is quite apparent when something is setup for deniable encryption. I believe this is one major reason DE is not used in the wild - deny all you want but when an immoral adversary uses rubber hose cryptanalysis they will find the second plaintext. $\endgroup$ Commented Aug 17, 2017 at 5:21

Not the answer you're looking for? Browse other questions tagged or ask your own question.