I am completely new to cryptography and am interested in encrypting two basic text strings into one encrypted text that can be accessed separately with two different keys (preferably using something easily accessible like 256bit AES). For example:

Text1= I like peanut butter

Key1= Password1

Text2= I'm allergic to peanut butter

Key2= Password2

Output: 5UniWN0MjkPvUbLImrQUP68W4tpwOBMp2nrDqV73xeY

This output is just Text1+Key1, but is there a way that I can get both to work simultaneously so if Key1 is used, Text1 is returned, but if Key2 is used, Text2 is returned?

From my understanding, this is called deniable encryption and I was wondering where I could find a generator.

Thanks so much in advance!


If you aren't concerned with integrity guarantees, one easy way of accomplishing this is via AES-CTR encryption. For a given ciphertext, decrypting with any AES key results in a valid plaintext.

That being said, you should be concerned with integrity guarantees. I'm not recommending deploying any crypto which does not meet standard security notions like IND-CCA2.

| improve this answer | |
  • 3
    $\begingroup$ As far as I can tell, AES-CTR does not allow deniable encryption as in the question. $\endgroup$ – fgrieu Aug 16 '17 at 21:15
  • $\begingroup$ I have been unable to find anything helpful so far $\endgroup$ – Munson Aug 16 '17 at 21:37
  • 1
    $\begingroup$ Sorry, I think I misunderstood what functionality you wanted. AES-CTR will decrypt correctly under different keys but there is no efficient algorithm to produce two keys that decrypt a ciphertext to chosen values. In fact, such an algorithm would (I think) imply an attack on AES. $\endgroup$ – pg1989 Aug 16 '17 at 22:01
  • $\begingroup$ Indeed, such a scheme requires ciphertext expansion and by design it is quite apparent when something is setup for deniable encryption. I believe this is one major reason DE is not used in the wild - deny all you want but when an immoral adversary uses rubber hose cryptanalysis they will find the second plaintext. $\endgroup$ – Thomas M. DuBuisson Aug 17 '17 at 5:21

Not the answer you're looking for? Browse other questions tagged or ask your own question.