# Decrypt the same ciphertext to multiple messages of my choice if I can use any key I want to decrypt

In a modern secure encryption scheme, is it possible(both theoretically and practically) to encrypt a message using a key to get the following ciphertext c = Enc(M1,k1) and later find another key so that a different message of my choice gets encrypted to the same ciphertext c = Enc(M2,k2)?

• Yes, this is possible. It goes by the name of "Deniable Encryption", and was introduced in this paper. I am not up to date on the relevant literature, so cannot survey the current state of the art (hence why this is a comment). – Mark Mar 5 at 3:40
• – kelalaka Mar 5 at 7:29
• Are we in the symmetric-key or the public-key setting? – Occams_Trimmer Mar 8 at 16:53
• In the symmetric-key setting this is easy to achieve. E.g., doesn't the one-time pad satisfies this property? In general, XOR-based stream ciphers (i.e., ones which take the message and XORs with a pseudo-random steam) satisfy this property. This is, in fact, used in protocols like TextSecure and Off-the-Record Messaging. You can read more here and here. – Occams_Trimmer Mar 8 at 21:52
• "[...] the public key is known to everyone and this might make it impossible to change the secret key". True, therefore one needs to take the randomness used to encrypt in account. That is, given a ciphertext $c=E_{pk}(m;r)$ can one find $m'$ and $r'$ such that $c=E_{pk}(m;r)$ (let's focus on a single public key for now)? Such \$(m',r') exists for example in El Gamal encryption, but are not necessarily easy to find. This is where deniable encryption (a Mark points out) comes in. These are far from practical though. – Occams_Trimmer Mar 8 at 22:03