Is it possible to alter the contents of a plaintext message without altering the ciphertext? Altering the private key is allowed to accomplish this. If the answer is yes, how would I go about in doing this? Encryption strength is not particularly important.

  • 1
    $\begingroup$ You might want to look into message franking $\endgroup$
    – ambiso
    Commented Apr 29, 2021 at 6:54
  • $\begingroup$ Public key cryptography? $\endgroup$
    – forest
    Commented Apr 29, 2021 at 7:45
  • $\begingroup$ It can just be an encrypted message body with a private key that decrypts it. $\endgroup$
    – Jeff
    Commented Apr 29, 2021 at 8:41
  • $\begingroup$ Yes, the subject is called deniable encryption $\endgroup$
    – kelalaka
    Commented Apr 29, 2021 at 13:22
  • $\begingroup$ Interesting. Can deniable encryption be used to alter the contents of the message several days after the original ciphertext is posted? My only experience with deniable encryption is using full disk encryption software. $\endgroup$
    – Jeff
    Commented Apr 30, 2021 at 3:44

1 Answer 1


Yes, but typically not in any controlled way.

Essentially you're asking whether two different encryption parameterisations map to the same ciphertext space and that is precisely what most cryptosystems do.

Let's take AES-ECB as an example. Suppose that I have a key $k_0$ and a plaintext $P_0$ and a ciphertext $C=\mathrm{AES}_{\mathrm Enc}(k_0,P_0)$. Now I can pick any other key $k_1$ and compute $P_1\mathrm{AES}_{\mathrm Dec}(k_1,C)$ and lo and behold $C=\mathrm{AES}_{\mathrm Enc}(k_1,P_1)$. However $P_1$ is almost certainly gibberish. To try and control $P_1$ is to say I have a matched plain and cipher and want to find the corresponding key. This is intended to be hard.

To take a public key example, let's consider El Gamal on an arbitrary additive group $\langle G\rangle$. Pick a private key $a$ and public key $A=aG$ and off we go. For a plaintext message $M_0$ some one chooses a random $r$ and sends $(R,C)=(rG,rA+M_0)$. Now choose any other private key $b$ which would have corresponding public key $B=bG$ and we decrypt $(R,C)$ using this key to get $C-rB$ which we call $M_1$. Note that $M_1=M_0+r(B-A)$ so to select $M_1$ I need to know $r$ which would involve solving a discrete logarithm.

There is one cryptosystem where the alternative plaintext can be pretty much completely specified and that is the one-time pad. It's a straightforward exercise to show that any OTP cryptogram can be written as any plaintext message of the same length enciphered with a different OTP which differs from the original OTP by the difference of the messages.

  • $\begingroup$ Interesting answer. With regards to your first three paragraphs, this is my understanding of public key cryptography as well. However, I suspect someone is doing what you described in the last paragraph using thedecryptor.com. They are posting football match scores in ciphertext several days before the results are known. Then after the result is publicly known, they post the key to decrypt the message. The ciphertext is never altered. Therefore I suspect the key is being altered. However if I try to alter the private key in my own encrypted messages, I receive an error. $\endgroup$
    – Jeff
    Commented Apr 30, 2021 at 3:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.