What I am picturing is something like this:

Block A: "Hello, how are you today?"

Block B: "The weather reminds me of summer."

I encode this, giving me two keys and a resulting encrypted block e.g.

AP: 2da93742a7340ad12372aff
BP: 023cd97d40293d7c4027947
DATA: ksdjhfksdjhf0wddfg74059r7sdhdkfh

Whereas decrypting with AP would give me "Hello, how are you today?" and with BP would correspond to "The weather reminds me of summer.".

  • $\begingroup$ Based on your tags it looks like you're trying to have one key bring out an innocuous message, while another keys bring out something more secret. Is that what you're trying to do? $\endgroup$
    – Jeff
    Commented Aug 14, 2013 at 21:53
  • $\begingroup$ Yes exactly. But having it be transparent so to speak. $\endgroup$
    – jett
    Commented Aug 15, 2013 at 16:53
  • 2
    $\begingroup$ You might also be interested in some of the history and discussion around TrueCrypt hidden volumes. The ability to return an innocuous message with a given key does not always remove suspicion that there is another message in the encrypted data. Deniability is complicated, be careful. truecrypt.org/docs/hidden-volume $\endgroup$
    – Jeff
    Commented Aug 16, 2013 at 17:42

2 Answers 2


It is possible that you have some additional implicit constraints that invalidate the following solution. But as the question currently stands the following might give you what you are looking for:

Assume we have a authenticated symmetric encryption scheme. (Say encrypt-then-mac with a blockcipher in a suitable mode.)

We get our two messages $m_0,m_1$ and two keys $k_0,k_1$. To make things simpler, we assume that the messages have the same length and that our encryption scheme will output ciphertexts of the same length for inputs of the same length.

We encrypt $c_0 \leftarrow \mathsf{Enc}(k_0,m_0)$ and $c_1 \leftarrow \mathsf{Enc}(k_1,m_1)$. We then choose a random bit $b \in \{0,1\}$ and output the ciphertext $c=c_b\Vert c_{1-b}$.

To decrypt, given a key $k$ and a ciphertext $c$, we split $c$ into two halves, and try to decrypt each half. As the encryption scheme is authenticated, decryption will only be successful for the half actually encrypted under $k$ except with negligible probability. We then simply output this message.

The CPA security of this scheme easily reduces the the CPA security of the authenticated encryption scheme. If we need CCA security, it should be enough to add an additional MAC over the complete ciphertext with a third key, and include that third key as part of what you call AP and BP, i.e. the two keys.

The Security of the encryption scheme ensures that given one of the keys you can decrypt only exactly one of the messages. Furthermore, because the order of the ciphertexts is random, you cannot learn whether your key/message is the first or second one.


A one-time pad would meet your requirements, but is impractical.

If the key length is much shorter than the message length, and the ciphertext length is not much longer than the plaintext length, it is known that the problem is unsolvable in practice.

You might also be interested in non-committing encryption.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.