# Is there a way to encrypt multiple sets of data into one result, with separate keys decrypting each set of data

What I am picturing is something like this:

Block A: "Hello, how are you today?"

Block B: "The weather reminds me of summer."

I encode this, giving me two keys and a resulting encrypted block e.g.

AP: 2da93742a7340ad12372aff
BP: 023cd97d40293d7c4027947
DATA: ksdjhfksdjhf0wddfg74059r7sdhdkfh


Whereas decrypting with AP would give me "Hello, how are you today?" and with BP would correspond to "The weather reminds me of summer.".

• Based on your tags it looks like you're trying to have one key bring out an innocuous message, while another keys bring out something more secret. Is that what you're trying to do? – Jeff Aug 14 '13 at 21:53
• Yes exactly. But having it be transparent so to speak. – jett Aug 15 '13 at 16:53
• You might also be interested in some of the history and discussion around TrueCrypt hidden volumes. The ability to return an innocuous message with a given key does not always remove suspicion that there is another message in the encrypted data. Deniability is complicated, be careful. truecrypt.org/docs/hidden-volume – Jeff Aug 16 '13 at 17:42

It is possible that you have some additional implicit constraints that invalidate the following solution. But as the question currently stands the following might give you what you are looking for:

Assume we have a authenticated symmetric encryption scheme. (Say encrypt-then-mac with a blockcipher in a suitable mode.)

We get our two messages $m_0,m_1$ and two keys $k_0,k_1$. To make things simpler, we assume that the messages have the same length and that our encryption scheme will output ciphertexts of the same length for inputs of the same length.

We encrypt $c_0 \leftarrow \mathsf{Enc}(k_0,m_0)$ and $c_1 \leftarrow \mathsf{Enc}(k_1,m_1)$. We then choose a random bit $b \in \{0,1\}$ and output the ciphertext $c=c_b\Vert c_{1-b}$.

To decrypt, given a key $k$ and a ciphertext $c$, we split $c$ into two halves, and try to decrypt each half. As the encryption scheme is authenticated, decryption will only be successful for the half actually encrypted under $k$ except with negligible probability. We then simply output this message.

The CPA security of this scheme easily reduces the the CPA security of the authenticated encryption scheme. If we need CCA security, it should be enough to add an additional MAC over the complete ciphertext with a third key, and include that third key as part of what you call AP and BP, i.e. the two keys.

The Security of the encryption scheme ensures that given one of the keys you can decrypt only exactly one of the messages. Furthermore, because the order of the ciphertexts is random, you cannot learn whether your key/message is the first or second one.