13

OTR can provide forward secrecy because both partners create fresh ephemeral (one-time-use) keys, which are discarded afterwards, so they can't be recovered by later attackers. The long-term public keys are only used to authenticate them, to avoid any man-in-the-middle attack. For offline communication like e-mails this is not easily possible, since the ...


7

We need clear goals. The question asks for "plausible deniability" or "deniable encryption", and these terms needs a precise definition in a public-key context (implied by RSA). I assume that in addition to the IND-CPA and IND-CCA1 properties of a cipher, including hybrid (as implied by AES), it is desired that: One without the private key can't distinguish ...


6

It looks like you might be interested in applying Deniable Encryption. The general idea of this kind of encryption is that you can decrypt the data to produce a different (but still plausible) plaintext. In this way, the airport staff or whoever is asking you to decrypt the data, would by no means differentiate between the real plaintext and the ...


6

Here's a relatively complete list of the papers on deniable encryption (plus papers containing a lower bound against some type of deniable encryption): Deniable Encryption by Canetti/Dwork/Naor/Ostrovsky [CRYPTO 1997] Separating Random Oracle Proofs from Complexity Theoretic Proofs: The Non-committing Encryption Case by Nielsen [CRYPTO 2002] Lower and Upper ...


5

An important thing to note is that $\mathsf{P} = \mathsf{NP}$ would not fundamentally threaten cryptography - even theoretical cryptography. What it would imply, as mentioned by Meir Maor in his answer, is that there is no one-way function, which means essentially no "traditional" cryptography. However, one-way functions, and most of cryptography, are ...


4

If P=NP there are no one way functions, there are no trap door one way functions and essentially no cryptography. If P=NP it means verifying a key and finding the key are equally hard(Up to a polynomial reduction). So one time pads still work, they are information theoretically secure and don't rely on computational difficulty. But all encryption, ...


4

Is LUKS Anti-Forensic information splitter (AFsplit) indistinguishable from random data? No. AFSplitting is merely meant to provide diffusion, not cryptographically secure randomness. When you check the LUKS On-Disk Format Specification (eg PDF of v1.1.1) you'll notice it states LUKS uses anti-forensic information splitting as specified in [Fru05b]. ...


4

It is possible that you have some additional implicit constraints that invalidate the following solution. But as the question currently stands the following might give you what you are looking for: Assume we have a authenticated symmetric encryption scheme. (Say encrypt-then-mac with a blockcipher in a suitable mode.) We get our two messages $m_0,m_1$ and ...


4

This is possible, and it's called deniable encryption. The idea behind this type of encryption is that if you are required (e.g., under subpoena) to provide a key to decrypt your ciphertext, then you can provide an "alternative key" that decrypts it to something else. However, this is complex, and you cannot do it by hand. In general, it's difficult to do, ...


3

Note that the fact that a deniable encryption scheme has been used or at least is available for use is hard or even impossible to hide. Competent attackers observing the mathematical possibility of secondary plaintext will assume it has been used and will thus attempt to beat or persuade the second password out of you. So the situation regarding the ...


3

I understand the question as asking for a method such that: after step 3., we'll have a reasonably small password P2; deciphering MJ using P1 will give "Mocking Jay"; deciphering MJ using P2 will give "The Hobbit", or a meaningful extract of that, at least comparable in size to MJ; MJ is produced at step 2. without "The Hobbit" as input. By an entropy ...


2

Alice must send enough data for both Mocking Jay and The Hobbit. But there may be a plausible reason for all that data. Alice encrypts Mocking Jay using a method that produces ciphertext indistinguishable from random. Alice appends random data to that ciphertext to bring it to the length of The Hobbit (presumed at least as long as Mocking Jay). Alice sends ...


2

Deniable encryption should provide what you want. In a deniable encryption scheme, in addition to the usual $(\mathsf{KeyGen},\mathsf{Encrypt},\mathsf{Decrypt})$ algorithm, you have an algorithm $\mathsf{Explain}$ that takes as input a ciphertext $c$ (which can be any ciphertext) and a message $m$, and outputs a random coin $r$ such that the triple $(m,r,c)$ ...


2

The answer from the libsodium web site Only the recipient can decrypt these messages, using its private key. While the recipient can verify the integrity of the message, it cannot verify the identity of the sender. While Bob can decrypt the message and cannot verify the identity with his public and private key pair, there is no way the Eve can determine ...


1

A Carter-Wegman -style MAC gives you easy deniability when you use a one-time pad to encrypt the universal hash. You can compute a hash for your fake message and choose the key accordingly, just like you do with the one-time pad that you use to encrypt the message contents. This is actually available widely to programmers: NaCl has crypto_onetimeauth which ...


1

There are good reasons why this is hard to do by cryptography alone. Note that I am not saying the file-based systems are good solutions, I don't know enough about them. Symmetric Cryptography: Pairs of messages required to decrypt to different plaintexts under different key pairs introduce an equivalence relation on keys and weaken the cipher. Even ...


1

fgrieu addressed the entropy argument (hard to fit The Hobbit without expanding the input/output too much). I would like to point out following details: Extra data added in in compression etc. may still appear to to somebody analyzing the output (steganography) Asymmetric cryptography contains many bits that are random by the specification, for instance, ...


1

Well it makes the arguments about PFS stronger. If they would not frequently do a re-keying and securely erasing the old key (note that then they can not even read their own past messages anymore) an adversary that breaks either into Alices or Bobs computer and gets the shared secret can read and link all the previous communication between Alice and Bob. ...


1

In step 2 for Alice, what is the purpose of including Bob's public key in the hash? you can include a timestamp to prevent replay attacks instead. In step 2 for Bob, there is a typo - should use Alice's public key instead of her private key. Actually your protocol is similar to PGP, and I dont think it provides deniability because if Bob can prove that the ...


1

Have you considered using a one-time pad scheme if you really want plausible deniability? Each bit of the plaintext is XORed with a bit from the secret random pad. Even without the correct random pad or key, the ciphertext can be decrypted to all possible messages of the given length.


1

A one-time pad would meet your requirements, but is impractical. If the key length is much shorter than the message length, and the ciphertext length is not much longer than the plaintext length, it is known that the problem is unsolvable in practice. You might also be interested in non-committing encryption.


1

While the only other answer is correct in that it does not break Bob's deniability, I want to add a few things because this question was on the first page of search results. A variation of this attack is described in the paper Finite-State Security Analysis of OTR Version 2, section 3.2: "Attack on Strong Deniability": An outside attacker who has control ...


1

It’s of course doable. Please be referred to the paper “Honey Encryption: Security Beyond the Brute-Force Bound” by Ari Juels and Thomas Ristenpart (PDF) for more details.


Only top voted, non community-wiki answers of a minimum length are eligible