Deniable encryption

Deniable encryption makes it impossible to prove the origin or existence of the plaintext message without the proper decryption key. This may be done by allowing an encrypted message to be decrypted to different sensible plaintexts, depending on the key used. This allows the sender to have plausible deniability if compelled to give up their encryption key. Scenario In some jurisdictions, statutes assume that human operators have access to such things as encryption keys, and governments may enact key disclosure laws that compel individuals to relinquish keys upon request. Countries such as France and Australia give prosecutors wide-ranging power to compel any person to surrender keys to make available any information encountered in the course of an investigation, and failure to comply incurs jail time and/or civil fines. Another example is the United Kingdom's Regulation of Investigatory Powers Act, which makes it a crime not to surrender encryption keys on demand from a government official authorized by the act. According to the Home Office, the burden of proof that an accused person is in possession of a key rests on the prosecution; moreover, the act contains a defense for operators who have lost or forgotten a key, and they are not liable if they are judged to have done what they can to recover a key. In cryptography, rubber-hose cryptanalysis is a euphemism for the extraction of cryptographic secrets (e.g. the password to an encrypted file) from a person by coercion or torture⁠‌such as beating that person with a rubber hose, hence the ‌in contrast to a mathematical or technical cryptanalytic attack. An early use of the term was on the sci.crypt newsgroup, in a message posted 16 October 1990 by Marcus J. Ranum, alluding to corporal punishment:[...]the rubber-hose technique of cryptanalysis (in which a rubber hose is applied forcefully and frequently to the soles of the feet until the key to the cryptosystem is discovered, a process that can take a surprisingly short time and is quite computationally inexpensive). Such methods are also euphemistically referred to as "wrench attacks", in reference to an xkcd comic with a similar premise. Deniable encryption allows the sender of an encrypted message to deny sending that message. A possible scenario works like this: • Alice wishes to send a message to Bob but is aware that she may be compelled to decrypt the message for a third party. • Alice uses key 1 (K1) to encrypt a harmless message (M1) into a ciphertext (C). She also uses key 2 (K2) to encrypt a second, secret message (M2) within the same ciphertext for Bob. • If Alice is coerced, through legal or illegal means, into decrypting the ciphertext C, she can provide K1 to reveal the harmless message M1 without disclosing the existence of M2. This approach relies on the attacker being satisfied with the contents of M1. If M1 appears trivial or unconvincing, the attacker may suspect the existence of additional keys and messages and continue to apply pressure. The existence of deniable encryption introduces a paradoxical limitation. Because an attacker can never be certain that a given ciphertext contains only a single key–message pair, they may continue to demand further keys even after one has been revealed. This is particularly problematic in scenarios involving coercion, such as Rubber-hose cryptanalysis, where additional keys and messages may be demanded regardless of whether they actually exist. Another scenario involves Alice sending the same ciphertext (some secret instructions) to Bob and Carl, to whom she has handed different keys. Bob and Carl are to receive different instructions and must not be able to read each other's instructions. Bob will receive the message first and then forward it to Carl. • Alice constructs the ciphertext out of both messages, M1 and M2, and emails it to Bob. • Bob uses his key to decrypt M1 and isn't able to read M2. • Bob forwards the ciphertext to Carl. • Carl uses his key to decrypt M2 and isn't able to read M1. ==Forms of deniable encryption==