> deniable encryption [Canetti et al., Crypto’96] provides the additional guarantee that the plaintext remains secret even in face of authoritative entities tha

> deniable encryption [Canetti et al., Crypto’96] provides the additional guarantee that the plaintext remains secret even in face of authoritative entities that attempt to coerce (or bribe) communicating parties to expose their internal states, including the plaintexts, keys and randomness. To achieve this guarantee, deniable encryption is equipped with a faking algorithm which allows parties to generate fake keys and randomness that make the ciphertext appear consistent with any plaintext of the parties’ choice. Does the faking algorithm for the scheme proposed in the paper require any of the private information as input? In other words: given a ciphertext only, can I come up with keys and randomness to provide an arbitrary plaintext? OTP for example does have this property, I can just simply XOR the plaintext I want to have with the ciphertext and claim that this is the key. Edit: this question is relevant as if the private information is needed, it might limit your options once you do give them fake stuff. If some party can prove that the fake plaintext/key pair you gave them is indeed fake, then you should be able to walk back on your claims and say that you never had the plaintext or forgot the password or whatever.