From the paper: > To address this issue, Canetti et al. introduced the notion of deniable encryption, in which a party may send a ciphertext c which is an encr

From the paper: > To address this issue, Canetti et al. introduced the notion of deniable encryption, in which a party may send a ciphertext c which is an encryption of message m, and later, for any plaintext m2!=m, the party can reveal fake keys and randomness with respect to which c appears to be an encryption of m2 This is only really possible if your key is as big as m2, which in practise for many applications it would not be.