3 ms·

If an adversary demands the key to decrypt a given ciphertext, what stops the sender or receiver from claiming that it was encrypted by a onetime pad (i.e., a b

If an adversary demands the key to decrypt a given ciphertext, what stops the sender or receiver from claiming that it was encrypted by a onetime pad (i.e., a bitwise exclusive-or with the encryption key) and then furnishing the "key" that "decrypts" it to some unrelated plaintext of his choice? Not to diminish the authors' work, but if this is the problem of deniable encryption, I don't get why it isn't trivial. Any advice?

theoh 8y ago
From the article: "When the communicating parties have common secret key, deniable encryption can be simple. For instance, the one-time pad (OTP) scheme is perfectly deniable: having sent c = k ⊕ m, the parties can claim that they sent any plaintext m0 by claiming that k0 = c ⊕ m0 is their true key. In fact, it turns out that the key size in any deniable encryption scheme has to be at least as large as the size of a plaintext (since there should exist a different key for any possible fake plaintext), and in this sense OTP is “the best possible” symmetric-key deniable encryption. But what if no pre-shared secret key is available? Is it possible to communicate fully deniably even in this case?"
- gradschool 8y ago
  It probably comes down to a question of specifying whether the treat model includes an adversary who can coerce both parties and check that their plaintexts agree. Otherwise, I wouldn't see any need for a shared secret key because the ciphertext can be encrypted by any method at all. The onetime pad is used only by the person under coercion and only for the purpose of misleading the adversary.
  - theoh 8y ago
    Yeah, they've got that covered too. The second paragraph of the paper says that they're working with the notion of "deniable encryption" introduced in a paper by Canetti et al: http://www.wisdom.weizmann.ac.il/~naor/PAPERS/deniable.pdf http://www.wisdom.weizmann.ac.il/~naor/PAPERS/deniable.pdf Here's the abstract of the Canetti paper: "Consider a situation in which the transmission of encrypted messages is intercepted by an adversary who can later ask the sender to reveal the random choices (and also the secret key, if one exists) used in generating the ciphertext, thereby exposing the cleartext. An encryption scheme is deniable if the sender can generate ‘fake random choices’ that will make the ciphertext ‘look like’ an encryption of a different cleartext, thus keeping the real cleartext private. Analogous requirements can be formulated with respect to attacking the receiver and with respect to attacking both parties. Deniable encryption has several applications: It can be incorporated in current protocols for incoercible (“receipt-free”) voting, in a way that eliminates the need for physically secure communication channels. It also underlies recent protocols for general incoercible multiparty computation (with no physical security assumptions). Deniable encryption also provides a simplified and elegant construction of an adaptively secure multiparty protocol. In this paper we introduce and define deniable encryption and propose constructions of such schemes. Our constructions, while demonstrating that deniability is obtainable in principle, achieve only a limited level of it. Whether they can be improved is an interesting open problem." I'm not sure how the paper under discussion relates to those applications, if at all. I'm not sure I buy the argument you appear to be making that a single principal can use a fake OTP to achieve deniability with any encryption scheme, but that this breaks down when both sender and receiver are coerced. If the fake plaintexts don't match it comes down to one person's word against another. The consequences of that scenario are outside the scope of "deniable encryption". It sounds a bit like a prisoner's dilemma situation. But the key defining feature of "deniable encryption" is of deniability within a specified encryption scheme.

theoh 8y ago

From the article: "When the communicating parties have common secret key, deniable encryption can be simple. For instance, the one-time pad (OTP) scheme is perfectly deniable: having sent c = k ⊕ m, the parties can claim that they sent any plaintext m0 by claiming that k0 = c ⊕ m0 is their true key. In fact, it turns out that the key size in any deniable encryption scheme has to be at least as large as the size of a plaintext (since there should exist a different key for any possible fake plaintext), and in this sense OTP is “the best possible” symmetric-key deniable encryption. But what if no pre-shared secret key is available? Is it possible to communicate fully deniably even in this case?"

gradschool 8y ago
It probably comes down to a question of specifying whether the treat model includes an adversary who can coerce both parties and check that their plaintexts agree. Otherwise, I wouldn't see any need for a shared secret key because the ciphertext can be encrypted by any method at all. The onetime pad is used only by the person under coercion and only for the purpose of misleading the adversary.
- theoh 8y ago
  Yeah, they've got that covered too. The second paragraph of the paper says that they're working with the notion of "deniable encryption" introduced in a paper by Canetti et al: http://www.wisdom.weizmann.ac.il/~naor/PAPERS/deniable.pdf http://www.wisdom.weizmann.ac.il/~naor/PAPERS/deniable.pdf Here's the abstract of the Canetti paper: "Consider a situation in which the transmission of encrypted messages is intercepted by an adversary who can later ask the sender to reveal the random choices (and also the secret key, if one exists) used in generating the ciphertext, thereby exposing the cleartext. An encryption scheme is deniable if the sender can generate ‘fake random choices’ that will make the ciphertext ‘look like’ an encryption of a different cleartext, thus keeping the real cleartext private. Analogous requirements can be formulated with respect to attacking the receiver and with respect to attacking both parties. Deniable encryption has several applications: It can be incorporated in current protocols for incoercible (“receipt-free”) voting, in a way that eliminates the need for physically secure communication channels. It also underlies recent protocols for general incoercible multiparty computation (with no physical security assumptions). Deniable encryption also provides a simplified and elegant construction of an adaptively secure multiparty protocol. In this paper we introduce and define deniable encryption and propose constructions of such schemes. Our constructions, while demonstrating that deniability is obtainable in principle, achieve only a limited level of it. Whether they can be improved is an interesting open problem." I'm not sure how the paper under discussion relates to those applications, if at all. I'm not sure I buy the argument you appear to be making that a single principal can use a fake OTP to achieve deniability with any encryption scheme, but that this breaks down when both sender and receiver are coerced. If the fake plaintexts don't match it comes down to one person's word against another. The consequences of that scenario are outside the scope of "deniable encryption". It sounds a bit like a prisoner's dilemma situation. But the key defining feature of "deniable encryption" is of deniability within a specified encryption scheme.