Abstract. Consider a situation in which the transmission of encrypted messages is intercepted by an adversary who can later ask the sender to reveal the random choices (and also the secret key, if one exists) used in generating the ciphertext, thereby exposing the cleartext. An encryption scheme is deniable if the sender can generate`fake random choices' that will make the ciphertext`look like' an encryption of a di erent cleartext, thus keeping the real cleartext private. Analogous requirements can be formulated with respect to attacking the receiver and with respect to attacking both parties. Deniable encryption has several applications: It can be incorporated in current protocols for incoercible (\receipt-free") voting, in a way that eliminates the need for physically secure communication channels. It also underlies recent protocols for general incoercible multiparty computation (with no physical security assumptions). Deniable encryption also provides a simpli ed and elegant construction of an adaptively secure multiparty protocol. In this paper we introduce and de ne deniable encryption and propose constructions of such schemes. Our constructions, while demonstrating that deniability is obtainable in principle, achieve only a limited level of it. Whether they can be improved is an interesting open problem.
A much stronger primitive, deniable encryption REF considers encryption schemes that can survive the later compromise of an encrypting device.
Deniable Encryption
CRYPTO
Computer Science