Deniable encryption
In
cryptography,
deniable encryption allows an encrypted message to decrypted to different sensible
plaintexts, depending on the
key used, or otherwise makes it impossible to prove the existence of the real message without the proper encryption key. This allows the sender to have
plausible deniability if compelled to give up his or her encryption key.
Deniable encryption allows the sender of an encrypted message to deny sending that message. This requires a trusted
third party. A possible scenario works like this:#
Alice sends a pre-chosen key to Bob and a different pre-chosen key to Trent, the trusted third party. The keys are constructed for the purposes of deniable encryption.#Alice constructs a
ciphertext (intended to be decrypted by a
one-time pad), such that Bob's key will decrypt a harmful message (e.g. instructions on how and when to rob a bank, while Alice tells the bank that someone will try to rob them) and such that Trent's key will decrypt it to a harmless message.#Alice sends the ciphertext to Bob, who tries to rob the bank and gets arrested.#Bob claims that Alice told him to rob the bank, but Alice denies this. To prove her innocence, she can send Trent the same ciphertext (Bob can verify that it is the same ciphertext Alice sent him) and Trent will decrypt it to the harmless message. Trent, being a disinterested third party, is above suspicion, so an adjudicator will believe him over Bob.
Another possible scenario involves Alice sending the same ciphertext to Bob and Carol, to whom she has sent different keys. Bob's key could decrypt the ciphertext to a claim that Carol has maligned Bob, and Carol's key could decrypt the ciphertext to a claim that Bob has maligned Carol. Under the assumption that neither Bob nor Carol can find out each other's keys, Alice's ruse would never be discovered. The same is true of the bank-robbing scenario, except that Bob would understand that Alice had tricked him somehow, but no one would believe him over Trent.
Most modern encryption systems make it almost impossible to construct a piece of ciphertext that can be decrypted more than one way.
A prototypical example of deniable encryption is the Rubberhose file system, designed from the ground up to make it possible to satisfy a compelling demand to reveal your encryption key, such as a court order, yet still keep your secret data a secret.
Software such as
BestCrypt approach the issue of deniable encryption in a slightly different way, by using the empty space of an encrypted partition, the software creates a "hidden" parttion that is only accessable via a different passphrase. In this way, the user can provide a valid passphrase that will decrypt a harmless looking partition that appears to consume the entire size of the container, when in reality, the encrypted data is still protected by the secondary encryption passphrase and hidden from view. Jetico, the creators of BestCrypt claim that there is no known way to tell whether one of their partitions has a hidden partition or not, creating a very practical form of deniable encryption.
Cryptography expert, Bruce Schneier, in his
18 April 2006 Weblog called for, "A deniable file system that fits on a USB token, and leaves no trace on the machine it's plugged into." See
Away RJN Professional.
*
FreeOTFE, opensource on-the-fly disk encryption for Windows that provides both deniable encryption and
plausible deniability (see its
documentation section on "Plausible Deniability"). Offers an extensive range of encryption options, and doesn't need to be installed before use.
*
Off-the-Record Messaging, a cryptographic technique providing true deniability for instant messaging.
*
PhoneBookFS, another cryptographic filesystem for Linux, providing plausible deniability through chaff and layers. A
FUSE implementation. No longer maintained.
*
rubberhose. Last version (alpha) released in 2000. Never released a Beta version. Not maintained. For the Linux 2.2 kernel which is also no longer supported by Linus Torvalds.
*
TrueCrypt, which is free open-source on-the-fly disk encryption software for Windows and Linux that
provides deniable encryption and
plausible deniability, and doesn't need to be installed before use.
*
StegFS, the current successor to the ideas embodied by the rubberhose and PhoneBookFS filesystems and in need of developers.
*
Away RJN Professional Combines Rijndael AES encryption algorithm, (256 bit block size) with CTR Counter mode and USB token type
deniable encryption.
*
Plausible deniability*
Rubber-hose cryptanalysis*
Steganography
