Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

On the Impossibility of Sender-Deniable Public Key Encryption.

Dana Dachman-Soled

Published Jan 1, 2012• 4 citations
OpenAlex

Abstract

Abstract. The primitive of deniable encryption was first introduced by Canetti et al. (CRYPTO, 1997). Deniable encryption is a regular public key encryption scheme with the added feature that after running the protocol honestly and transmitting a message m, both Sender and Receiver may produce random coins showing that the transmitted ciphertext was an encryption of any message m ′ in the message space. Deniable encryption is a key tool for constructing incoercible protocols, since it allows a party to send one message and later provide apparent evidence to a coercer that a different message was sent. In addition, deniable encryption may be used to obtain adaptively-secure multiparty computation (MPC) protocols and is secure under selective-opening attacks. Different flavors such as sender-deniable and receiver-deniable encryption, where only the Sender or Receiver can produce fake random coins, have been considered. Recently, several open questions regarding the feasibility of deniable encryption have been resolved (c.f. (O’Neill et al., CRYPTO, 2011), (Bendlin et al., ASIACRYPT, 2011)). A fundamental remaining open question is whether it is possible to construct sender-deniable Encryption Schemes with super-polynomial security, where an adversary has negligible advantage in distinguishing real and fake openings. The primitive of simulatable public key encryption (PKE), introduced by Damg˚ard and Nielsen (CRYPTO, 2000), is a public key encryption scheme with additional properties that allow oblivious sampling of public keys and

Related papers

Lower and Upper Bounds for Deniable Public-Key Encryption.

Rikke Bendlin, Jesper Buus Nielsen, Peter Sebastian Nordholt +1 more

Abstract. A deniable cryptosystem allows a sender and a receiver to communicate over an insecure channel in such a way that the communication is still secure even if the adversary can threaten the parties into revealing their internal states after the execution of the protocol. This is done by allowing the parties to change their internal state to make it look like a given ciphertext decrypts to a message di erent from what it really decrypts to. Deniable encryption was in this way introduced to allow to deny a message exchange and hence combat coercion. Depending on which parties can be coerced, the security level, the avor and the number of rounds of the cryptosystem, it is possible to de ne a number of notions of deniable encryption. In this paper we prove that there does not exist any non-interactive receiver-deniable cryptosystem with better than polynomial security. This also shows that it is impossible to construct a non-interactive bi-deniable public-key encryption scheme with better than polynomial security. Speci cally, we give an explicit bound relating the security of the scheme to how e cient the scheme is in terms of key size. Our impossibility result establishes a lower bound on the security. As a nal contribution we give constructions of deniable public-key encryption schemes which establishes upper bounds on the security in terms of key length. There is a gap between our lower and upper bounds, which leaves the interesting open problem of nding the tight bounds. 1

•Jan 1, 2011•0 citations

Hybrid deniable and short-key encryption protocols based on the authentication procedure

Tan Sy Ho, Alexander Andreevich Moldovyan, Moldovyan Nikolay Andreevich +5 more

To ensure resistance to attacks with coercion to disclose a secret key by an active adversary, the protocol of deniable encryption includes a procedure for mutual authentication of the sender and receiver of a message with their long-term public keys, which is combined with a hidden exchange of single-use public keys used to generate a single-use shared key, on which the secret message is encrypted. Longterm public keys are used to generate a shared secret key, on which a fake message is encrypted. The produced intermediate ciphertexts are converted into a single ciphertext, which is computationally indistinguishable from the ciphertext obtained by probabilistic encryption of a fake message. This approach allows us to build an encryption protocol that is resistant to bi-sided attacks with coercion, since the disclosure of users' private keys gives access only to the fake message and cannot be used to prove the possibility of alternative decryption of the ciphertext transmitted over a public communication channel. The authentication of the single-use public keys is also used to implement protocols for secure encryption using short shared keys.

International Conference on Advanced Computing and Applications (ACOMP)•Nov 1, 2020•1 citation

No-Key Protocol for Deniable Encryption

Nam Hai Nguyen, Nikolay Andreevich Moldovyan, A.V. Shcherbacov +2 more

There is proposed a new method for deniable encryption based on commutative transformations. The method has been used to design the deniable encryption protocol resistant to the passive coercive attacks, which uses no pre-shared secret keys and no pre-exchanged public keys. The protocol begins with the stage at which the sender and receiver exchange their single-use public keys and compute the single-use shared secret key. Then, it is performed pseudo-probabilistic three-pass protocol with simultaneous commutative encryption of the fake and secret messages. Resistance of the proposed protocol to coercive attacks is provided by its computational indistinguishability from probabilistic no-key three-pass protocol used to send securely the fake message. To perform commutative encryption, it used exponentiation cipher. To provide security against active coercer, the protocol is to be complemented with procedure for authenticating the sent messages.

Advances in intelligent systems and computing•Jan 1, 2018•7 citations

Receiver‐ and sender‐deniable functional encryption

Angelo De, Vincenzo Iovino, Adam O’Neill

Deniable encryption, first introduced by Canetti et al . 1997, allows equivocation of encrypted communication. In this work, the authors generalise its study to functional encryption (FE). The authors’ results are summarised as follows: They first put forward and motivate the concept of receiver‐deniable FE, for which they consider two models. In the first model, as previously considered by O'Neill et al . 2011 in the case of identity‐based encryption, a receiver gets assistance from the master authority to generate a fake secret key. In the second model, there are ‘normal’ and ‘deniable’ secret keys, and a receiver in possession of a deniable secret key can produce a fake but authentic‐looking normal key on its own. In the first model, they show a compiler from any FE scheme for circuits to a FE scheme having receiver deniability. In addition, they show an efficient receiver‐deniable FE scheme for Boolean formulae from bilinear maps. In the second (multi‐distributional) model, they present a specific FE scheme for circuits having receiver deniability. To the authors’ knowledge, a scheme in the multi‐distributional model was not previously known even for the special case of identity‐based encryption. Finally, they construct the first sender (non‐multi‐distributional) deniable FE scheme.

IET Information Security•May 15, 2017•4 citations

Bi-Deniable Inner Product Encryption from LWE.

Daniel Apon, Xiong Fan, Feng-Hao Liu

Deniable encryption (Canetti et al. CRYPTO ’97) is an intriguing primitive that provides a security guarantee against not only eavesdropping attacks as required by semantic security, but also stronger coercion attacks performed after the fact. The concept of deniability has later demonstrated useful and powerful in many other contexts, such as leakage resilience, adaptive security of protocols, and security against selective opening attacks. Despite its conceptual usefulness, our understanding of how to construct deniable primitives under standard assumptions is restricted. In particular, from standard assumptions such as Learning with Errors (LWE), we have only multi-distributional or non-negligible advantage deniable encryption schemes, whereas with the much stronger assumption of indistinguishable obfuscation, we can obtain at least fully-secure sender-deniable PKE and computation. How to achieve deniability for other more advanced encryption schemes under standard assumptions remains an interesting open question. In this work, we construct a bi-deniable inner product encryption (IPE) in the multi-distributional model without relying on obfuscation as a black box. Our techniques involve new ways of manipulating Gaussian noise, and lead to a significantly tighter analysis of noise growth in Dual Regev type encryption schemes. We hope these ideas can give insight into achieving deniability and related properties for further, advanced cryptographic constructions under standard assumptions.

•Jan 1, 2015•10 citations

Universal Encrypted Deniable Authentication Protocol.

Zhenfu Cao

The notion of deniable authentication protocol was introduced in 1998 by Dwork et al. [11] and Aumann and Rabin [1, 2] independently. As a new cryptographic authentication protocol, a deniable authentication protocol enables an intended receiver to identify the source of a given message without being able to prove the identity of the sender to a third party. Over the past years, many deniable authentication protocols have been proposed. In this paper, we would like to present a universal encrypted deniable authentication protocol from any public key encryption scheme. Provided that the public key encryption scheme is secure, a secure deniable authentication protocol can be directly derived.

International journal of network security•Jan 1, 2009•3 citations
Abstract. The primitive of deniable encryption was first introduced by Canetti et al. (CRYPTO, 1997). Deniable encryption is a regular public key encryption scheme with the added feature that after running the protocol honestly and transmitting a message m, both Sender and Receiver may produce random coins showing that the transmitted ciphertext was an encryption of any message m ′ in the message space. Deniable encryption is a key tool for constructing incoercible protocols, since it allows a party to send one message and later provide apparent evidence to a coercer that a different message was sent. In addition, deniable encryption may be used to obtain adaptively-secure multiparty computation (MPC) protocols and is secure under selective-opening attacks. Different flavors such as sender-deniable and receiver-deniable encryption, where only the Sender or Receiver can produce fake random coins, have been considered. Recently, several open questions regarding the feasibility of deniable encryption have been resolved (c.f. (O’Neill et al., CRYPTO, 2011), (Bendlin et al., ASIACRYPT, 2011)). A fundamental remaining open question is whether it is possible to construct sender-deniable Encryption Schemes with super-polynomial security, where an adversary has negligible advantage in distinguishing real and fake openings. The primitive of simulatable public key encryption (PKE), introduced by Damg˚ard and Nielsen (CRYPTO, 2000), is a public key encryption scheme with additional properties that allow oblivious sampling of public keys and
Abstract. A deniable cryptosystem allows a sender and a receiver to communicate over an insecure channel in such a way that the communication is still secure even if the adversary can threaten the parties into revealing their internal states after the execution of the protocol. This is done by allowing the parties to change their internal state to make it look like a given ciphertext decrypts to a message di erent from what it really decrypts to. Deniable encryption was in this way introduced to allow to deny a message exchange and hence combat coercion. Depending on which parties can be coerced, the security level, the avor and the number of rounds of the cryptosystem, it is possible to de ne a number of notions of deniable encryption. In this paper we prove that there does not exist any non-interactive receiver-deniable cryptosystem with better than polynomial security. This also shows that it is impossible to construct a non-interactive bi-deniable public-key encryption scheme with better than polynomial security. Speci cally, we give an explicit bound relating the security of the scheme to how e cient the scheme is in terms of key size. Our impossibility result establishes a lower bound on the security. As a nal contribution we give constructions of deniable public-key encryption schemes which establishes upper bounds on the security in terms of key length. There is a gap between our lower and upper bounds, which leaves the interesting open problem of nding the tight bounds. 1
To ensure resistance to attacks with coercion to disclose a secret key by an active adversary, the protocol of deniable encryption includes a procedure for mutual authentication of the sender and receiver of a message with their long-term public keys, which is combined with a hidden exchange of single-use public keys used to generate a single-use shared key, on which the secret message is encrypted. Longterm public keys are used to generate a shared secret key, on which a fake message is encrypted. The produced intermediate ciphertexts are converted into a single ciphertext, which is computationally indistinguishable from the ciphertext obtained by probabilistic encryption of a fake message. This approach allows us to build an encryption protocol that is resistant to bi-sided attacks with coercion, since the disclosure of users' private keys gives access only to the fake message and cannot be used to prove the possibility of alternative decryption of the ciphertext transmitted over a public communication channel. The authentication of the single-use public keys is also used to implement protocols for secure encryption using short shared keys.
There is proposed a new method for deniable encryption based on commutative transformations. The method has been used to design the deniable encryption protocol resistant to the passive coercive attacks, which uses no pre-shared secret keys and no pre-exchanged public keys. The protocol begins with the stage at which the sender and receiver exchange their single-use public keys and compute the single-use shared secret key. Then, it is performed pseudo-probabilistic three-pass protocol with simultaneous commutative encryption of the fake and secret messages. Resistance of the proposed protocol to coercive attacks is provided by its computational indistinguishability from probabilistic no-key three-pass protocol used to send securely the fake message. To perform commutative encryption, it used exponentiation cipher. To provide security against active coercer, the protocol is to be complemented with procedure for authenticating the sent messages.
Deniable encryption, first introduced by Canetti et al . 1997, allows equivocation of encrypted communication. In this work, the authors generalise its study to functional encryption (FE). The authors’ results are summarised as follows: They first put forward and motivate the concept of receiver‐deniable FE, for which they consider two models. In the first model, as previously considered by O'Neill et al . 2011 in the case of identity‐based encryption, a receiver gets assistance from the master authority to generate a fake secret key. In the second model, there are ‘normal’ and ‘deniable’ secret keys, and a receiver in possession of a deniable secret key can produce a fake but authentic‐looking normal key on its own. In the first model, they show a compiler from any FE scheme for circuits to a FE scheme having receiver deniability. In addition, they show an efficient receiver‐deniable FE scheme for Boolean formulae from bilinear maps. In the second (multi‐distributional) model, they present a specific FE scheme for circuits having receiver deniability. To the authors’ knowledge, a scheme in the multi‐distributional model was not previously known even for the special case of identity‐based encryption. Finally, they construct the first sender (non‐multi‐distributional) deniable FE scheme.
Deniable encryption (Canetti et al. CRYPTO ’97) is an intriguing primitive that provides a security guarantee against not only eavesdropping attacks as required by semantic security, but also stronger coercion attacks performed after the fact. The concept of deniability has later demonstrated useful and powerful in many other contexts, such as leakage resilience, adaptive security of protocols, and security against selective opening attacks. Despite its conceptual usefulness, our understanding of how to construct deniable primitives under standard assumptions is restricted. In particular, from standard assumptions such as Learning with Errors (LWE), we have only multi-distributional or non-negligible advantage deniable encryption schemes, whereas with the much stronger assumption of indistinguishable obfuscation, we can obtain at least fully-secure sender-deniable PKE and computation. How to achieve deniability for other more advanced encryption schemes under standard assumptions remains an interesting open question. In this work, we construct a bi-deniable inner product encryption (IPE) in the multi-distributional model without relying on obfuscation as a black box. Our techniques involve new ways of manipulating Gaussian noise, and lead to a significantly tighter analysis of noise growth in Dual Regev type encryption schemes. We hope these ideas can give insight into achieving deniability and related properties for further, advanced cryptographic constructions under standard assumptions.
The notion of deniable authentication protocol was introduced in 1998 by Dwork et al. [11] and Aumann and Rabin [1, 2] independently. As a new cryptographic authentication protocol, a deniable authentication protocol enables an intended receiver to identify the source of a given message without being able to prove the identity of the sender to a third party. Over the past years, many deniable authentication protocols have been proposed. In this paper, we would like to present a universal encrypted deniable authentication protocol from any public key encryption scheme. Provided that the public key encryption scheme is secure, a secure deniable authentication protocol can be directly derived.