Bob to know for sure that there might be other messages contained in C, he might assume that there are no other messages (alternatively, Bob may not be familiar with the concept of plausible encryption in the first place, and thus may not be aware it is even possible for C to contain more than one message). Another possible scenario involves Alice sending the same ciphertext (some secret instructions) to Bob and Carl, to whom she has handed different keys. Bob and Carl are to receive different instructions and must not be able to read each other's instructions. Bob will receive the message first and then forward it to Carl. Alice constructs the ciphertext out of both messages, M1 and M2, and emails it to Bob. Bob uses his key to decrypt M1 and isn't able to read M2. Bob forwards the ciphertext to Carl. Carl uses his key to decrypt M2 and isn't able to read M1. Forms of deniable encryption Normally, ciphertexts decrypt to a single plaintext that is intended to be kept secret. However, one form of deniable encryption allows its users to decrypt the ciphertext to produce a different (innocuous but plausible) plaintext and plausibly claim that it is what they encrypted. The holder of the ciphertext will not be able to differentiate between the true plaintext, and the bogus-claim plaintext. In general, one ciphertext cannot be decrypted to all possible plaintexts unless the key is as large as the plaintext, so it is not practical in most cases for a ciphertext to reveal no information whatsoever about its plaintext. However, some schemes allow decryption to decoy plaintexts that are close to the original in some metric (such as edit distance). Modern deniable encryption techniques exploit the fact that without the key, it is infeasible to distinguish between ciphertext from block ciphers and data generated by a cryptographically secure pseudorandom number generator (the cipher's pseudorandom permutation properties). This is used in combination with some decoy data that the user would plausibly want to keep confidential that will be revealed to the attacker, claiming that this is all there is. This is a form of steganography. If the user does not supply the correct key for the truly secret data, decrypting it will result in apparently random data, indistinguishable from not having stored any particular data there. One example of deniable encryption is a cryptographic filesystem that