How can I create pre-determined encrypted results? I want my encryption results to be the lyrics to Star Spangled Banner.
The original text I'm encrypting would be, for instance, the menu to a local pizza place.
I know what I want my passphrase to be.


How can I determine how to do this if I want to require a particular passphrase for its decryption? Obviously, I don't want something simple like ROT. I want to use cascade ciphers to accomplish this, something like AES, Serpent or Twofish.
What's asked is not possible if we add three constraints:


There exists a decryption method that given only the encryption results and the passphrase, outputs the original text.
The encryption/decryption method is not highly specific to a particular input (a particular menu to a local pizza place) or desired output (the lyrics to Star Spangled Banner).
In "I want my encryption results to be the lyrics to Star Spangled Banner", what's meant is that the full encryption results is exactly equal to prescribed data rendering as the lyrics to Star Spangled Banner.


Proof: suppose what's asked is possible with these three constraints. Using the same passphrase, encipher a variant of the menu to that local pizza place, in the same hypothetical method that gives the prescribed data rendering as the lyrics to Star Spangled Banner. The deciphering program of 1 has no way to decide which of the two menus it should output.

If we remove any of these constraints, what's asked is easy.

Argument for 1: Consider a decryption program that uses the help of an online server to retrieve the original text stored there, using the desired output as key. 

Argument for 2: Consider a program that outputs the lyrics to Star Spangled Banner whenever the original text is a specific menu to a local pizza place, and otherwise performs as a normal encryption program; add a few easy technicalities.

Argument for 3: Consider an encryption program that accepts as additional input a text file with the desired output; and outputs a PDF or JPEG file that shows the text of that desired output, but contains in a comment field (not rendered by a PDF or JPEG viewer) the result of the encryption of the original text under the passphrase, per some standard encryption method. The decryption program will first extract the comment field, then use the standard decryption method. We can perfect the illusion by replacing the passphrase with the SHA-256 hash of the passphrase followed by the PDF or JPEG output file less its comment field.

There are countless ways to work around requirement 3; some even use a standard method modified in a detail. For example, with AES-CBC, it is easy to specially chose an IV such that a given 16-byte plaintext block enciphers to a given 16-byte ciphertext block under a given key, with no change to the decryption program. That's apparently how the idea illustrated in Angecryption started.



An entropy argument gives us a limit to how far we can go while meeting requirements 1 and 2: regardless of how clever we are in working around 3, the ciphertext is bound to be at least as big as we can losslessly compress the combination of the input and desired output, minus the entropy in the passphrase.