Achievable (with superpolynomial message spaces) only in the programmable random oracle model, as shown by Jesper Nielsen: https://www.iacr.org/archive/crypto2002/24420111/24420111.pdf Put into system by us in [[SoK - Public Key Encryption with Openings]]. Related to but different from [[Deniable Encryption]].