# Combining multiple symmetric encryption algorithms - implications?

I was just wondering if I add more security by combining two or more symmetric encryptions on a plain text.

For example: Plaintext → AES → Twofish → Serpent

Of course a different key and IV (produced with a cryptographic secure prng) is used for each algorithm. Speed fortunately is not important.

Or does this form of combination has other implications I do not see?

There is a question like that here at Crypto.SE (Is Truecrypt's multiple/cascading encryption safe?) but it focuses on using the same key – so what is your opinion?

Thanks

-
Where does that question focus on using the same key? $\;$ –  Ricky Demer Sep 12 '13 at 18:14
There's some excellent discussion of this topic here –  hunter Sep 12 '13 at 18:15

I can see based upon your question that you're not already a crypto-expert. Given that, I think the single most useful answer I can give you is this:

Multiple encryption addresses a problem that mostly doesn't exist. Modern ciphers rarely get broken -- at least, not in the Swordfish sense. You're far more likely to get hit by malware or an implementation bug than you are to suffer from a catastrophic attack on AES.

That's a quote from http://blog.cryptographyengineering.com/2012/02/multiple-encryption.html, which is an excellent article on this topic.

Moreover, if you have to ask this question, you should not be using multiple encryption. It's a little bit tricky, and you're more likely to screw something up than to get any meaningful security gain.

Bottom line: No, you can't add more security by using multiple encryption. The block cipher isn't the weak link, and strengthening the strongest link in a system does not add more security. Modern block ciphers appear to be effectively unbreakable; if that's correct, multiple encryption is pointless. So, my recommendation is: don't do it. It doesn't solve any real-world problem, it doesn't add much benefit, and you're likely to screw something up. Use standard well-vetted cryptographic solutions, like TLS, Truecrypt, GPG, etc.

-
The point about 'fixing a problem that doesnt exist' is probably the best item of discussion for the original post –  Richie Frame Sep 12 '13 at 18:51
Not what I wanted to hear, but you are likely to be right.... Thanks! –  Chris Sep 13 '13 at 8:08
I think you mistyped "strengthening the weak link in a system does not add more security", since it is quite straightforward that it does. Perhaps you meant "the strongest link"? :) –  Stephen Touset Apr 1 '14 at 17:46
@StephenTouset, oh, right, thank you! Boy that was a dumb thing to write. :-) I appreciate the comment. –  D.W. Apr 2 '14 at 3:25

Block ciphers are already built of multiple components: AES = fixed 8-bit sbox, MDS matrix multiplication, 8-bit rotations Twofish = key dependent sboxes, MDS matrix, 1 and 8-bit rotations, PHT

Chaining ciphers adds more components, more rounds, more complexity

Depending on chaining implementation, a different IV is not required for each cipher. For example, the first algorithm uses the selected mode, and the next in the chain only use ECB; or the other way around. Choosing the modes and the order they are chained is important.

Different keys should be used, otherwise there is no increase in effective key space, just cipher complexity and round count.

As long as the algorithms are not some kind of inversion of eachother, it effectively increases the total keyspace of the cipher chain, in addition to increasing the round count. Additionally, the different building blocks make certain attacks more difficult, where the similarity between rounds is exploited. It is better to build a cipher with more complexity than rely on the complexity of the chain, as one complete weak cipher may be "peeled off".

Rounds of one cipher cancelling out rounds of another is a distinct concern, and if the ciphers are the same (DES to 2DES, 3DES,.. NDES) there are attacks that will exploit this and reduce the effective key space. Assuming the underlying block ciphers are strong against all attacks, the upper bound on the chain security will be the combined upper bounds of each cipher's security, but can be lower in practice, especially if implemented poorly.

I tried to summarize points in one of the comments to the original post, certain points may be unclear or not touched upon

-
side note, I use a 2 cipher chain construction with AES as both primitives in 2 different modes of operation, first CTR, then OCB, each with 128-bit keys, which should provide better diffusion than 256-bit AES in OCB only, and allows multicore optimization as well as precomputation. –  Richie Frame Sep 12 '13 at 18:47
This reply contains suggestions which I would recommend against. "Complete weak cipher may be peeled off". This is true, however, the reason multiple ciphers practice is not recommended is that implementation mistake may allow breaking entire chain. If multiple different kind of modes are used, it is important to carefully meet requirements of each mode. –  user4982 Sep 12 '13 at 20:07
The only suggestion I thought I made was "Different keys should be used", which is actually more of a statement. I did touch upon the importance of mode selection, and as always, implementation mistakes can break any cryptosystem regardless of cipher(s) used. Chaining or cascading does carry its own set of possible mistakes, I tried not to give any instructions on how to implement chaining or cascading securely. –  Richie Frame Sep 13 '13 at 3:54
Valuable answer, thank you –  Jeremy Dicaire Nov 12 '13 at 16:14