Way back when, DES had a theoretical security level 56-bits. 2-key TDEA provides about 80-bits of security, and 3-key TDEA provides about 112-bits of security. Obviously, those security levels are not linear in the cascading of the underlying block cipher.
How does one estimate the increase in security level when compositing?
Is it necessary that the composition is not closed so that the composite does not form a group? I.e, if A(B(C(x))) = y, then there cannot be a A' such that A'(x) = y. (I believe so).
How does this apply to Diffie-Hellman over integers? If I run the Diffie-Hellman algorithm twice with 3072 moduli (i.e., 128-bits of security each) and concatenate the two shared secrets, then how many effective bits of security are present? (Intuitively, I think its around 128-bits or 129-bits).
How does this apply to RSA? If I run the RSA algorithm twice with 3072 moduli (i.e., 128-bits of security each) and transport two shared secrets, then how many effective bits of security are present? (Intuitively, I think its around 128-bits or 129-bits).
Sorry to ask these questions. The back story has to do with elliptic curves and patents, and I'm trying to figure out if its feasible to exchange/agree/transport an AES-256 key in distinct pieces using traditional crypto primitives while maintaining security levels and avoiding elliptic curves.