Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I'm not cryptography expert (well, I'm here after all!) but I have this doubt…

Suppose I have 2 different keys:

  1. secretkey1
  2. secretkey2

And a plain text:

  • myReallySecretPlainText

If I use AES128 on my plain text with my first key I get this:

U2FsdGVkX19fHxumDqEB9Kuyvhj+aoHpctLCdo2VEvt1danATMo+sBaz3nsCaS/Z

now, if I use on this cipher text my second key I got this:

U2FsdGVkX1/AqJ3w8nTRAHvm1ZbDTdwmq7LTVBDR/z4O9ngaXGuAIqcqTzPj+flPRIV6++twqBnIEHgUVVe7oO1D75VO14ezRX5tqcjBTPUUtr7YDqCks5ZW7fX8crqg

Looks pretty safe, but I have a doubt: does this have the same security of a AES256? Or a single 128bit key that can decode my final text can exists?

share|improve this question
2  
It's weaker than AES-256 against generic attacks. There is a meet in the middle attack which can break it with cost 2^128 (not sure how applicable the attack is with realistic cost models). See Attacking 2DES efficiently. Search for DES meet-in-the-middle for several related question. –  CodesInChaos Jan 29 at 16:43
    
If you are going to do a double encryption, it is best to use different algorithms, and if possible different modes. For example, AES128-CTR(Twofish128-ECB(Plaintext,Key),Key,Nonce). This is extremely fast and allows "false length" outputs on the CTR wrap. –  Richie Frame Mar 25 at 4:37
add comment

1 Answer 1

up vote 4 down vote accepted

The idea you describe is vulnerable to a meet-in-the-middle attack that work in approximately $2^{128}$ time and $2^{128}$ memory. The attack assumes knowledge of plaintext/ciphertext pair(s). Given a pair, you encrypt the plaintext with every possible key 1 and store those values. You then decrypt the ciphertext with every possible key 2 and look for a match between the two datasets. Say you find that $E_{k_1}(P)=D_{k_2}(C)$. Likely these are your two keys. This can be validated by looking at additional plaintext/ciphertext pairs.

As codesinchaos says, the attack may not necessarily be applicable with realistic cost models, but it is a theoretical break and is therefore considered weaker than just using a larger key space in the first place. Also, I've got to believe that this idea is slower than just using AES-256.

share|improve this answer
    
Not that AES-256 is per se more secure than AES-128. –  Stephen Touset Jan 29 at 18:55
1  
@StephenTouset True, but it's very likely that it is more secure. The one big issue found so far is specific for related key attacks, which is not applicable in most protocols using AES. –  owlstead Jan 29 at 19:23
    
@mikeazo thank you for your answer! I want to use this "double aes128 method" because i have to cipher lot of things, with a double ciphering where the second key is always different i can make attacker's life more hard :) i remember something about the meet in the middle attack, looks like it can't be applied in this case due the impossibility to know a plaintext/ciphertext pairs since the key change for every element. Thank you again! –  AlexanderPD Jan 30 at 8:00
    
@AlexanderPD, what sort of attack are you worried about?To be honest, if I saw "double aes128 method" used in a real world system, I would run away from it as fast as I could. While the attacks might be theoretical, it does not follow good design principles from a cryptographic prospective. Chances are, whatever attack you are worried about can be mitigated using standard cryptographic processes and procedures (or perhaps by something else). –  mikeazo Jan 30 at 19:19
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.