# Does re-iterate AES128 with different keys gives any benefict?

I'm not cryptography expert (well, I'm here after all!) but I have this doubt…

Suppose I have 2 different keys:

1. secretkey1
2. secretkey2

And a plain text:

• myReallySecretPlainText

If I use AES128 on my plain text with my first key I get this:

U2FsdGVkX19fHxumDqEB9Kuyvhj+aoHpctLCdo2VEvt1danATMo+sBaz3nsCaS/Z


now, if I use on this cipher text my second key I got this:

U2FsdGVkX1/AqJ3w8nTRAHvm1ZbDTdwmq7LTVBDR/z4O9ngaXGuAIqcqTzPj+flPRIV6++twqBnIEHgUVVe7oO1D75VO14ezRX5tqcjBTPUUtr7YDqCks5ZW7fX8crqg


Looks pretty safe, but I have a doubt: does this have the same security of a AES256? Or a single 128bit key that can decode my final text can exists?

-
It's weaker than AES-256 against generic attacks. There is a meet in the middle attack which can break it with cost 2^128 (not sure how applicable the attack is with realistic cost models). See Attacking 2DES efficiently. Search for DES meet-in-the-middle for several related question. –  CodesInChaos Jan 29 '14 at 16:43
If you are going to do a double encryption, it is best to use different algorithms, and if possible different modes. For example, AES128-CTR(Twofish128-ECB(Plaintext,Key),Key,Nonce). This is extremely fast and allows "false length" outputs on the CTR wrap. –  Richie Frame Mar 25 '14 at 4:37

The idea you describe is vulnerable to a meet-in-the-middle attack that work in approximately $2^{128}$ time and $2^{128}$ memory. The attack assumes knowledge of plaintext/ciphertext pair(s). Given a pair, you encrypt the plaintext with every possible key 1 and store those values. You then decrypt the ciphertext with every possible key 2 and look for a match between the two datasets. Say you find that $E_{k_1}(P)=D_{k_2}(C)$. Likely these are your two keys. This can be validated by looking at additional plaintext/ciphertext pairs.