Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When transfering data using TLS the browser and server agree the cipher suite to be used - so for example this could be chosen as AES-128 and is (probably) outside of my control. If I separately encrypt a file using AES-256 and then Alice downloads this via her browser (using AES 128) have I still effectively got AES-256 security?

My reasoning goes like this: even if the AES-128 encryption on the TLS link was broken by Eve then all she would get is the AES-256 encrypted file and she would then have to break that encryption to see the plaintext.

Of course the AES-256 key is sent to Alice over a separate channel.

share|improve this question
What's described is AES-128 over AES-256, not AES-256 over AES-128 (think of a paint/protection analogy: the second-applied layer is over the first one). As explained by poncho, the answer is a clear: NO. – fgrieu May 22 '14 at 11:09

Obviously, as long as the AES-128 (TLS) channel is keyed independently from the AES-256 (file encryption), the TLS encryption cannot damage the file encryption.

Let us consider what would be true if it could. If that somehow did weaken the file encryption, this would allow this attack on an encrypted file – he could take that encrypted file, and send it through his own encrypted TLS link. He can then use the records from that encrypted link, and exploit the weakness to attack the file encryption.

Since he can do that, any weakness that would apply to the combination would also apply to the file encryption alone. We don't believe that there's anything wrong with the file encryption (assuming that the AES-256 key is randomly chosen), hence there isn't anything wrong with the combination.

share|improve this answer
Thanks for your answer, a course that I did some while ago warned about making assumptions and so I thought it best to verify with the experts - I hadn't realised that if it were true it would provide an attack. – Bob May 21 '14 at 14:23
Correct, however, it's not as obvious as that. Suppose it was the other way around and the file was 128-bit encrypted while the TLS connection used 256-bit encryption. Theoretically, AES-256 could be weaker with certain plaintexts, and AES-128 could be biased to produce those as ciphertexts more often than they would otherwise appear. The double encryption is provably at least as strong as the inner encryption (all that's needed here), but could be weaker than the outer encryption. (Stream ciphers are as strong with all plaintexts so should always be safe as outer encryption.) – otus May 21 '14 at 14:36
@otus: actually, if you analyze the outer encryption strength in terms of chosen plaintext attacks, the exact same result applies. – poncho May 21 '14 at 14:41
Exact same as? In Applied Cryptography they say: "This can be better phrased: Using a chosen-plaintext attack, a cascade of ciphers is at least as hard to break as any of its component ciphers. A previous result showed that the cascade is at least as difficult to break as the strongest algorithm, but that result is based on some unstated assumptions. Only if the algorithms commute, as they do in the case of cascaded stream ciphers (or block ciphers in OFB mode), is the cascade at least as strong as the strongest algorithm." – otus May 21 '14 at 14:47
@poncho: a chosen plaintext attack the outer cipher is equally vulnerable only against pure chosen plaintext attacks in which the key is broken, not in general, like shown in "Cascade ciphers: The importance of being first". – otus May 21 '14 at 15:14

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.