# How to encrypt data and know it will be secure for at least a few decades?

I want to encrypt a small amount (few kilobytes) of data and be fairly confident it will be secure against brute force decryption and advances in cryptanalysis for at least a a few decades (or more). I am flexible on the amount of time it takes (even a minute is reasonable) to encrypt as this will run on the client machine, and not on a server.

My thought was to combine a few encryption algorithms over an iterative process - each iteration with a fresh key. The reasoning being:

1. Multiple iterations increases the time necessary for each brute force attempt.
2. Multiple algorithms means a failure in any one algorithm doesn't compromise the whole encryption.
3. Multiple key effectively increases the key size to astronomical.

So it might look like this:

CipherText = AES(TwoFish(Serpent(PlainText)));


Except with many more layers of nesting (repeating the selected algorithms). Each layer will have a CSRNG generated Key and IV and use CBC.

• Is this a good idea?
• Does the nesting increase the security, or does it somehow introduce a new vulnerability?
• If this is a good idea, which algorithms would be best to use?
• Would it be better to use asymmetrical algorithms instead of symmetrical ones?
• How many iterations is enough?

I'm fine with it being overkill. Just want to make sure it isn't going to make things worse.

Updated to specify resistance to cryptanalysis, use of CSPRNG for Key and IV and using CBC. Also removed references to outdated algorithms.

-
The main issue is, From where do you get the keys? Do you expect the user to enter 1000 key bits manually? If you use a normal password, that is most likely the weakpoint in your scheme. And you didn't specify a chaining mode, or if you're suing a MAC. –  CodesInChaos Sep 2 '12 at 10:54
Do you want to be secure only from brute force (then everything with a 128 bit key size should be enough), or also save from advances in cryptanalysis? The latter is harder. –  Paŭlo Ebermann Sep 2 '12 at 10:59
But where does your user keep the key? Does he print it? Does he memorize 1000 bits? –  CodesInChaos Sep 2 '12 at 15:30
It helps against crypto-analysis, and brute-force is irrelevant for ciphers with 256 bit keys. But a cryptographic system is only as strong as its weakest part. It's unlikely that the actual cipher is the weakest part in your system. –  CodesInChaos Sep 2 '12 at 15:43
@JimMcKeeth: if that's the case, why not use a secret sharing scheme. In the specific case where there are two parties, and you need both to recover the text, you can do this simply by generating a truly random string $S$, and give one party $S$, and the other party $S \oplus Plaintext$. –  poncho Sep 2 '12 at 16:25
show 7 more comments

Is this a good idea?

Not really.

It is rare to find attacks against vetted designs that allow a complete break with a tiny amount of cipher-text.

Assuming you plan to have a unique key (which isn't used anywhere else) for just this few kilobytes of plaintext, it's very unlikely any cryptographic attack could be mounted against any modern cipher that would recover the plain-text.

Honestly, your message is likely to be absolutely fine encrypted with AES.

It's very unlikely someone's missed a key-recovery attack on AES that can be conducted with a few kilobytes of cipher-text.

Does the nesting increase the security, or does it somehow introduce a new vulnerability?

It is possible to do this badly and introduce a new vulnerability, yes.

If this is a good idea, which algorithms would be best to use?

Just use AES in GCM mode.

Would it be better to use asymmetrical algorithms instead of symmetrical ones?

No.

How many iterations is enough?

One iteration of AES in GCM mode is enough.

-
Thanks Simon. Good advice. Was not familiar with GCM but will do some research and see if I can find an implementation. Was going to use CBC. –  Jim McKeeth Sep 3 '12 at 2:30

(1) Where are you going to keep the key for those decades? That is the point of attack.

(2) Regardless the answer to 1, for such a small amount of data use a one time pad. However you planned to keep the key secure for the intervening decades, use it to keep the pad safe.

-