Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Is Truecrypt use of cascading encryption safe? Is it useful? Truecrypt is arguably one of the most popular and widely used encryption applications in use today, yet it seems to use a very unconventional scheme.

The software offers cascading encryption, where the user can specify either double or triple encryption using any combination of AES, Twofish, and Serpent. Unusually, multiple-encryption is performed on each block, before moving on to the next block, as opposed to encrypting all the data and then encrypting the resulting ciphertext.

After having spent a lot of time reading through crypto.se, the consensus seems to be that multiple/cascading encryption offers little (or perhaps no) extra security, and some even argue that if may be weaker than just following a standard protocol (although the latter rarely seems to be substantiated by any reasoning). However, in Bruce Schneier's Applied Cryptography (considered by many to be a quintessential text on cryptography), he advocates the use of multiple encryption (albeit cautiously, and with some caveats). See sections: 15.7 Cascading Multiple Block Algorithms, 15.8 Combining Multiple Block Algorithms, and 17.11 Cascading Multiple Stream Ciphers.

Another example of going against this consensus would be the Tahoe-Lafs 100 Year Cryptography Project, which has been recommended on crypto.se. Their protocol involves encrypting with AES in CTR mode and then encrypting the output with xSalsa20.

So my question is, is Truecrypt's use of multiple/cascading cryptography reasonable, and why?

share|improve this question
Perhaps someone more familiar with the history of crypto will correct me, but it's my understanding that Applied Cryptography was written before AES, at a time when the NSA was actively trying to cripple private-sector encryption. This included knocking down the DES key length to 56 bits so it could be brute-forced. Triple DES was one method cryptographers developed to fight this. In contrast, AES uses 128 bit keys (or longer), and the cryptographic community is more confident in our ability to design blockciphers. Cascading different types of ciphers addresses a different threat. –  Seth Feb 26 '13 at 18:53
add comment

1 Answer

up vote 9 down vote accepted

Cascading cipher gives a sense of security; and one that is technically justified with respect to the possibility that a weakness in one of the cipher would allow recovering the encrypted data. That's Bruce Schneier's argument, and it made sense in an era where DES, the then leading cipher, was a closed design, clearly deliberately weakened by a small key, giving rise to the fear that is was also deliberately weakened otherwise (which turned out not to be the case).

On the other hand, the more serious threats facing systems like TrueCrypt are not a weakness of the cipher; they include compromise of the software, compromise of the hardware running the software, compromise of the key (by eavesdropping, guess of the passphrase, rubber hose cryptanalysis, recovery from hibernation file or RAM memory..), analysis of changed sectors.. These risks are hard to mitigate, and in the opinion of many (including me), much more likely to materialize than cryptanalysis of AES, for at least decades even if we consider AES-128. And further, technological progress likely will enable a guess of the passphrase by brute force sooner than a cryptanalysis of AES.

Cascading ciphers has at least one obvious drawback: performance is lowered. Often it matters, sometime it does not, e.g. when enciphering a key. In my opinion, compared to AES, cascading might only improve practical security by a side effect: making it harder to verify a guess of the passphrase (that would be the case in a system where the only way to check such guess is to turn the passphrase into keys, decipher something using the cascade of ciphers, and check that it makes sense).

So all in all, I would think of cascading a cipher in addition to AES only as a way to damp paranoia or indicate an extra level of care, like telling to someone knowing little about cryptography: for the cold storage of your all-important master keys, you could use a Truecrypt volume on a USB stick, perhaps even with cascaded ciphers; and most importantly, strive for the integrity of all the hardware and software used!

Addition following comment asking how to do cascading (of block ciphers) properly. My answer to that would be that if one uses cascading:

  1. That might be considered in the key-stretching phase (turning the user's passphrase into the key of the bulk cipher), where cascading is useful, because it makes construction of a device that successfully brute-force passphrases significantly harder/more expensive/less likely. Cascading is useful in key stretching because when a cascade of encryptions is iterated, a fast implementation must be fast on each of the cascaded ciphers, which is a very serious problem in a password cracker using ASIC or (to a lesser degree) FPGA; search FPGA password for some interesting links. Beware however that speed optimization of the legitimate implementation for each of the cascaded cipher iterated in the key-streching phase is important for security (because we need to push the number of iterations as high as feasible), when it is immaterial to security in the bulk-encryption phase.

  2. At least the first cipher in the cascade (the one in contact with the plaintext during bulk encryption, or to a lesser degree the one in contact with the passphrase during key stretching) should be implemented in a manner protecting from any likely side-channel attacks, including timing and unwanted emissions (for an illustration of that later danger in a slightly different context, see this).

  3. When the key must be secret (in particular the key used for bulk encryption), the cascaded ciphers positively must use different keys (e.g. extracted from a wide derived key); otherwise using a cascade could well turn out to enable an attack if any of the ciphers turns out to leak its key through a side channel.

Truecrypt's use of cascaded ciphers definitely follows 3; I can't tell for 2, and the most important 1.

share|improve this answer
That's exactly the kind of objective, sensible response to this question that I've been looking for - thank you. –  hunter Feb 27 '13 at 14:49
Good way of thinking, thank you for this valuable answer. Upvoted. –  Jeremy Dicaire Nov 12 '13 at 5:55
And why shouldn't we have paranoia? Remember recent revelations about deliberate weakening of cryptography by some agency. If "rubber hose cryptanalysis" is more serious threat than why they do it at all? What a non-serious agency! –  catpnosis Jan 11 at 15:02
@catpnosis: I wrote "compromise of the software" as the first thing to worry about. I maintain that, and every bit in my answer, in light of the recent revelations that you point out. It is rational to be very cautious (not paranoid, by definition of that), but it is nowadays not very rational to use cascading ciphers for bulk encryption. –  fgrieu Jan 11 at 18:25
@catpnosis: I added material in the answer that I hope will answer some of your question. –  fgrieu Jan 12 at 10:17
show 2 more comments

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.