# Tag Info

13

Cascading cipher gives a sense of security; and one that is technically justified with respect to the possibility that a weakness in one of the cipher would allow recovering the encrypted data. That's Bruce Schneier's argument, and it made sense in an era where DES, the then leading cipher, was a closed design, clearly deliberately weakened by a small key, ...

10

The usual method to do this is to turn the block cipher into a stream cipher. In that way the ciphertext is generated by XOR'ing the plaintext with a generated key stream. This key stream in turn is generated by the mode of operation that turns the block cipher into a key stream. There are several of these modes, but CTR mode of operation is most often used ...

7

EEE and EDE are effectively the same in terms of security. EDE is used because it is "backwards compatible:" by setting all three keys to be the same, it becomes equivalent to just single encryption (E) with that key.

6

I don't know about computing things in parallel, so I will ignore that part of the question. First, please note that the encryption algorithm is rarely the the weak point of the security. It is far more likely that you will have problems with the implementation, some spyware installed on your computer, a weak password (If you use qwerty as your password, ...

5

I won't say someone would be able to break it 'easily'; however it won't be anywhere as difficult as with a true 128 bit cipher (or even 120 bit cipher; your construction ignores 8 of the key bits). Here's an outline of how the attack would work: we assume we know the plaintext and the ciphertext, and are trying to recover the key. When we do is encrypt ...

5

Well, whether $AES'$ is as secure as $AES$ depends on the length of $k_1, k_2$. If they are both 128 bit, then what you effectively have is a standard 128-bit AES, except that prior to round 6, you replace the running key with an independent key (and you tweaked the last round, but that's cryptographically harmless). Now, it is never a good idea to do ...

5

I can see based upon your question that you're not already a crypto-expert. Given that, I think the single most useful answer I can give you is this: Multiple encryption addresses a problem that mostly doesn't exist. Modern ciphers rarely get broken -- at least, not in the Swordfish sense. You're far more likely to get hit by malware or an ...

5

Step 1: good job, this is the right way. You can also use bcrypt or scrypt for extra resistance. Make sure you have chosen sufficiently strong parameters, that is, 64-bit salt and 10000 rounds absolute minimum. Step 2: no! once you have a strong derived master key, you don't need to apply PBKDF2 on any keys derived from this master key. You are just wasting ...

4

What you are asking appears to be 'is AES commutative'? The short answer to which is no: encrypting with AES with key 1 then key 2 will not (generally) give the same output as encrypting with key 2 then key 1, which is what would be required for naive implementation. However, there are modes in which AES can be used which would be commutative. For example, ...

4

You could be able to reduce the space required for a meet-in-the-middle attack, if you follow a similar idea as the application of Grover's algorithm on collisions. Suppose you have two layers of $n$-bit encryption: Partition the inner keyspace into $2^{n/4}$ parts of size $2^{3n/4}$. For each partition generate the inner encryption table. Run Grover's on ...

3

The actual security would probably be about 65 bits. A meet-in-the-middle attack can be used to find the keys of both ciphers in less time than naive brute force. The attack would decrypt the ciphertext with all the 64 bit l keys of the outer cipher, encrypt the plaintext with all the 56 bit keys of the inner cipher, then look for matches. It only requires ...

3

Start with “Shamir's Secret Sharing” concepts… Abstract. In this paper we show how to divide data D into n pieces in such a way that D is easily reconstructable from any k pieces, but even complete knowledge of k - 1 pieces reveals absolutely no information about D. This technique enables the construction of robust key management schemes for ...

3

Does re-encrypting the same value with multiple keys reduce security? The answer is "it depends"; there are some attack models and encryption methods where the security is reduced, there are other cases where there appears to be no security reduction. Let us go through some models where we actually see a security reduction: Plaintext guessing attack ...

3

In general (especially without knowledge what encryption you consider), it's not possible to detect "correct decryption of one layer", if that's all you have and this "middle ciphertext" is not in a specific format. However, from today's point of view this is almost entirely irrelevant, because stronger attacks are considered: Kerckhoff's principle states ...

3

What you propose is called Double Encryption. With two independent keys, it is vulnerable to meet-in-the-middle attacks as described in another comment. I just add that this attack can be performed almost memoryless. Details are in the answer to similar question about Double-DES.

3

If you're using a real encryption scheme then no it cannot weaken or strengthen the system because the encryption scheme's security is supposed to be independent the actual data being encrypted. The plaintext could be random bytes or all zeroes for all it cares, it will be just as secure. All this modification achieves is lower your encryption scheme's ...

3

Your first option: Encrypted(Input) = AES256(key2, Serpent(key1, Input)) suffers from a textbook meet-in-the-middle attack. It only gives you one additional bit of security over AES alone / Serpent alone. Not a good choice if you're aiming for extra paranoia.

3

This is not a complete answer but it seems to me that it cannot be more secure than the original AES since otherwise it would mean that there is a serious weakness in the AES key schedule As far as being as secure there's at least one application in which it's a weakness : when you use AES inside a Davies-Meyer construction. An attacker has then more power ...

3

Yes, you can reasonably expect that these will provide equivalent security, if you choose all keys uniformly and independently at random. The decryption operation is basically the same as the encryption operation, so it would be extremely surprising if there was any significant difference in security among these. (Of course, if you don't generate the keys ...

3

There is a very simple, completely generic solution, that unlike the other solution doesn't assume anything about how the two encryption schemes work internally (e.g., that they are built from block ciphers or have pseudorandom ciphertexts): given a message $m$, choose a uniformly random $m_1$ of the same length and let $m_2 = m \oplus m_1$. Then encrypt ...

2

Short answer: (Probably) yes. Long answer: DES is a Feistel cipher, and therefore encryption and decryption are almost the same process. The only difference is the reverse order of the subkeys. There are theoretical attacks on DES, which might have to be adjusted if you use reverse order of subkeys for encryption. If these attacks target the subkeys ...

2

In short: does storing these encrypted files in an encrypted partition/folder create the same potential weaknesses as cascade encryption? If not, what of encrypting a .tar of encrypted documents? An encrypted file inside an encrypted container is a cascade of ciphers, almost by definition. Is that a problem? Not really. A cascade of ciphers shouldn't ...

2

Block ciphers are already built of multiple components: AES = fixed 8-bit sbox, MDS matrix multiplication, 8-bit rotations Twofish = key dependent sboxes, MDS matrix, 1 and 8-bit rotations, PHT Chaining ciphers adds more components, more rounds, more complexity Depending on chaining implementation, a different IV is not required for each cipher. For ...

2

They rely on problems not so different as you might think. They are based either in the factoring problem or in the discrete logarithm problem, which have a deep connection between each other. Once you have an algorithm that can efficiently solve one, you most likely would be able to adapt it to reproduce an answer for the other in polynomial time. Thus ...

2

It seems the result is specifically for multiple encryption with a single cipher (like in 3DES). It probably applies for different ciphers as well, but key and block sizes would need to be equal. You might get a lower bound by using the minimum key size, but don't quote me on that. However, I don't think this is really relevant for a practical ...

2

To begin with 4: Remember Kerckhoff's principle. You should always assume that the attacker knows which algorithm is used to encrypt your data. All the algorithms used in practice are designed to be secure under this assumption, so you should consider that hiding the algorithm from the attacker is superfluous. But as a hypothetical... I can't think of any ...

2

The combination of Grover algorithm and man in the middle attack is the main subject of a paper (arXiv:1410.1434) published last year by Marc Kaplan (Full disclosure: Marc is a friend of mine.) In this paper beyond applying Grover to MITM to reduce the time needed to analyse double-encryption, he also looks at the time-space gain, which is different, and ...

2

At its simplest, to encrypt a message for $n$ different recipients, you could just make $n$ copies of the message, encrypt each one with a different key, and join the encrypted messages together into a single long ciphertext. Of course, the disadvantage of this scheme is that the ciphertext length grows linearly with the number of recipients. To avoid ...

2

For a crypto algorithm that acts like a group, the first thing that comes to mind is Pohlig-Hellman. In this method, we have a large prime $p$, and define: $$E_A(Data) = Data^A \bmod p$$ (with $A$ relatively prime to $p-1$) This has the property that $E_B(E_A(Data)) = E_{A \times B \bmod p-1}(Data)$; however it has the security properties you're looking ...

2

EDIT: I think what I do is provide a little more than a hint so don't read further if that is an issue. That is: Resulting in: Alternatively: and

Only top voted, non community-wiki answers of a minimum length are eligible