I was just wondering if I add more security by combining two or more symmetric encryption algorithms on a plain text.

For example: Plaintext → AES → Twofish → Serpent

Of course a different key and IV (produced with a cryptographic secure prng) is used for each algorithm. Speed fortunately is not important.

Or does this form of combination has other implications I do not see?

There is a question like that here at Crypto.SE (Is TrueCrypt's multiple/cascading encryption safe?) but it focuses on using the same key.

  • 2
    $\begingroup$ Where does that question focus on using the same key? $\;$ $\endgroup$
    – user991
    Commented Sep 12, 2013 at 18:14
  • 4
    $\begingroup$ There's some excellent discussion of this topic here $\endgroup$
    – hunter
    Commented Sep 12, 2013 at 18:15

2 Answers 2


I can see based upon your question that you're not already a crypto-expert. Given that, I think the single most useful answer I can give you is this:

Multiple encryption addresses a problem that mostly doesn't exist. Modern ciphers rarely get broken -- at least, not in the Swordfish sense. You're far more likely to get hit by malware or an implementation bug than you are to suffer from a catastrophic attack on AES.

That's a quote from http://blog.cryptographyengineering.com/2012/02/multiple-encryption.html, which is an excellent article on this topic.

Moreover, if you have to ask this question, you should not be using multiple encryption. It's a little bit tricky, and you're more likely to screw something up than to get any meaningful security gain.

Bottom line: No, you can't add more security by using multiple encryption. The block cipher isn't the weak link, and strengthening the strongest link in a system does not add more security. Modern block ciphers appear to be effectively unbreakable; if that's correct, multiple encryption is pointless. So, my recommendation is: don't do it. It doesn't solve any real-world problem, it doesn't add much benefit, and it adds the extra risk that you might screw something up. Use standard well-vetted cryptographic solutions, like TLS, Truecrypt, GPG, etc.

  • 2
    $\begingroup$ The point about 'fixing a problem that doesnt exist' is probably the best item of discussion for the original post $\endgroup$ Commented Sep 12, 2013 at 18:51
  • 1
    $\begingroup$ Not what I wanted to hear, but you are likely to be right.... Thanks! $\endgroup$
    – Chris
    Commented Sep 13, 2013 at 8:08
  • 1
    $\begingroup$ I think you mistyped "strengthening the weak link in a system does not add more security", since it is quite straightforward that it does. Perhaps you meant "the strongest link"? :) $\endgroup$ Commented Apr 1, 2014 at 17:46
  • 1
    $\begingroup$ @StephenTouset, oh, right, thank you! Boy that was a dumb thing to write. :-) I appreciate the comment. $\endgroup$
    – D.W.
    Commented Apr 2, 2014 at 3:25
  • 1
    $\begingroup$ @D.W.: (cont'd) So I'm saying you should be able to defend your answer if you think it's actually right, and I'm pointing out that (a) for a second layer of encryption to break a previous one, you would need to have somehow broken the previous one already, and (b) you haven't provided a single justification why we should believe you that it's so unlikely for NSA to have broken AES in the first place (and why (a) doesn't make this irrelevant anyway). At the bare minimum, you need links. But a sound argument would be better. Your response to this is just "go write your own answer"? Really? $\endgroup$
    – user541686
    Commented Feb 1, 2017 at 20:20

Block ciphers are already built of multiple components: AES = fixed 8-bit sbox, MDS matrix multiplication, 8-bit rotations Twofish = key dependent sboxes, MDS matrix, 1 and 8-bit rotations, PHT

Chaining ciphers adds more components, more rounds, more complexity

Depending on chaining implementation, a different IV is not required for each cipher. For example, the first algorithm uses the selected mode, and the next in the chain only use ECB; or the other way around. Choosing the modes and the order they are chained is important.

Different keys should be used, otherwise there is no increase in effective key space, just cipher complexity and round count.

As long as the algorithms are not some kind of inversion of eachother, it effectively increases the total keyspace of the cipher chain, in addition to increasing the round count. Additionally, the different building blocks make certain attacks more difficult, where the similarity between rounds is exploited. It is better to build a cipher with more complexity than rely on the complexity of the chain, as one complete weak cipher may be "peeled off".

Rounds of one cipher cancelling out rounds of another is a distinct concern, and if the ciphers are the same (DES to 2DES, 3DES,.. NDES) there are attacks that will exploit this and reduce the effective key space. Assuming the underlying block ciphers are strong against all attacks, the upper bound on the chain security will be the combined upper bounds of each cipher's security, but can be lower in practice, especially if implemented poorly.

I tried to summarize points in one of the comments to the original post, certain points may be unclear or not touched upon

  • $\begingroup$ side note, I use a 2 cipher chain construction with AES as both primitives in 2 different modes of operation, first CTR, then OCB, each with 128-bit keys, which should provide better diffusion than 256-bit AES in OCB only, and allows multicore optimization as well as precomputation. $\endgroup$ Commented Sep 12, 2013 at 18:47
  • 2
    $\begingroup$ This reply contains suggestions which I would recommend against. "Complete weak cipher may be peeled off". This is true, however, the reason multiple ciphers practice is not recommended is that implementation mistake may allow breaking entire chain. If multiple different kind of modes are used, it is important to carefully meet requirements of each mode. $\endgroup$
    – user4982
    Commented Sep 12, 2013 at 20:07
  • $\begingroup$ The only suggestion I thought I made was "Different keys should be used", which is actually more of a statement. I did touch upon the importance of mode selection, and as always, implementation mistakes can break any cryptosystem regardless of cipher(s) used. Chaining or cascading does carry its own set of possible mistakes, I tried not to give any instructions on how to implement chaining or cascading securely. $\endgroup$ Commented Sep 13, 2013 at 3:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.