I recently had a discussion with a friend of mine about cryptography. As we are both no experts, I thought that I could better resolve are dispute here.

  1. My friend said that when he used public key cryptography in the past, he used to keep his public key private too. Only giving it out to people that really needed it (i.e. don't post it on the internet, but giving it out personal to a select group of people). He said that this made it harder for third parties to break the encryption that do not have the public key. I argued that he could have better used a symmetric cipher instead of this scheme, as it is a lot faster and with sufficient key size just as secure. So two questions arise here:

    • Does keeping your public key private give you any more security?
    • Does this scheme have any advantages over a symmetric scheme?
  2. Also he said that he used to combine different ciphers and run them a random amount of times. Only the other party knows how many times and what cipher combination. He said that it not only makes the encryption stronger by enlarging the effective calculation time, but it also introduces a human factor, that is someone has to think this out and make the decision to try different ciphers different amounts of times. I argued that this is true, but unnecessarily complicated, because choosing a large enough key size for a single cipher will be just fine (can cost thousands of years), even for military security. So:

    • Are there any REAL benefits of running different ciphers for random amount of times to try to confuse the attacker? Or is this just unnecessarily complicated?

To clarify:

  • With military security I mean that, at the current moment, it is impossible to break the encryption, even for governments institutions (like the NSA).

  • To better illustrate my question: instead of giving out your public key to a select group of people, you give it out to one individual. Furthermore, you can be sure that he knows how to handle a key ring and that he has no benefit from leaking your public key (i.e. he has no benefit from leaking the clear text you messaged to him)

  • $\begingroup$ One thing about your 2nd point with the symmetric scheme: In symmetric encryption you have to be really careful not to reuse keys. Symmetric encryption has two properties, which might be bad for security: It is deterministic, so that encrypting the same message is the same ciphertext, which might be a security issue. And then there is the problem that if you share a symmetric key with several people all of them can decrypt all messages. Therefore, best stick to the common practice of hybrid systems: Encrypt messages d with an entirely random symmetric key, and this key is encrypted with PKC. $\endgroup$ – tylo Oct 28 '13 at 10:43

Keeping the public key private:

  • Does not help in protecting data.
  • Does not work: depending on the algorithm, the public key could be recomputed from the exchanged messages.
  • Does not work: something which has been communicated to more than two people cannot be considered secret anymore. Especially since public keys are commonly written everywhere without any particular protection.
  • Does not work: people who would bother trying to crack your friend's private key would be people interested in your friend's secret, so chances are that they already have the public key (the attacker is one of your friend's friends, or already has hijacked the computer of one of your friend's friends).

As for cascading ciphers, it just makes processing slower, and more complex, both activities being ultimately detrimental to security (way more than the off-chance that one of the algorithms is actually weak, which does not happen often as long as none of them is a homemade cryptosystems -- these, of course, are almost always laughably vulnerable).

And "military security" is not stronger than normal security; it is just usually much more expensive.

  • $\begingroup$ Cascading ciphers is a practice that can work, i.e. it can be more secure than using single cipher. It just needs to be implemented very carefully. It is likely not a good idea for the scenario mentioned by the original poster. However, if the intent is to encrypt data that needs to stay confidential for very long time. Example: TrueCrypt one of notable products providing support for multiple ciphers, because life time of stored data can be very long. $\endgroup$ – user4982 Oct 27 '13 at 8:57
  • $\begingroup$ Thanks for your answer, but I think its kind of shallow. Could you please give me some more technical details (i.e. why? which algorithms? examples?) PS. I updated my question, please read the EDIT section. $\endgroup$ – Jori Oct 27 '13 at 10:53
  • $\begingroup$ Also why do you say that cascading ciphers don't work? I though that DES-3 is still pretty common (although you could better use AES). There is even a whole Wikipedia article on this. Could you please clarify your answer? Thanks in advance :-) ! $\endgroup$ – Jori Oct 27 '13 at 10:59
  • $\begingroup$ Triple-DES is needed, because brute-force attack against single-DES is very fast. This is not the case for ciphers user currently (with 128-bit key or larger key). This topic or cascading ciphers has been covered in many questions on this site. You may want to read Is TrueCrypt's multiple cascading encryption safe? for example of popular product where cascading encryption is used (apparently well). You may use the search to find more details on e.g. Triple-AES or public keys. $\endgroup$ – user4982 Oct 27 '13 at 13:23

I've added a few comments already so I decided to write answer to this question. Your friend sounds like 'The Crypto Nut' from a XKCD strip. :^)

Public Key

First of all, public key cryptography does not protect the public key. Thus, trying to keep public key secure does not provide better security, because the algorithms just do not work that way. In fact, it can easily provide worse security: In public key security it is critical to ensure correct public key is being used. Trying to be secretive about the public key may result in it being harder to ensure correct public key is used.

Cascading Encryption Algorithms

Cascading encryption algorithms has been used for famous Triple-DES encryption algorithm, as well as is used by TrueCrypt.

Triple-DES is needed, because brute-force attack against single-DES is very fast. This is not the case for ciphers user currently (with 128-bit key or larger key). Instead, there is large risk that the non-standard construct will make result weaker rather than stronger. We know this to be not the case with triple-DES, because the cipher is well tried, but with ad-hoc combination this may not be the case.

Thus, there is some doubt over how good Cascading Encryption is against the ciphers currently in use: See Is TrueCrypt's multiple cascading encryption safe?.

This multiple encryption blog may be interesting to read. It points out what benefits and drawbacks are provided by correctly implemented cascaded ciphers. I recommend to take a look at it.

Good part is that if one of ciphers is semantically secure the output is.

The worst case highlighted is that in certain cases, the cascade may be only as strong as the first algorithm in the cascade (plaintext distribution).

Long time

Using a cascade may become more useful if the data is retained for very long time, because in this case, threat model certainly contains also possibility of one or more important new cryptographic discoveries, which possible run some algorithms unusable. Tahoe-LAFS is about encrypting data retained for very long period of time. They are about to standardize on combination of XSalsa20 and AES-CTR.


There was nothing about authentication in the question. Usually either authenticated encryption or separate authenticity algorithms need to be used to ensure correctness of the data.

If there is need to authenticate the data, there maybe be also the problem of combining authenticity mechanisms.


Public Key: No you do not need to keep public key's private or secret. It does not work. Cascading ciphers: The information is very mixed. If you do this, please be very careful. It is a solution that usually is not needed and the added complexity may very well result in lessened security.


Keeping the key secret

Here's an argument that keeping the public/private key secret does not help security.

Suppose Alice believes keeping the key a secret helps security. Suppose Bob does not. They set up a game to try and decide the argument.

At the start of the game Alice picks a random RSA key. In each turn of the game, Bob will a send message to Alice and Alice will return the encryption of that message using the keys she just generated. If the message is longer than the RSA's modulus, Alice just splits the message up in to multiple blocks and sends the concatenation of the encrypted blocks back to Bob. Bob gets as many turns as he likes. His job is to tell Alice the modulus $N$ using the smallest number of turns.

With his first query, he sends a message of say two thousand bits all set to "1". Alice replies with the encryption of the message. However, because all operations in RSA are done mod n, the size of the result leaks the length of the modulus. By varying the length of the string he passes, he can look at the length of the encryption and work out whether he's getting one or more blocks. Using just a handful of queries, he's recovered the length of the modulus.

To recover the modulus' value, he shortens his messages until he gets one block returned. He slowly increases the numerical value of the message until he gets two blocks. The point at which this occurs will be one less than the modulus.

Bob then just increments this value by one an declares his answer to Alice, winning the game. Once Bob has the modulus, he can factor that and break the key pair even though he doesn't know the encryption and decryption exponents.

Cascade ciphers

When you encipher with multiple ciphers, we call that a cascade cipher. There is no proof that this makes the resultant encryption any harder to break. The only proof we have is that any cascade is only a good as the strongest cipher.

To demonstrate this, imagine a cascade of AES in CTR, and a simple XOR with a repeating five byte key. Clearly, the security of this scheme is identical to AES in CTR.

Now it could well be the case that a Serpent, AES and Salsa-20 cascade offers more security than either of them does alone but you'd have to prove that in order for it to be remotely sensible.

Most of the time, with 3DES being the only notable exception, cascades just waste CPU cycles. If a cipher can't be distinguished from random, then it can't be distinguished. Adding more transformations to the cipher-text is just wasted effort at that point.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.