I'm not cryptography expert but I have this doubt…

Suppose I have 2 different keys:

  1. secretkey1
  2. secretkey2

And a plain text:

  • myReallySecretPlainText

If I use AES-128 on my plain text with my first key I get this:


now, if I use on this cipher text my second key I got this:


Looks pretty safe, but I have a doubt: does this have the same security of a AES-256? Or does it have the security equivalent to a single 128 bit key?

  • 2
    $\begingroup$ It's weaker than AES-256 against generic attacks. There is a meet in the middle attack which can break it with cost 2^128 (not sure how applicable the attack is with realistic cost models). See Attacking 2DES efficiently. Search for DES meet-in-the-middle for several related question. $\endgroup$ Jan 29, 2014 at 16:43
  • $\begingroup$ If you are going to do a double encryption, it is best to use different algorithms, and if possible different modes. For example, AES128-CTR(Twofish128-ECB(Plaintext,Key),Key,Nonce). This is extremely fast and allows "false length" outputs on the CTR wrap. $\endgroup$ Mar 25, 2014 at 4:37

1 Answer 1


The idea you describe is vulnerable to a meet-in-the-middle attack that work in approximately $2^{128}$ time and $2^{128}$ memory. The attack assumes knowledge of plaintext/ciphertext pair(s). Given a pair, you encrypt the plaintext with every possible key 1 and store those values. You then decrypt the ciphertext with every possible key 2 and look for a match between the two datasets. Say you find that $E_{k_1}(P)=D_{k_2}(C)$. Likely these are your two keys. This can be validated by looking at additional plaintext/ciphertext pairs.

As codesinchaos says, the attack may not necessarily be applicable with realistic cost models, but it is a theoretical break and is therefore considered weaker than just using a larger key space in the first place. Also, I've got to believe that this idea is slower than just using AES-256.

  • $\begingroup$ Not that AES-256 is per se more secure than AES-128. $\endgroup$ Jan 29, 2014 at 18:55
  • 1
    $\begingroup$ @StephenTouset True, but it's very likely that it is more secure. The one big issue found so far is specific for related key attacks, which is not applicable in most protocols using AES. $\endgroup$
    – Maarten Bodewes
    Jan 29, 2014 at 19:23
  • $\begingroup$ @mikeazo thank you for your answer! I want to use this "double aes128 method" because i have to cipher lot of things, with a double ciphering where the second key is always different i can make attacker's life more hard :) i remember something about the meet in the middle attack, looks like it can't be applied in this case due the impossibility to know a plaintext/ciphertext pairs since the key change for every element. Thank you again! $\endgroup$ Jan 30, 2014 at 8:00
  • $\begingroup$ @AlexanderPD, what sort of attack are you worried about?To be honest, if I saw "double aes128 method" used in a real world system, I would run away from it as fast as I could. While the attacks might be theoretical, it does not follow good design principles from a cryptographic prospective. Chances are, whatever attack you are worried about can be mitigated using standard cryptographic processes and procedures (or perhaps by something else). $\endgroup$
    – mikeazo
    Jan 30, 2014 at 19:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.