2
$\begingroup$

When transfering data using TLS the browser and server agree the cipher suite to be used - so for example this could be chosen as AES-128 and is (probably) outside of my control. If I separately encrypt a file using AES-256 and then Alice downloads this via her browser (using AES 128) have I still effectively got AES-256 security?

My reasoning goes like this: even if the AES-128 encryption on the TLS link was broken by Eve then all she would get is the AES-256 encrypted file and she would then have to break that encryption to see the plaintext.

Of course the AES-256 key is sent to Alice over a separate channel.

Improve this question
$\endgroup$
1
  • 1
    $\begingroup$ What's described is AES-128 over AES-256, not AES-256 over AES-128 (think of a paint/protection analogy: the second-applied layer is over the first one). As explained by poncho, the answer is a clear: NO. $\endgroup$
    – fgrieu ♦
    Commented May 22, 2014 at 11:09

1 Answer 1

Reset to default
5
$\begingroup$

Obviously, as long as the AES-128 (TLS) channel is keyed independently from the AES-256 (file encryption), the TLS encryption cannot damage the file encryption.

Let us consider what would be true if it could. If that somehow did weaken the file encryption, this would allow this attack on an encrypted file – he could take that encrypted file, and send it through his own encrypted TLS link. He can then use the records from that encrypted link, and exploit the weakness to attack the file encryption.

Since he can do that, any weakness that would apply to the combination would also apply to the file encryption alone. We don't believe that there's anything wrong with the file encryption (assuming that the AES-256 key is randomly chosen), hence there isn't anything wrong with the combination.

Improve this answer
$\endgroup$
7
  • $\begingroup$ Thanks for your answer, a course that I did some while ago warned about making assumptions and so I thought it best to verify with the experts - I hadn't realised that if it were true it would provide an attack. $\endgroup$
    – Bob
    Commented May 21, 2014 at 14:23
  • 2
    $\begingroup$ @otus: actually, if you analyze the outer encryption strength in terms of chosen plaintext attacks, the exact same result applies. $\endgroup$
    – poncho
    Commented May 21, 2014 at 14:41
  • 3
    $\begingroup$ Exact same as? In Applied Cryptography they say: "This can be better phrased: Using a chosen-plaintext attack, a cascade of ciphers is at least as hard to break as any of its component ciphers. A previous result showed that the cascade is at least as difficult to break as the strongest algorithm, but that result is based on some unstated assumptions. Only if the algorithms commute, as they do in the case of cascaded stream ciphers (or block ciphers in OFB mode), is the cascade at least as strong as the strongest algorithm." $\endgroup$
    – otus
    Commented May 21, 2014 at 14:47
  • 1
    $\begingroup$ @poncho: a chosen plaintext attack the outer cipher is equally vulnerable only against pure chosen plaintext attacks in which the key is broken, not in general, like shown in "Cascade ciphers: The importance of being first". $\endgroup$
    – otus
    Commented May 21, 2014 at 15:14
  • 1
    $\begingroup$ @otus: the question is about AES-128 over AES-256 (despite the current title), with the strongest cipher AES-256 first, which is when Cascade ciphers: The importance of being first proves security, and poncho's original argument applies. And the paradoxical phenomenon illustrated in this article applies only if the second cipher allows a distinguisher under chosen-plaintext attack, which is not the case for AES-256 as far as we know. It is thus plausible AES-256 over AES-128 is at least as safe as AES-256. $\endgroup$
    – fgrieu ♦
    Commented May 22, 2014 at 12:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.