If I use the output of a cipher, for example a block cipher such as AES and encrypt it again with the same algorithm, I read that this introduces weaknesses into the overall security of the system.

Is this the case?

  • $\begingroup$ Hi rezx, I have edited your question to tidy it up and I think better reflect what you are asking (you're asking with regards to truecrypt I believe?). If I've mis-interpreted, please feel free to click the edit link and improve on my edit. Do you think it would be a good idea to re-title the algorithm to specifically mention block ciphers, or are you interested in the general case too? $\endgroup$ – user46 Apr 9 '12 at 14:14
  • $\begingroup$ sure, do what u think is better, my english isnt very good in long sentence :) $\endgroup$ – rezx Apr 9 '12 at 14:16
  • $\begingroup$ no problem :) I think as you're interested in block ciphers it might be better to focus on those - if you're then curious about public key systems you could always then ask another question. I'll go ahead and change it. $\endgroup$ – user46 Apr 9 '12 at 14:18
  • $\begingroup$ Hello, @rezx. Where did you read that? $\endgroup$ – Hilder Vitor Lima Pereira Feb 23 '16 at 16:42

Well, I don't know where you read that. However, depending on what they meant by that, that's either nonsense, or an appropriate cautionary tale.

What is known is that encrypting again cannot make the cipher weaker, as long as the keys you chose to encrypt a second time are independent of the keys you use the first time. The logic behind this is straight-forward; the attacker is assumed to know everything about the cipher except the keys. If he has some ciphertext that he wants to attack, there's nothing preventing him from picking his own "second time key", and then encrypting the ciphertext to form a doubly-encrypted ciphertext. If double-encrypting was inherently weaker, then he could attack that (and hence single-encryption would be equally weak).

On the other hand, if the two keys you use during the first and the second use are the same, this logic does not apply. And, in fact, there are ciphers where this encrypting twice with the same key is a Bad Idea. For example, some ciphers will, if you run the ciphertext through a second time with the same key, will generate a 'doubly-encrypted ciphertext' that is exactly the same as the plaintext; this is obviously weaker than the 'singly-encrypted ciphertext'

  • $\begingroup$ "as long as the keys you chose to encrypt a second time are independent of the keys you use the first time" This is not right, encryption keys are usually long lived keys. In fact, your statement questions the semantic security of the PKC in multiple message model. The second paragraph holds only for information theoretic security and that is because of Shannon's lower bound on the size of the key length. $\endgroup$ – Jalaj Apr 9 '12 at 13:26
  • 2
    $\begingroup$ @Jalaj: I'm not at all sure what you're disagreeing with. The second paragraph says "if you use independent keys, you are safe"; do you disagree with that? The third paragraph says "there are ciphers (not necessarily public key ciphers) that, if you encrypt again with the same keys, do become weaker"; do you disagree with that? $\endgroup$ – poncho Apr 9 '12 at 13:40
  • $\begingroup$ @poncho u may be logic when i read it i miss understand, they mean if i use the cipher text to encrypt again with another algorithm like what happen in truecrypt.. AES-twofish-serpent.. but never know why that could make it less secure? $\endgroup$ – rezx Apr 9 '12 at 14:09
  • $\begingroup$ I don't disagree with your comment, but I disagree with the formulation of your answer which for the first time gives an indication that you need to keep the keys independent if you want to use the same cipher text again. I just figured out that I was a bit hasty in making the second comment. You can construct an artificial PKC which is secure on one encryption, but leaks least (most) significant bits when doubly encrypted with the same key. $\endgroup$ – Jalaj Apr 9 '12 at 14:09
  • $\begingroup$ @rezx: if you use a different algorithm to doubly-encrypt, the same argument applies; if you use independent keys, the resulting cipher is at least as strong as the stronger cipher in the stack. If you reuse the same keys, well, AES/Twofish/Serpent are sufficiently different that you're quite likely to be secure, but the logic I gave doesn't ensure that. $\endgroup$ – poncho Apr 9 '12 at 14:19

I assume you mean that you have encrypted a message $M_1$ (string of information) with AES and a key $K$, received an output $C_1$, and now want to insert the output $C_1$ back through AES (as a new $M_2$) using the same key $K$ to produce another output $C_2$. This is called super-encryption.

Since you deem AES to be secure to start with, it would be reasonable to assume it will not introduce a computational complexity security weakness. Repeating with the same key increases the computational complexity required to brute force the super-ciphertext, but not its security complexity (this is done by increasing the key). If you assume that all public block ciphers have inverse functions where given a ciphertext and a possible message one can get the Key (why brute force the key, when the message probabilities are lower, right?), and you must assume this, then your super-encryption process increases security, but only insofar as a super-inverse function has not been created. Using different keys solves this problem.

From an information theoretic perspective, read Shannon's "Communication Theory of Secrecy Systems" (PDF). If your message is shorter than the key you used, it has "perfect secrecy" to start with and there's no benefit to super-encryption. If your message is longer than the key but shorter than the unicity distance (The number of key characters / the redundancy in the message - use 84% for English), then in the case of a 256 bit key, 32 characters, you benefit from "ideal secrecy" for the first 38.09 characters only. Since 39 characters falls within 2 blocks, a brute force attack on the first two blocks only is sufficient to message-brute-force your ciphertext (even if super-encrypted). Increasing the key size, using 2 independent keys, for a key of 64 characters, moves the unicity distance to 76.19 characters, requiring 4 blocks to message-brute-force. A much greater computational complexity problem, but irrelevant in an information theoretic context. Note, this rule applies irrespective of the length of the ciphertext or super-cyphertext. Beyond the unicity distance, any cipher has no information theoretic security to speak of - it's "pseudo-security".

Contrary to public belief, attaining information theoretic security is not impossible, its actually quite easy, just stop thinking inside the box. There is no box, and it's your kind of question which helps us push the boundaries of what is possible.


I'd like to expand on some claims in previous answers.

@AlbertVeli writes

encrypting a block twice with the same algorithm and key ... does not increase security

Rule of thumb is that it's true, however, you can imagine a crypto algorithm with not good enough properties, like bit diffusion. With such algo, applying encryption twice even with the same key may make it more secure (against non brute force attack).

But not talking about same keys, applying same algorithm several times definitely can improve the strength, actually, that's how venerable 3DES works - once original DES was found too weak, guys just took 3 times more bits, split them in 3 keys, and applied one after another (they did extra trick of applying "encryp-decrypt-encrypt").

Finally, it should be noted that a typical crypto algorithm consists of number of same (or highly similar) rounds. Each of them works while not with the same key, but with the set of keys directly derived from the original (i.e. inter-related). It's exactly repetition of these small sub-algos sufficient number of times what makes overall algo secure. For example, there're known attacks on reduced-rounds AES, but after some number of rounds, diffusion and permutation are that much, that dataflow analysis becomes infeasible (so far).

So, summing up, applying same algorithm several times can lead to continuum of consequences - from complete annihilation of encryption (XOR 2 times with the same key) to turning otherwise non-secure crypto-primitive into a really secure encryption.


No, encrypting a block twice with the same algorithm and key does not introduce any weakness. But on the other hand, it does not increase security either. The only difference is that a brute-force attack will take twice as long to perform. In the case of AES a brute-force attack already takes long enough to perform so there is no need to encrypt twice.

If you have several blocks and want to encrypt them with the same cipher and key, then the security depends on what mode you choose. In short, never use Electronic Code Book. If the clear-text is the same for two blocks, the cipher-text will also be identical in ECB mode. If you use CBC, make sure to always use a random IV. The IV must not be predictable. A good way is to encrypt a nonce and use the output as IV for CBC. The nonce value may not repeat as long as the same key is used. The recommended mode is ctr. It has several advantages over CBC (ctr can be computed in parallel, you can encrypt more blocks with ctr than CBC before having to change key, you never need a dummy padding block with ctr and if both sender and receiver keep count of the ctr variable, then you don't even have to include the ctr, in CBC you will have to send the IV in cleartext).

Edit. If you use counter mode, do not encrypt the same block twice with the same key and counter. The encryptions will cancel each other and produce the clear-text as cipher-text.

  • $\begingroup$ If Brute Force takes twice as long, doesn't that automatically improve security? $\endgroup$ – user93353 May 15 '13 at 4:33
  • 1
    $\begingroup$ Although your later comments clarify the situation, your initial claim is false (stream ciphers are catastrophically broken if you double-encrypt under the same key!) $\endgroup$ – Cryptographeur Feb 23 '16 at 11:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.