Are there any instances where a combination of industry standard encryption algorithms can weaken the overall encryption of the data?

As a Naive example using non-standard encryption algorithms, running ROT13 on textual data a second time would actually unencrypt the text.

  • 1
    $\begingroup$ Encryption can't weaken another encryption if the keys are indepentend. If this would be possible, you could just encrypt already encrypted text and then use this attack on the output - which would break any encryption. $\endgroup$ – Nova Jun 11 '15 at 10:36
  • $\begingroup$ @Nova: here's an counterexample: the first algorithm is GPG with the common option of plaintext compression before encryption, and the second is AES-CTR with random IV; the ciphertext for a 1MB text document will be recognizable from the ciphertext for a 1MB mp3 file (the former will be much smaller than the later), which is at least a theoretical weakness; when the second algorithm alone does not exhibit this leak. Other counterexamples are possible if we consider timing or side-channel attacks on the first algorithm. $\endgroup$ – fgrieu Jun 11 '15 at 11:08
  • $\begingroup$ So as you already gave an example where the combination does weaken the overall encryption, I presume that you want to exclude the possibility that a keyed encryption algorithm is the direct inverse of one of the other encryption algorithms? And the same if a combination of keyed encryption algorithms is the direct inverse of one of the other algorithms? $\endgroup$ – Maarten - reinstate Monica Jun 11 '15 at 12:45
  • $\begingroup$ I would argue that plaintext compression should not be considered "another encryption algorithm". In your example, using CAST5 (GPG default) without compression followed by AES with different key certainly does not weaken the encryption. Yes, different files (and file types) compress differently, but so what. The fact that one file compresses smaller than another one only reveals that either it was a smaller file to begin with or it had a higher redundancy (and you can't tell which after encryption!). Compression before encryption removes redundancy and thus strengthens encryption. $\endgroup$ – Damon Jun 11 '15 at 14:39
  • 3
    $\begingroup$ "Compression before encryption removes redundancy and thus strengthens encryption." Citation needed. Modern ciphers in general should not be vulnerable to repetition in the plaintext. $\endgroup$ – Maarten - reinstate Monica Jun 11 '15 at 16:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.