I am new to crypto and wondered what would happen when we encrypt twice using any algorithm and the same key. Consider two block ciphers A and B. We generate the ciphertext as c = A(B(m)) for any message m. If they are in the same message space and they map to the same ciphertext space, why would using the same key on both schemes make the encryption insecure? I have understood meet in the middle attack and the general idea of collisions when using two functions mapping to the same ciphertext space. Is there any other approach?

Edit: I am also looking for attacks except the case where one encryption undoes the decryption of the other. eg. B is inverse of A

  • 2
    $\begingroup$ Hint: Make B = AES encryption, and A = AES decryption. $\endgroup$
    – fgrieu
    Sep 17, 2015 at 2:04
  • $\begingroup$ Hey, I forgot to add that case too! I am looking if there are attacks beyond meet-in-the-middle, collisions and one encryption undoing the other.. $\endgroup$
    – Kat108
    Sep 18, 2015 at 2:43

1 Answer 1


I'll be answering the question as in its body, which does not match the title (double encryption implicitly refers to using the same block cipher for each encryption, when the question is explicitly about two block ciphers).

With only the hypothesis that $A$ and $B$ are secure block ciphers sharing block size and key size, we can't conclude that the compound block cipher $G$ defined by $c=G_k(m)=A_k(B_k(m))$ is secure. An extreme example is that $G$ could be the identity function (e.g. $B$ could be AES-256 encryption, and $A$ AES-256 decryption).

And we can't make a rigorous exception for that case: $A$ and $B$ can interact badly in many ways to that $G$ is weak when $A$ and $B$ are secure (e.g. $B$ could be AES-256 encryption except for a modified S-box in the first SubBytes, and $A$ straight AES-256 decryption, so that $G_k$ is a transformation with no diffusion between bytes of a block, and quite a weak transformation of each byte).

On the other hand, there are (overwhelmingly many) cases where $G$ is more resistant to attack than either $A$ or $B$ is (e.g. $B$ could be AES-256 encryption reduced to the initial AddRoundKey and first 7 rounds, and $A$ AES-256 encryption reduced to the last 7 rounds, so that $G$ is the full AES-256). Thus we can't hope for general attacks working against $G$.

Thus, sorry to say, but what's explored with the question's body appears to be a dead end.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.