OK, in school, some of the lecturers always say "if you compound the crypto, it may make the cipher weaker".

So, which combinations of algorithms would do this? Why? Can anyone show the mathematical proof?

For example, would RSAk1(AESk2[AESk3[x]]) make the encrypted x weaker? Assuming all keys used are different and randomly generated using a SecureRandom function.

  • $\begingroup$ Hello, while I appreciate the reference, I was not talking about result becoming weaker of the two, and wanted an answer (with mathematical proof), that.. For example (not based on fact, though), RSAk1(AESk2[AESk3[x]]) = DESk4[x]. $\endgroup$ – user3635998 Mar 22 '16 at 11:58
  • $\begingroup$ That Lindell fellow did not cover different algos, different keys. Please also assume that I have 100% control over the application as a dev. Thanks. The RSAk1(AESk2[AESk3[x]]) = DESk4[x] thing was just an example, I could write RSAk1(AESk2[AESk3[x]]) = 1+1, but that looks ridiculous. $\endgroup$ – user3635998 Mar 22 '16 at 12:16
  • $\begingroup$ Oh? OK. Thank you for your replies. $\endgroup$ – user3635998 Mar 22 '16 at 12:20
  • $\begingroup$ I moved my comments into their own answer and deleted them here. $\endgroup$ – malexmave Mar 22 '16 at 12:30

Moving my reply from the comments into a proper answer. The general case of double-encrypting is formally explained by Yehuda Lindell in this answer on crypto.SE. Summing up:

  • Same Algorithm, same key: It may or may not be secure, depending on the properties of the cipher. It is definitely not always secure, but may be secure for practical cases.
  • Same Algorithm, different keys: Secure, because otherwise people who do not know the key could break the encryption by encrypting with a different key, which would be... strange, and not very logical.
  • Different Algorithms, different keys: Secure, for the same reason. Otherwise, sending PGP-encrypted eMails over a TLS connection would be unsafe, which would be ridiculous.
  • Different Algorithms, same keys: Insecure. Never reuse keys for different encryption algorithms (even when not double-encrypting). For example: If you are using the same RSA keys to sign and encrypt, and the adversary can get you to sign a value for them, it can use you to decrypt data, because signature = encryption with the private key = decryption of data encrypted with the public key.

Summing things up: "Don't double encrypt" is a pretty general hint that definitely doesn't always apply, but it serves as a good baseline to avoid critical mistakes. The more nuanced version is "Don't reuse keys for different algorithms, and to be sure, don't double-encrypt with the same key and algorithm, either, it may hurt you".

  • $\begingroup$ Disclaimer: Why I have a background in IT Security and encryption, I am not enough of an expert to give you a 100% certain answer. Take all my replies with a grain of salt and properly analyze any construct you may choose to build, just in case. Also see, for example, this question and answers about common mistakes made in cryptography. $\endgroup$ – malexmave Mar 22 '16 at 12:33

It depends if the algorithm and keys are the same, different or one of them is same and the other one is different. On the other side, according to a study combinations of algorithms give better security assurances has been accepted by the designers of TLS and its predecessor SSL. Both TLS and SSL use various combinations of MD5 and SHA1 instead of relying only on a single hash function. The specification of TLS even explicitly states: “In order to make the PRF as secure as possible, it uses two hash algorithms in a way which should guarantee its security if either algorithm remains secure. (The TLS Protocol Version 1.0. Technical Report RFC 2246, T. Dierks, and C. Allen, 1999.)


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.