# How secure is $\operatorname{AES256}_{\operatorname{ECB}}(\operatorname{ChaCha20}(\text{plaintext}))$?

Suppose I encrypt a bytestream using ChaCha20, and then encrypt the resulting ciphertext using AES in ECB mode. How secure is the combination?

• That is called XE mode, it has good provable security properties – Richie Frame Apr 8 '16 at 1:27
• @RichieFrame how much stronger than ChaCha20 or AES-CTR seperately? – Demi Apr 8 '16 at 2:16
• Strong enough that any block cipher modes I have designed in the last few years are either XE or XEX type. You get the parallelization of both modes, but eliminate their weaknesses. You can drop ChaCha to 8 rounds, and use AES-128 for additional performance – Richie Frame Apr 8 '16 at 9:05
• @RichieFrame Could we (or preferably, you) answer this by pointing out some kind of paper that explaints or mentions the security properties of XE mode? – Maarten Bodewes Apr 8 '16 at 10:16
• @MaartenBodewes I looked for the reference I was expecting, but only found the one relating to OCB mode. The reference I was expecting was much earlier – Richie Frame Apr 8 '16 at 10:31