# Using caesar crypt, then encrypting the output with pgp, then encrypting that with aes256

Is that possible? Well, of course it is, but if you decrypt it, will it show the actual message in the final output? This isn't me actually doing this in practice, just if it is possible.

Lets say you encrypt this message: "faeces" with the caesar encryption by using key 22. The output will be a bunch of random crap. Take that random crap and encrypt it with pgp, you'll get even more random crap. Then encrypt that random crap with aes256 and you'll get the most random crap you've ever seen.

Now you decrypt the aes256 and you get less random crap, then you decrypt that and get even less random crap, then you use key 4 to decrypt the caesar method, will ya get "faeces"?

• Encrypting twice may, or may not, enhance security. Consider the amount of security provided by applying ROT13 twice. – rossum May 29 '17 at 14:42
• OK, so we have a classical cipher (Ceasar cipher) that doesn't add any security, a protocol that can be configured for encryption or for instance signature generation using a whole host of algorithms (PGP) and finally a block cipher - which isn't a semantically secure cipher in itself (AES). Although they all have to do with encryption, basically that's where the comparison ends. You may want to reconsider what you're trying to do. – Maarten Bodewes May 29 '17 at 19:28

The most basic property of a cryptosystem is what is called functional correctness. Intuitively this is the property that the cryptosystem works always when it isn't under attack. Formulated in a more mathematical way, let $i\in\{1,2,3\}$ and $\mathcal K_i$ be the sets of all possible keys for each encryption algorithm. Furthermore let $\mathcal P_i$ and $\mathcal C_i$ be the plain- and ciphertext spaces of all the three algorithms such that $\mathcal P_2=\mathcal C_1$ and $\mathcal C_2=\mathcal P_3$. Finally let $E^i_K(p)$ denote the encryption of plaintext $p$ under key $K$ using scheme $i$ and $D^i_K(c)$ be the corresponding decryption of the produced ciphertext. The scheme $i$ is said to be functionally correct1 iff the following statement holds:
$$\forall k\in\mathcal K_i:\forall p\in\mathcal P_i:D_k^i(E_k^i(p))=p$$
Now we have picked scheme $1$ to be Caesar-encryption, scheme $2$ to be PGP-encryption and scheme $3$ to be some AES-based encryption. We assume that all of these are functionally correct (which they should be). Finally we picked $p=\text{faeces}$. Now we encrypt: $c=E^3(E^2(E^1(p)))$ and decrypt $p'=D^1(D^2(D^3(c)))$. If we substitute, we get $$p'=D^1(D^2(D^3(E^3(E^2(E^1(p))))))=D^1(D^2(E^2(E^1(p))))=D^1(E^1(p))=p$$ as expected and required (keys have been left out of the equations for improved readability). It follows that we retrieve "faeces" upon decryption and that the newly constructed scheme is functionally correct.
1: Actually sometimes you also see the different formulation that a scheme is functionally correct iff it returns the right plaintext with overwhelming probability. Mathematically that means, that for some security-parameter $l$ the following should hold: $\forall l\in \mathbb N:\forall k\in\mathcal K:\forall p\in\mathcal P:\Pr[D_k(E_k(p))\neq p]<\operatorname{negl}(l)$ where $\operatorname{negl}(\cdot)$ is a negligble function, ie a function that approaches 0 faster than any polynomial.