Ok so let's say I have some top secret data ~ 50-100 MB and I need it to be protected. The cipher operation mode and the KDF is irrelevant for this example. Let's just assume we use gpg.

The only possibility is either single AES-256 encryption, so 14 rounds with a 256 bit key size or dual AES-128 x2 (cascade) with 20 rounds and an effective key size of 256 bit.

The AES-256 would be 140% slower, while the AES-128 cascade would be 200% slower when measured against AES-128.

So which of the 2 should I take and why?

Is the effective key size of 2 x 128 bit really as strong (or even stronger) than the 256 bits of AES-256?

  • 11
    $\begingroup$ You can run a meet-in-the-middle attack against the double encryption giving your $2^{129}$ time complexity (and $2^{128}$ storage complexity). $\endgroup$ – SEJPM Jul 18 '17 at 16:04

Using double encryption is always attackable with a Meet in the middle attack which reduces the effective strength to $2\cdot 2^{128}$ (in your case), but requires a lot of memory ($2^{128}$ blocks must be stored).

This is the very reason, why one uses a triple-encryption scheme to strengthen DES to 3DES via the EDE construction.

Besides: you have a standardised scheme which has been proven to be secure and works on 256-bit keys. There is absolutely no reason to make your life more complicated and insecure by trying homegrown constructions.

  • $\begingroup$ Even 3DES is vulnerable to a meet in the middle attack, just not as bad as it could be. $\endgroup$ – forest Dec 15 '17 at 6:06

I can only see one advantage, and in this case the mode does matter. You have your keys $K1$ and $K2$, and your 2 ciphers, $E_{K1}$ and $E_{K2}$. Using 2 ciphers in a cascade allows you to do this:

$A$ = $E_{K1}$( $n$ $||$ $i$ )

$B$ = $E_{K2}$( $A$ $\oplus$ $P_i$ )

$C$ = $B$ $\oplus$ $A$

Where $P$ is the plaintext block, $n$ is a nonce, and $i$ is a block counter matching the index of $P$. This mode is an XEX type, it is fully parallel and seekable like ECB and CTR for both encryption and decryption.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.