# Why do we use multiple rounds of encryption?

I understand that DES and AES use multiple rounds of encryption to secure the cipher text output, what is the real reason this is carried out?

Is there a certain point performing multiple rounds becomes pointless not relating to security; as of course performance becomes an issue at some point?

Do all encryption algorithms require multiple rounds in order to make them secure?

• Related: Why does SHA-1 have 80 rounds? Jan 4, 2018 at 11:34
• For the same reason that cards are shuffled multiple times.
– fgrieu
Jan 4, 2018 at 11:48
• Jan 4, 2018 at 22:58

Using the same scheme multiple times will allow for efficient crypto-analysis. If the cipher cannot be analysed then this will be considered detrimental to security. The cipher itself doesn't need to be hard; it just must be hard to reverse without the key. The rounds themselves do not provide enough confusion to be considered a full cipher themselves.

Having rounds where the same scheme is repeated allows for efficient implementation, making the code size much smaller and easier to protect against side channel attacks.

Yes, the required number of rounds can be limited to the best attack available. Generally any cipher with rounds will have successful (if theoretical) attacks over a number of rounds. The problem is that you don't know which attacks will be devised in the future.

So in the end some kind of margin is in order; there is a non-trivial balance between future proofing an algorithm and performance. To what number of rounds an algorithm is tweaked is often subject to discussion.

Having at least 3 "spare rounds" is probably advised. That doesn't take into account the complexity of each round (Threefish is used with 80 lightweight rounds while AES uses a minimum of 10, more complex rounds). You'd expect more "spare rounds" when a lot of rounds are required in the first place.

Generally block ciphers will use rounds, but stream ciphers may use different ways of generating a key stream. Asymmetric encryption such as RSA generally doesn't use rounds at all.

It's certainly not a theoretical security requirement to use rounds.