2
$\begingroup$

Say I have 

$k1 = "keyhere";
    $k2 = "keyhere";

$rc4key = sha256($k1 . $seed);
    $aeskey = sha256($k2 . $seed . $rc4key);

$input_data = "hello world";

$rc4 = new RC4 -> encrypt($input,$rc4key)
    $aes = new AES -> encrpt ($rc4, $aeskey);

Meaning... If I have two keys (1 rc4 and 1 aes), Is it more secure to encrypt my RC4 output with AES, than to use AES or RC4 alone and a single key?

Improve this question
$\endgroup$
7
  • 2
    $\begingroup$ More secure against what type of attack? $\endgroup$
    – Stephen Touset
    Dec 10, 2012 at 21:19
  • 1
    $\begingroup$ Also, please note that you are inventing your own cryptography. If this had been analyzed by cryptographers and determined to provide advantages over other methods, it would already be a cryptographic primitive. Just use AES (in EAX or GCM mode, preferably) with appropriately-generated IVs and be done with it. $\endgroup$
    – Stephen Touset
    Dec 10, 2012 at 21:21
  • $\begingroup$ I didn't think that using RC4 with one key, and then encrypting the result in AES with another key would be considered making your own cryptography. I see encryption modules that use AES + Blowfish or Twofish. How is this different? Using an existing RC4 module and encrypting the output with a different key using AES. I'm not inventing my own cipher -- it is simply encrypting with RC4 (with one key) and encrypting the result with AES. $\endgroup$
    – Jeremy P
    Dec 10, 2012 at 21:36
  • $\begingroup$ Is there any other asymmetric encryption systems beside RSA? I need a two-key system, although the above example is symmetric, asymmetric is preferred. $\endgroup$
    – Jeremy P
    Dec 10, 2012 at 21:39
  • $\begingroup$ Inventing your own cryptography doesn't mean inventing your own cipher. You're inventing a cryptographic protocol which (probably pointlessly, possibly insecurely) combines two ciphers. What are your actual security goals? "I need a two-key system" sounds suspiciously like a feature checklist driven by people who have no idea about security or cryptography. $\endgroup$
    – Stephen Touset
    Dec 10, 2012 at 22:41

1 Answer 1

Reset to default
6
$\begingroup$

What type of attack are you trying to prevent?

If it's a brute-force attack, AES-128 is more than sufficient. In the best case scenario, combining RC4 and AES gains you negligible additional security due to a meet-in-the-middle attack.

Are you trying to hedge against a "break" of either RC4 or AES? If so, in the real world, this is extremely unlikely to happen. If either one is weakened by a cryptanalytic result, you will have plenty of time to migrate away from the affected cipher — and you should do this regardless of if you're encrypting only with this cipher, or encrypting with two separate ciphers.

So, practically speaking, there's very little upside. On the downside, you're now heavily increasing the likelihood that you implement the cryptography incorrectly. It's infinitely more likely that you will, as an amateur cryptographer, generate keys insecurely, store keys insecurely, generate two keys that are not independent of one another, use an insecure mode of encryption (e.g., ECB), use static IVs, generate IVs that don't satisfy the requirements of the cryptographic mode for which they're used, fail to use authenticated encryption (e.g., GCM / EAX modes), introduce timing attacks when creating your own authenticated mode (e.g., CTR + HMAC), and so on. There is a near infinite number of ways in which even experienced cryptographers can fail when working directly with ciphers, and well-intentioned amateur cryptographers have practically no hope of implementing it correctly.

The general advice here is to use a high-level cryptographic library like NaCl or KeyCzar that handles the details for you. If you're typing the letters A-E-S into your code, you're doing it wrong.

Improve this answer
$\endgroup$
2
  • 5
    $\begingroup$ "you will have plenty of time to migrate away from the affected cipher" While you can upgrade authentication, you can't really upgrade confidentiality, since an attacker can simply store the old ciphertext. So in many scenarios you need a time-machine to do that. $\endgroup$
    – CodesInChaos
    Dec 11, 2012 at 13:23
  • $\begingroup$ That's fair, and something I hadn't considered. $\endgroup$
    – Stephen Touset
    Dec 11, 2012 at 18:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.