In terms of security, would it be MORE or LESS secure to take, say, an RC4 output (or Serpent) or other, that is encrypted with one key, and to encrypt that output with AES (using a different key)?
> $Data -> Serpent -> key: $s_key = HASH_HMAC(sha256, "1st Key" . > $salt1, "HMAC KEY1") = $S_Output > > $S_Output -> Rijndael (AES) -> key: $aes_key = HASH_HMAC(sha256, "2nd > Key" . $salt1 . $s_key . $salt2, "HMAC KEY2") = $AES_Output
As long as I'm using good hashes as keys, would this be MORE secure than using a single key with AES? Is there a risk of the two ciphers colliding in some fashion? If so, would using a stream cipher instead of another xor-type cipher avoid this?
P.S. THIS IS PSUEDO-CODE -- I will be using truly random salts and keys for my data i.e. mcrypt / openssl
I will be using a software based token system like the RSA SecurID that is on a fingerprint-secured thumbdrive that opens a self-contained browser. Each keyholder has a 512 bit has to open the soft-token automatically. Once the token is posted to the auth site, it gives the pair (two people) 90 min to enter the keys.
Repeat the same thing for user# 2 with the second key.
AND THE REAL KICKER -- aside from the php thumb drive token gen, THIS HAS TO RUN ON PHP, killing the possibility of many other libs that are ideal.
Basically, two biometric token systems + two passphrases within 90 mins decrypts the file. But better to use Serpent + AES, AES + AES, or TWOFISH + AES?