Why isn't E' secure if it's built over a secure cipher?

Question

Let $E$ be a semantically secure cipher.

Let $E'(k,m) = E(k,E(k,m))$.

How would one prove that $E'$ is not necessarily secure even if $E$ is?

---

It doesn't make sense to me. If you consider the advantage of an attacker $\mathcal{A}$ over a semantically secure cipher $E$, you have $SSadv[\mathcal{A},E] = \epsilon$, where $\epsilon$ is negligible.

If you call for $E(k,E(k,m))$, you should have $E(k,E(k,m)) = E(k,c)$, where $c$ is $\epsilon$-distant of being random, so you give an advantage of $\epsilon$ to the attacker.

When you compute $E(k,c)$, analogously you give another advantage of $\epsilon$ to the attacker, so you give an overall advantage of $(\epsilon + \epsilon)$, and such a sum would be negligible as well.

Answer 1

Summarizing the answer from the comments:

what happens if E is a stream cipher? ~ Richie Frame

What if you use exclusive-or to combine the key stream instead of addition? ~ Ella Rose

So $c_i=m_i\oplus k_i\oplus k_i=m_i$, and it would be trivially broken. Thanks! I wouldn't come up with the idea of using a stream cipher nor modifying the one-time pad like this. ~ Daniel

Answer 2

The only component that defines security in this case is 'k'. i.e., the more random 'k' is, harder it is for the attacker to guess. Rest of the functions are deterministic. i.e., the definitions of E and E' and m are known to the outside world.

So, it doesn't matter if you do a two level or three level encryption, if you use a single key as a base, then that becomes the single point of attack or the weakest link in the chain. Breaking that would break your n-level encrypted ciphering text.