# Why isn't E' secure if it's built over a secure cipher?

Let $E$ be a semantically secure cipher.

Let $E'(k,m) = E(k,E(k,m))$.

How would one prove that $E'$ is not necessarily secure even if $E$ is?

It doesn't make sense to me. If you consider the advantage of an attacker $\mathcal{A}$ over a semantically secure cipher $E$, you have $SSadv[\mathcal{A},E] = \epsilon$, where $\epsilon$ is negligible.

If you call for $E(k,E(k,m))$, you should have $E(k,E(k,m)) = E(k,c)$, where $c$ is $\epsilon$-distant of being random, so you give an advantage of $\epsilon$ to the attacker.

When you compute $E(k,c)$, analogously you give another advantage of $\epsilon$ to the attacker, so you give an overall advantage of $(\epsilon + \epsilon)$, and such a sum would be negligible as well.

• what happens if $E$ is a stream cipher? – Richie Frame Apr 30 '18 at 19:41
• @RichieFrame if $E$ is, for example, one-time pad (which is a stream cipher), let $m$ be the plaintext and $c$ the ciphertext , so instead of $c_i = m_i + k_i$, it would be $c_i = m_i + 2k_i$, and it isn't clear for me how the latter is not secure given the former is secure – Daniel Apr 30 '18 at 20:06
• @Daniel You're almost there: What if you use exclusive-or to combine the key stream instead of addition? – Ella Rose Apr 30 '18 at 20:35
• so $c_i = m_i \oplus k_i \oplus k_i = m_i$, and it would be trivially broken. Thanks! I wouldn't come up with the idea of using a stream cipher nor modifying the one-time pad like this. – Daniel Apr 30 '18 at 20:50

So $$c_i=m_i\oplus k_i\oplus k_i=m_i$$, and it would be trivially broken. Thanks! I wouldn't come up with the idea of using a stream cipher nor modifying the one-time pad like this. ~ Daniel