This may be a difficult question
- So, $C_1$ = AES-GCM($k_1$, nonce, message) where nonce = HMAC(key,message). $C_2$ = AES-CBC($k_2$, iv, $C_1$).
- Now, a security breach occurs. The adversary obtains $k_1$ and $C_2$ because they are the most vulnerable parts of my encryption scheme. I change the keys in this instance and re-encrypt the database.
- Now, $C_3$ = AES-GCM($k_3$, nonce, message). $C_4$ = AES-CBC($k_4$, nonce, $C_3$).
- Then there is another data breach. The adversary now has $k_3$ and $C_4$.
1.) If the adversary has $k_1$, $k_3$, $C_2$ and $C_4$ can he decrypt the messages?
TL,DR explanation
In my encryption scheme, I have two sets of 256 bit secret keys [$c_1$,$c_2$] used to encrypt data. The first key is used by my customers to encrypt data using AES-GCM. The second key is used to encrypt the data once again using AES-CBC with PKCS#7 padding before being saved on the server. Please assume I never repeat the same 96-bit nonce when using AES-GCM. My message length is short and the number of messages encrypted will remain well below 1 billion.
How would a worst-case scenario play out assuming the adversary already has the customer key? If an adversary obtains the data on the database I will change the keys and re-encrypt the data using the new keys. If an adversary then obtains all of the data once again can he break my encryption assuming he has the customers key?