I have some files that contain important information, so I want to encrypt them by the most secure encryption method possible.

I've read countless StackExchange answers on similar questions and some Wikipedia articles about different ciphers, cryptoanalytic attacks, bad software implementations, cipher modes, etc. Google searches have not helped me in deciding which cipher mode is best, as this may depend on other factors that I will choose in my encryption process.

Having realized that one bad choice when encrypting a file may lead to failure, I want to describe my encryption process and have someone review it for anything that might weaken the encryption.

I do understand that it's impossible to brute force a cipher like AES256, Twofish (256-bit version), or Camellia256--in any practical length of time, according to academic consensus. With that said, I don't want the security of my files to depend on the soundness of a single cipher. Therefore, even if a vulnerability were to be found in one cipher, say AES256, my files would will still be protected by another.

By using multiple ciphers to encrypt my files, I know that I may not be increasing the security of the encryption against brute force per se; rather, I want to increase the security of the encryption against the future failure of a single cipher.

The following may be important in determining things like encryption order, encryption modes, etc.


1) I will be using GnuPG, and the ciphers I trust are AES256, Twofish (256 bit), and Camellia256, in that order.

2) There will be about 10 or 20 files, but I'm not sure yet. All the files are less than 1MB, and some only contain a few words/passwords, etc.

3) Since GnuPG can't encrypt a whole folder, I will need to compress the folder containing my files to a tar.gz file.

4) I will then encrypt this tar.gz file this way:

Enc1=Encrypt(TarFile, Camellia256, Passphrase1)

Enc2=Encrypt(Enc1, Twofish [256 bit], Passphrase2)

Enc3=Encrypt(Enc2, AES256, Passphrase3)


I) Does the amount of the encrypted data matter? If so, what are the minimum and maximum sizes for the encrypted data?

II) Should I add some trivial data to the folder that I want to encrypt, like some random .png or .mp3 files, to avoid the cipher leaking some plaintext data?

How about when I encrypt the Enc1 file, should I add some trivial data to it before encryption?

III) Since I have to compress the folder that contains all the files to be able to encrypt it, does this weaken the encryption in any way? If this is the case, since I can't encrypt a folder without first compressing it, is there a solution?

IV) Knowing that I trust the security of the ciphers in this order--AES256 > Twofish (256 bit) > Camellia256--which one should I encrypt with first and which should be the last?

V) Since I will be encrypting using these three different ciphers, is it important to use different passphrases for each encryption?

VI) Knowing that I will only use ANSI characters--this includes alpha-numerals, lower and uppercase and some special characters--what is the minimum size of the passphrase that I should use? Is there a maximum size for the passphrase past which it will be less secure like in some kind of overflow? Can I use 100 characters? How about 1000 characters?

VII) Knowing all of this information about the data that I want to encrypt, and that I value security over speed, which commands/options/flags should I use with GnuPG to encrypt my files for each cipher to offer the best security possible?

  • $\begingroup$ How will you protect your pass phrases? $\endgroup$ – user2768 Jun 4 '19 at 8:54
  • $\begingroup$ 1) In your proposal, GnuPG is a single point of failure: maybe you would like to use three different applications? 2) Why cannot you use VeraCrypt which provides cascaded algorithms (like AES-Twofish-Serpent)? $\endgroup$ – A. Hersean Jun 4 '19 at 8:57
  • $\begingroup$ tar does not require you to compress. By default it just makes a fancy concatenation of all the included files. $\endgroup$ – jamesbtate Jun 4 '19 at 20:48
  • $\begingroup$ @jamesbtate thanks, I've overlooked that. so would you recommend that I compress or just group the files before encryption? $\endgroup$ – COLD Crypto Jun 4 '19 at 21:05
  • $\begingroup$ You should use Veracrypt because they offer a cascade of ciphers, and you want to encrypt and store folders. Veracrypt makes all of that easy. Put AES256 first, and make sure to use a strong passphrase. Use SHA512. Make sure to move your mouse and/or use the keyboard when instructed. $\endgroup$ – Patriot Jun 5 '19 at 10:18

I) There is no minimum. Maximum in your case is $2^{64} * 16$ bytes with same key.

II) No. No. GnuPG takes care of that.

III) No. Compressing does not weaken encryption.

IV) I don't think it matters because it is not authenticated encryption.

V) Yes, passphrases must be different.

VI) In your case you can get maximally 256-bits of security per cipher. You should use around 50 characters (depending on complexity) per passphrase. More does not hurt.

VII) I don't think you can tweak anything. It is "best security" by default.

It is important to note that GnuPG does not authenticate files encrypted with symmetric encryption, which means you cannot detect, if it has been modified.

You can read more about cascade encryption here: https://blog.cryptographyengineering.com/2012/02/02/multiple-encryption/

  • $\begingroup$ Thanks for your answer. for your V) answer, you say I have to use different passphrase for each encryption. Is this really important? I know that using the same cipher multiple time with the same passphrase is very bad, but in my case it is 3 different ciphers, is this still really the case? $\endgroup$ – COLD Crypto Jun 4 '19 at 20:44
  • $\begingroup$ If using 3 different passphrases is mandatory. For example instead of coming up with 3 completely random passwords, I use one very strong password, but I won't use it directly for the encryption, but rely on the result of sha512 of that password with a different salt for each different encryption as the passphrase. Let say rndpass is the only password that I will need to remember for the 3 encryption. I will use this password a long with a different salt to generate a passphrase for each different cipher. $\endgroup$ – COLD Crypto Jun 4 '19 at 20:52
  • $\begingroup$ passphrase1=sha512(rndpass+1) passphrase2=sha512(rndpass+2) passphrase3=sha512(rndpass+3) supposing that sha512 is very hard to crack, then if if the attacked managed to brute force the first encryption by getting passphrase1 they can't guess passphrase2 because they won't be able to decreypt the sha512 hash. $\endgroup$ – COLD Crypto Jun 4 '19 at 20:57
  • $\begingroup$ If you use same passphrase, after successful break of any cipher attacker could get key for other ciphers. Yes, you can use key derivation function to generate passphrases from master passphrase. $\endgroup$ – LightBit Jun 4 '19 at 21:18
  • 1
    $\begingroup$ Salt does not need to be "strong", it has to be unique. I recommend using existing key derivation function like PBKDF2 or Argon2 to be sure. $\endgroup$ – LightBit Jun 5 '19 at 6:01

Not the answer you're looking for? Browse other questions tagged or ask your own question.