We want to find the most secure way to encrypt message of arbitrary length
M with AES such that the recipient can only decrypt if they have both AES keys
- AES keys
K2are independent and randomly generated, 256-bit keys
- Assume we'll be running AES-GCM
- Key exchange for the valid recipient has already be performed
- Performance is not a concern (operation is performed less than once a couple of seconds)
Options (I could think of)
Option 1: XOR
Derive a new key
K3 = K1 ^ K2 and perform encryption on
Given that there are no known weak keys or known weaknesses in AES, only practical way for deriving
K3 is by having pre-existing knowledge of
Option 2: KDF
Compute $K_1\mathbin\|K_2$ (concatenation of the two keys) and feed the result to a KDF (perhaps HMAC based KDF) and use the resulting key as the AES key to encrypt
M. I don't think this is significantly different from Option 1, but I'm listing it as an option anyway.
Option 3: Encrypt twice
Perform two layers of encryption:
C1 = Encrypt(M, K1) C2 = Encrypt(C1, K2)
C2 as the cipher text. My intuition is that this should be no less secure than Option 1.
This question is gear towards the two keys being used as something similar to the cryptographic equivalent of "Multi-factor Authentication". In particular, the user has to obtain two different keys (through different means) before being able to decrypt the data.
This question could be extended to the case where there are
N keys. The constraint is that all
N keys will always be required to decrypt the data.