Can a broken cipher reveal the key?

Question

Suppose I cascade cipher A and cipher B to encrypt a message. Both ciphers use the same key. I know that theoretically, the security of the setup when used correctly is at least as secure as the most secure. In other works, if cipher A or cipher B is broken, there is still cipher B or cipher A protecting the data. Is it possible under any case for cipher A or B to "reveal" the key, since it's broken? If this happens, then the attacker would know both keys and be able to decrypt the text.

TL;DR: Can a broken cipher ever reveal the key directly?

Answer 1

I know that theoretically, the security of the setup when used correctly is at least as secure as the most secure.

That's true if they use independent keys. If they use the same key, the security of the cascaded cipher may be much worse. Consider the case where cipher B happens to be the exact inverse of cipher A with the same key.

However, that doesn't answer the question you asked (as in the above example, the key is perfectly secure; the plaintext not-so-much):

Can a broken cipher ever reveal the key directly?

Obvious yes. In the most trivial case, consider the 'cipher' the appends the key to the plaintext, and outputs that.

Even if we disallow such obvious egregious examples, we could have a cipher B that encrypts securely, but appends a 'tag' which is a function of the ciphertext and the key (which is common with combined mode ciphers) - if the computation of the tag was weak enough, you could recover the key just with the ciphertext and the tag, even if the plaintext given to cipher B was perfectly secure.