Can a broken cipher reveal the key?

Suppose I cascade cipher A and cipher B to encrypt a message. Both ciphers use the same key. I know that theoretically, the security of the setup when used correctly is at least as secure as the most secure. In other works, if cipher A or cipher B is broken, there is still cipher B or cipher A protecting the data. Is it possible under any case for cipher A or B to "reveal" the key, since it's broken? If this happens, then the attacker would know both keys and be able to decrypt the text.

TL;DR: Can a broken cipher ever reveal the key directly?

I know that theoretically, the security of the setup when used correctly is at least as secure as the most secure.

That's true if they use independent keys. If they use the same key, the security of the cascaded cipher may be much worse. Consider the case where cipher B happens to be the exact inverse of cipher A with the same key.

However, that doesn't answer the question you asked (as in the above example, the key is perfectly secure; the plaintext not-so-much):

Can a broken cipher ever reveal the key directly?

Obvious yes. In the most trivial case, consider the 'cipher' the appends the key to the plaintext, and outputs that.

Even if we disallow such obvious egregious examples, we could have a cipher B that encrypts securely, but appends a 'tag' which is a function of the ciphertext and the key (which is common with combined mode ciphers) - if the computation of the tag was weak enough, you could recover the key just with the ciphertext and the tag, even if the plaintext given to cipher B was perfectly secure.

• Consider this scenario: cipher A is the innermost layer and b is the outermost. If I encrypt using cipher A with a key, then encrypt with B using the hash of the previous key, would these keys be mutually independent and therefore secure? To crack this scenario, one would have to start at the outermost layer. Suppose the outermost cipher breaks. This would be okay because the key of the outermost is the just the hash of the innermost, so there is now way to figure the inner key with the outer key. Am I correct? Feb 24 '21 at 0:24