1
$\begingroup$

This is a beginner's question related to general security, but it fits cryptography exchange because it's more specific to the action of cryptographic attacks and how they work.

Assume the following theoretical situation:

  1. I do not know how attacks of all types work programmatically. From the aspect of this question, assume theoretically (hypothetical quantum computing algorithm for example) there is a working attack against AES that can break it or any encryption by whatever means.

  2. BUT we've "double encrypted" our data with two separate symmetric algorithms by means of hybrid encryption. We've also NOT sent keys with the initial message but by some other secured channel.

  3. Attacker (after however many attempts, by whatever means) guesses the correct key for the first layer of encryption and successfully decrypts the first layer.

Questions:

  1. At this point, how does the attacker's system know it has broken the encryption, especially if it has attempted many previous attempts & at insane speeds? Corollary: how can an attacker know they have decrypted successfully since the decrypted text would look exactly like the encrypted text of the next layer of encryption?

  2. Assuming various agencies, countries, or hackers, are capable of breaking various encryption techniques, would such a system (from a high-level viewpoint, based on question one logic) add any level of security?

  3. Would reverse engineering by decompiling such a system enable all layers of encryption to be broken easily?

$\endgroup$
3
  • $\begingroup$ I would also like to add a resource to this question as I believe that it can be somewhat resourceful even though a close duplicate. I found the below link after asking my question which adds to answers. It is borderline duplicate but I think my viewpoint was slightly different and I got a good answer here which sheds some more light on the situation. Resource - "Breaking double encryption" $\endgroup$
    – RobbB
    Jan 22, 2022 at 1:58
  • $\begingroup$ Links to questions and answers are not considered answers themselves, so I converted this answer to a comment. Small note, I was aware of the other Q/A, but I think it only addressed the first question, and it required a bit more info to easily address the system you described. Should have however linked to it, thanks for posting it here. $\endgroup$
    – Maarten Bodewes
    Jan 22, 2022 at 13:37
  • $\begingroup$ Thanks for the edit :) $\endgroup$
    – RobbB
    Jan 23, 2022 at 2:24

1 Answer 1

2
$\begingroup$

At this point, how does the attackers system know it has broken the encryption, especially if it has attempted many previous attempts & at insane speeds? Corollary: how can an attacker know they have decrypted successfully since the decrypted text would look exactly like encrypted text of the next layer of encryption?

It doesn't. But note that to verify that the encryption is broken only takes that the other cipherstream is distinguishable from random. That may be less costly than a full attack that requires decryption. Furthermore, depending on the construction, meet-in-the-middle attacks may be feasible.

Assuming various agencies, countries or hackers, are capable of breaking various encryption techniques, would such a system (from a high level viewpoint, based on question one logic) add any level of security?

Yes, but how much depends on the details. Meet-in-the-middle attacks were already mentioned. However, it could also be that both ciphers have a common structure, which means that if one can be broken then the other might get broken as well. In that case the effort is doubled, if that. If Grover is used for quantum cryptanalysis then we can assume that doubling the number of qubits would get you pretty far from breaking the double-encryption system.

Would reverse engineering by decompiling such a system enable all layers of encryption to be broken easily?

You cannot "decompile" a cryptosystem, that's term is not defined within cryptography. The algorithms are considered known, while the keys are considered secret.

$\endgroup$
2
  • $\begingroup$ Quantum computers cannot break AES-256 this is why NIST doesn't make PQC block cipher call. If the OP fears of the classical broke of AES or ChaCha, then they need triple layers encryption. $\endgroup$
    – kelalaka
    Jan 21, 2022 at 16:39
  • $\begingroup$ Good point kelalaka, my point regarding quantum was meant as a hypothetical statement where encryption was easily broken in whatever way. I could have made that clearer. I will look further into ChaCha and a good multi layer system. @MaartenBodewes, this is very good information. Thank you for the information, this is a good starting point for me. Also I realize my "question three" is null and void as it must always be assumed that security systems will be known to attackers. I would assume any obfuscation & thereafter decompilation time is just an added luxurious time buffer to any attack :) $\endgroup$
    – RobbB
    Jan 22, 2022 at 1:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.