2
$\begingroup$

This is a beginner's question related to general security, but it fits cryptography exchange because it's more specific to the action of cryptographic attacks and how they work.

Assume the following theoretical situation:

  1. I do not know how attacks of all types work programmatically. From the aspect of this question, assume theoretically (hypothetical quantum computing algorithm for example) there is a working attack against AES that can break it or any encryption by whatever means.

  2. BUT we've "double encrypted" our data with two separate symmetric algorithms by means of hybrid encryption. We've also NOT sent keys with the initial message but by some other secured channel.

  3. Attacker (after however many attempts, by whatever means) guesses the correct key for the first layer of encryption and successfully decrypts the first layer.

Questions:

  1. At this point, how does the attacker's system know it has broken the encryption, especially if it has attempted many previous attempts & at insane speeds? Corollary: how can an attacker know they have decrypted successfully since the decrypted text would look exactly like the encrypted text of the next layer of encryption?

  2. Assuming various agencies, countries, or hackers, are capable of breaking various encryption techniques, would such a system (from a high-level viewpoint, based on question one logic) add any level of security?

  3. Would reverse engineering by decompiling such a system enable all layers of encryption to be broken easily?

Improve this question
$\endgroup$
3
  • $\begingroup$ I would also like to add a resource to this question as I believe that it can be somewhat resourceful even though a close duplicate. I found the below link after asking my question which adds to answers. It is borderline duplicate but I think my viewpoint was slightly different and I got a good answer here which sheds some more light on the situation. Resource - "Breaking double encryption" $\endgroup$
    – RobbB
    Commented Jan 22, 2022 at 1:58
  • $\begingroup$ Links to questions and answers are not considered answers themselves, so I converted this answer to a comment. Small note, I was aware of the other Q/A, but I think it only addressed the first question, and it required a bit more info to easily address the system you described. Should have however linked to it, thanks for posting it here. $\endgroup$
    – Maarten Bodewes ♦
    Commented Jan 22, 2022 at 13:37
  • $\begingroup$ Thanks for the edit :) $\endgroup$
    – RobbB
    Commented Jan 23, 2022 at 2:24

1 Answer 1

Reset to default
3
$\begingroup$

At this point, how does the attackers system know it has broken the encryption, especially if it has attempted many previous attempts & at insane speeds? Corollary: how can an attacker know they have decrypted successfully since the decrypted text would look exactly like encrypted text of the next layer of encryption?

It doesn't. But note that to verify that the encryption is broken only takes that the other cipherstream is distinguishable from random. That may be less costly than a full attack that requires decryption. Furthermore, depending on the construction, meet-in-the-middle attacks may be feasible.

Assuming various agencies, countries or hackers, are capable of breaking various encryption techniques, would such a system (from a high level viewpoint, based on question one logic) add any level of security?

Yes, but how much depends on the details. Meet-in-the-middle attacks were already mentioned. However, it could also be that both ciphers have a common structure, which means that if one can be broken then the other might get broken as well. In that case the effort is doubled, if that. If Grover is used for quantum cryptanalysis then we can assume that doubling the number of qubits would get you pretty far from breaking the double-encryption system.

Would reverse engineering by decompiling such a system enable all layers of encryption to be broken easily?

You cannot "decompile" a cryptosystem, that's term is not defined within cryptography. The algorithms are considered known, while the keys are considered secret.

Improve this answer
$\endgroup$
3
  • $\begingroup$ Quantum computers cannot break AES-256 this is why NIST doesn't make PQC block cipher call. If the OP fears of the classical broke of AES or ChaCha, then they need triple layers encryption. $\endgroup$
    – kelalaka
    Commented Jan 21, 2022 at 16:39
  • $\begingroup$ Good point kelalaka, my point regarding quantum was meant as a hypothetical statement where encryption was easily broken in whatever way. I could have made that clearer. I will look further into ChaCha and a good multi layer system. @MaartenBodewes, this is very good information. Thank you for the information, this is a good starting point for me. Also I realize my "question three" is null and void as it must always be assumed that security systems will be known to attackers. I would assume any obfuscation & thereafter decompilation time is just an added luxurious time buffer to any attack :) $\endgroup$
    – RobbB
    Commented Jan 22, 2022 at 1:54
  • $\begingroup$ The closest you can get to a secure obfuscation technique is white-box cryptography, but as you may have guessed: that's a game where the goal posts are consistently drawn backwards making it harder to score a goal. Expert knowledge is required but even then the best techniques get broken. $\endgroup$
    – Maarten Bodewes ♦
    Commented Dec 14, 2024 at 14:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.