29

This is simply saying that if a cryptosystem has a functional composition that is $$ h_{k}(x) = f_{k_1}(g_{k_2}(x)) $$ then you can find a key for single encryption that works as the double encryption. For example: consider the permutation cipher where a permutation is a key. The permutations are forming a group, named permutation group, under the ...


6

No, If we assume that the mythical computer can brute force the multiple AES encryptions and there are many ciphertexts available which are encrypted under the same key and their corresponding plaintext are not random. The brute-force code can keep track of the meaningful plaintexts for each ciphertext and finally can perform an intersection of possible key ...


4

The answer is we cannot improve the security of the one-time pad in this manner. Intuitively the reason is that the double one-time pad is just a less efficient one time pad. The security of the traditional xor-based one-time pad is requires that the key $K$ is chosen uniformly at random for each message and that the key is at least as large as the message. ...


2

Yes, if you know the key lengths and have a sufficient amount of known plaintext, you can easily recover the keys (or at least something equivalent to them) using linear algebra. How much is "a sufficient amount"? Well, to fully recover all the key characters, you would need to solve as many linear equations as there are characters in all the keys combined,...


2

For the one-time-pad the answer is no, since it already achieves information-theoretic security (meaning that the ciphertext is statistically independent from the plaintext). So, applying it twice doesn’t add any extra security (and may actually worsen security if the second key is not independent from the first).


2

If we presume that the two encryption methods are secure by themselves, then having double encryption will not introduce any weaknesses. Sure, the security of the encryption may be smaller than key size of the keys combined, but if you use two different keys then the security should not be smaller than the key strength of the smallest key used. Of course, ...


2

When you cascade two ciphers with independent keys, $E_{k_1,k_2}\colon x \mapsto \operatorname{AES}_{k_2}(\operatorname{AES}_{k_1}(x))$, the intelligent adversary will use a parallel collision search for a meet-in-the-middle attack at far less than $2^{128}$ or $2^{256}$ times the cost of a search for $k_1$ or $k_2$ alone. So this technique doesn't improve ...


1

I will address the question in the title - double encryption with AES has been addressed in the other answers. As Squeamish Ossifrage pointed out, you do not want in general to rely on the assumption that the adversary cannot verify if a candidate decryption is correct. However, there are situations where you have to. Typically, this is the case when the ...


1

I) There is no minimum. Maximum in your case is $2^{64} * 16$ bytes with same key. II) No. No. GnuPG takes care of that. III) No. Compressing does not weaken encryption. IV) I don't think it matters because it is not authenticated encryption. V) Yes, passphrases must be different. VI) In your case you can get maximally 256-bits of security per cipher. ...


1

Yes, this can improve security, but only against a cryptanalytic advance in the method you used to generate one of $k_1$ and $k_2$. This is known as a cipher cascade, and there is a theorem of Maurer and Massey (paywall-free) that breaking the composition of independent stream ciphers like this is at least as hard as breaking the hardest to break of the ...


1

The intention of a good cipher is to remove all orders and bit arrangements in a plaintext and produce output ciphertext in which there is no distinguishable orders and arrangements obtainable.I mean that the ciphertext should be a uniform distribution. By considering this remark, if we have a good encrypted output(means plaintext which is encrypted with a ...


1

This looks likely a classic server-multiple client scenarios, I had the similar situation: Depend on real application, some of my thought: For most case, IoT devices does not communicate to server at the same time? so server should be able to setup secure key for each of IoT devices through ECDH. To have a common key for all devices looks too dangerous, ...


Only top voted, non community-wiki answers of a minimum length are eligible