Which between the two encryption algorithms AES(Twofish(Serpent)) and Serpent(Twofish(AES)) is most secure and which hash algorithm to use between SHA-512, Whirlpool, SHA-256 , and Streebog?

  • I would only use SHA-512 for the hash, and would ditch the Serpent cascade because it is too slow Sep 28, 2017 at 5:17
  • 4
    TL;DR, it doesn't matter. If someone really wants the contents of your drive, they're more likely to beat the password out of you, use a keylogger or camera to get the password, steal the device while it's unlocked, or one of a million other meatspace methods rather than bothering with anything cryptanalytic. Relevant xkcd.. I personally would simply use AES/SHA-512 — chaining incurs a severe performance penalty for negligible security benefit, and SHA-512 is likely to perform slightly faster on a 64-bit processor given typical file sizes. Sep 28, 2017 at 5:28

3 Answers 3


As Stephen Touset already answered: The Algorithm might not be as important as you think.

The only way you would want several algorithms at once is longterm security. So your bet is: One of them will be broken some day and the others maybe won't. By theory thats a good way to go. But you might face several issues with it. Some of them are possibly:

  • Size of the encrypted information
  • Runtime Performance

I suggest you have a look at 'cascade encryption' e.g. at wikipedia or read something Bruce Schneier wrote about it. In case you decide to only have one layer of encryption: Use AES ( at least if you encrypt your OS). Because AES is so widely used it has been implemented as an extension to the x86 instruction set architecture used in INTEL and AMD processors. This means you can do it at almost no time cost and (assuming you wont change the number of rounds and so on) AES-256 is really a practically secure thing (afaik).

Just make sure you use a secure password ( > 30 chars, possibly random) and dont fiddle around with algorithm settings (but I'm not even sure veracrypt will let you).

Since @jondoe666 is pretty right in his criticism of my post this shall make it a little more complete:

Yes. For most of the things I wanted to do, AES was pretty sufficient. If your case requires some extra security feel free to apply as much extra layers as you want. Concerning the performance: Of course the tradeoff is performance for encryption. If you choose to encrypt using multiple layers your CPU will have to do more cycles for every de-/encryption than it has to cycle for just one layer. The question is not if it gets slower the question is: Will I notice. And for the poor Thinkpad I am currently using the answer is: YES. I do notice.

But since you asked:

And what would you personally use?

Thats it. I don't really care about the Hashes (unless you're trying to use SHA1 or MD5). I really prefer SHA-256 over SHA-512 but just because I think it is sufficient. Might really depend on your level of paranoia as well as what you have read about the other options.

  • 1
    Runtime performance ? Performance penalties? Really? In 2017, our processors are fast enough till the point it is negligible, and extra security is cheap, why not just use the maximum security settings possible? I should have also mentioned what I currently use: AES(Twofish(Serpent)) + Whirlpool + maximum allowed 63 characters randomly generated using pwgen for windows + 500 PIM rounds and I don't notice any performance penalties, it is super fast as if nothing, so what's all this stuff about performance penalties?
    – johndoe666
    Sep 28, 2017 at 7:05
  • So you're all saying that AES alone with a long and strong randomly generated password is sufficient for all practical purposes? What about the hash algorithms? Is the whirlpool I'm using a strong one?
    – johndoe666
    Sep 28, 2017 at 7:11

AES-256 is both very fast and very secure. If your processor supports it (nearly all do), then why settle for AES-128, which is only marginally faster but 3.4x10^38 times weaker?

Yes, using triple encryption (AES(Twofish(Serpent)) and Serpent(Twofish(AES))) are measurably more secure, but not as much as people might think, as brute-force attacks bypass the encryption while focusing on the 256-bit encrypted file itself. The first two layers of triple-encryption significantly increases the randomization of the volume before the final solution, giving you some additional peace of mind, but both are much slower than AES-256 by itself. Meanwhile, AES-256 and its 1.15792x10^77 solutions has not been cracked for the last 22 years. If you don't mind the wait, or subscribe to the "they might crack one, but not all" theory, as I do, then by all means, use triple encryption. Just realize it, too, has the same 1.15792x10^77 solutions as AES-256 and all other 256-bit encryption.

Hash: SHA-512 is the fastest fully-secure option for AES-256. With a 1024-bit block size and 80 rounds of mod 2^64, SHA-512 is vastly more complex than SHA-256's 512-bit block size and 64 rounds of mod 2^32.

Addendum: SHA-256 has NO security against length extension attacks, whereas SHA-512/256 has 256 bits of security against them. Depending on the variant, SHA-512 is between the same and upwards of 50% faster than SHA-256 on 64-bit processors. Based on this information, the only rational answer is to ditch SHA-256 and use SHA-512. The only conceivable reason one might logically prefer SHA-256 is if they were using a 32-bit processor, speed was paramount, and they implemented another means of securing against length extension attacks.

  • This answer is a bit rambling and goes off into tangential advice that has nothing to do with the question that was asked. Please make sure that answers are on point.
    – schroeder
    Aug 15, 2023 at 8:14
  • The intent of the question was to build the best security possible.
    – Grid77
    Sep 3, 2023 at 23:27
  • The intent of the answer was to be complete so as to avoid patchwork quilt solutions. Incomplete answers lead to patchy solutions. Very undesirable! Ergo, not "rambling" or "tangential," but rather, fully answers the question.
    – Grid77
    Sep 3, 2023 at 23:29
  • This isn't "fully answered", this is addressing multiple things that aren't relevant. Please make sure that answers are on point. Take a look around the community to get a sense for what good answers looks like so you don't end up wasting time on rambling answers.
    – schroeder
    Sep 4, 2023 at 7:16

The performance hit is only seen while booting and not while using it.

I use AES(Twofish) on my work OS on the same laptop and it slows booting to around 3 to 4 minutes as I have an i3 processor. I am willing to trade fast boot for security. I can wait 4 minutes and then start working securely.

Also, if you use PCI Express, the tradeoff will be very minimal--undetectable even while booting.

  • 1
    This is incorrect, performance would be affected whenever reading or writing from/to the device. Jun 1, 2018 at 14:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .