Cascading Encryption Algorithm using mcrypt or GnuGP

Question

I'm trying to a cascading cipher encryption algorithm to encrypt a textfile via mcrypt. I'm essentially trying to emulate the behavior of TrueCrypt, where it can cascade two or three different cipher algorithms when encryption data.

From this website I see that cascading encryption algorithms are a feature of mcrypt.

AES-Twofish-Serpent

Three ciphers in a cascade [15, 16] operating in XTS mode (see the section Modes of Operation). Each 128-bit block is first encrypted with Serpent (256-bit key) in XTS mode, then with Twofish (256-bit key) in XTS mode, and finally with AES (256-bit key) in XTS mode. Each of the cascaded ciphers uses its own key. All encryption keys are mutually independent (note that header keys are independent too, even though they are derived from a single password – see the section Header Key Derivation, Salt, and Iteration Count). See above for information on the individual cascaded ciphers.

However, the command line mcrypt provided from the sourceforge page doesn't seem to have a switch for cascading ciphers.

Is this cascading encryption algorithm option only available through the mcrypt library rather than the command line utility? Furthermore, will encrypting the encrypted file with a new cipher (but same password) be cryptographically the same as the cascading ciphers algorithms?

---

As a side note: the main reason I'm trying to use mcrypt over TrueCrypt is because TrueCrypt has a 64 character limit on the password length. If there is another open source utility without this password length limit, please let me know.

I'm aware that GnuGP doesn't have a 64 character limit, but I'm not sure if it supports cascading cipher algorithms.

Answer 1

There is one mcrypt which is a command-line utility and library for file encryption; and another mcrypt which is completely unrelated, and appears to be a direct rip-off of TrueCrypt, which is an implementation of an encrypted filesystem (and that rip-off might be illegal and/or malicious as well). GnuPG is an implementation of the OpenPGP standard, which covers symmetric encryption, asymmetric encryption and signatures, initially for use with emails. All these software differ quite a lot in offered functionalities, so comparing them together in abstracto makes little sense. You are encouraged to first define (at least for yourself !) what functionality you are looking for, and then, only then, see what product may provide it.

Nevertheless, we can state some things generically. For instance, cascading encryption algorithms is not a very rational feature. Cascading algorithms has any value only on the off-chance that an as yet undefined attack, which transcends our current knowledge on encryption algorithms, is still somehow thwarted by the cascade. It is speculation over speculation; it is like making bets on whether Pope Francis would play the guitar or the drum kit if he decided to switch careers and become a rock star. On the other hand, the overhead implied by cascading algorithms is very real (encrypting twice, that's twice the CPU cost).

Insisting on cascading is usually the sign of misaligned priorities; it is concentrating on phantasmagoric issues which are highly improbable and cannot be quantified anyway, at the expense of much more mundane and actually more serious issues. The same can be said about most "reasons" for oversized passwords: seriously, if you cannot stuff 80 bits of entropy in a 64-character password, then you are doing something very wrong with password generation; and if these 80 bits of entropy are not enough, then your key derivation function sucks. These are the real issues that must be dealt with.