7

I mean: does encrypting data multiple times have an effect on diffusion and confusion? Does it increase security, or does it have no effect? Is it useless? Does it make it harder to break the secret, or not?

Improve this question
1
  • 2
    ROT13 should never be used an even number of times.
    – emory
    Apr 28, 2015 at 22:34

1 Answer 1

Reset to default
10

Yes, multiple layers of encryption using different algorithms and different keys make the encryption as hard as the hardest in the chain.
IIRC this was adressed in Bruce Schneier's book Applied Cryptography (2nd edition).

But the important part is to use different algorithms, or at least different keys. Algorithms that use "round keys" are often optimized for a number of rounds. Using the same key will not necessarily make the message harder to break, and can theoretically make it easier.

A nice example is Triple-DES. Encrypting a message, then encrypting it again with a different key was vulnerable to meet-in-the-middle attack and effectively added only 1 bit of key space. Instead, it was found that one had to encrypt a message, then use the decryption algorithm but with a different key, then encrypt it again.
Even with 3 independent 56-bit keys, the effective key size is 112 bits as it is vulnerable to a meet-in-the-middle attack (source: Wikipedia).

So the strongest way is to use different keys and different algorithms.

Improve this answer
5
  • 1
    yes there is a chapter about multi-encryption in Applied Cryptography. Schneiers states there that double encryption doesn't do a lot of good (+1 bit due to meet-in-the-middle). He also states that EDE is quite a nice choice, as it doubles the margin. (both for multiple applications of a single cipher)
    – SEJPM
    Apr 28, 2015 at 15:51
  • 3
    Citation (p. 367): "Using a chosen-plaintext attack, a cascade of ciphers is at least as hard to break as any of its component ciphers." and "Only if the algorithms commute, as they do in the case of cascaded stream ciphers (or block ciphers in OFB [+CTR mode, which is considered an OFB variant in this book, added by me] mode), is the cascade at least as strong as the strongest algorithm"
    – SEJPM
    Apr 28, 2015 at 15:54
  • 1
    The meet in the middle attack works on Encrypt-Decrypt as well; you need three layers to get twice as much security.
    – Max
    Apr 28, 2015 at 18:41
  • 1
    I thought the choice of decryption for the second step in 3DES was for backward compatibility with regular DES - set all 3 keys to the same value, and the result is the same as if you just used DES. Encrypting 3 times would have been equally secure.
    – user2357112
    Apr 28, 2015 at 23:59
  • Also, wouldn't the same meet-in-the-middle attack against 2DES work against a scheme that used two different algorithms? The importance of different keys is obvious - using the same key for each encryption doesn't increase the amount of keyspace to search - but the use of different algorithms doesn't seem to be important.
    – user2357112
    Apr 30, 2015 at 0:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .