Live data from Hacker News

Any disadvantages of using multiple encryption algorithms on same data?

news.ycombinator.com

11–13 of 13 posts

Re: Any disadvantages of using multiple encryption algorithms on same data?

#11
post #2

Another example of "roll your own crypto". Just don't. Honestly, just stick to one algorithm and use that. Choose something modern. There is no evidence that AES-256 has problems. CBC mode allows some alteration of the plaintext but it's limited and noticeable, best to include an integrity check (HMAC or CMAC). You really don't want to encrypt bulk data using RSA, it's simply not designed for that.

One of the stories at the beginning of Volume 2, of The Art of Computer Programming tells of Knuth's early attempt to generate random numbers.

It's a story of a clever kid, relying on intuitions and getting it wrong, because it's mathematics.

Thus he devotes one of his twelve chapters entirely to random numbers.

Unfortunately, it is well established by internet forums that nobody should read Knuth.

Re: Any disadvantages of using multiple encryption algorithms on same data?

#13
post #4

It will be slower to encrypt and decrypt, and a bit more complicated due to the multiple layers and managing the keys to encrypt and decrypt it all. There's no disadvantage in terms of algorithmic secrecy.

I agree. There are various complexity downsides (implementation, key management, etc) but it should be fine from a practical cryptographic security perspective.

While I can't offer you a formal cryptanalysis, I do have a handwave-y thought experiment & proof by contradiction for intuition:

Consider two encryption algorithms A[...] and B[...] that are "good" in the standard ways (adversary cannot decrypt messages without keys, keys cannot be leaked by chosen plaintext attack, etc).

If putting A inside of B like B[A[...]] renders the system insecure, it would imply that B[...] was not a "good" encryption function! (if it was good, it would not break just because the input message happens to be the output of A[...]).

Therefore by handwave-y proof by contradiction, if A[...] and B[...] are "good", then A[B[...]] should be OK.

(Disclaimer: Again, this is a casual thought experiment and not real cryptanalysis. This result may not be true under formal cryptanalysis.)

Post reply on HN