7 ms·

I really don't understand why people don't just use a counter-based cipher. Like whichever one is the one where you start with a random IV, generate an infinite

I really don't understand why people don't just use a counter-based cipher. Like whichever one is the one where you start with a random IV, generate an infinite pseudorandom string from it, xor it with your data & its hash. Bonus points if you do this with multiple ciphers and xor them. Why is this not popular?

minitech 3y ago
> Why is this not popular? If you meant using a counter-based cipher: it is. GCM is the most popular mode on the modern internet, for example. If you meant using multiple ciphers: because it adds overhead without adding security.
- SAI_Peregrinus 3y ago
  Of note: cascading ciphers is, in general, at most as secure as the first cipher. The rest add nothing. For additive stream ciphers (like CTR mode) it's as secure as the most secure cipher instead.
  - deleted 3y ago
    [deleted]
  - n2d4 3y ago
    I think you made a typo, "at most as secure" should be "at least as secure" :) But you're right, the important takeaway here is that encrypting with a weak and a strong cipher sequentially may be less secure than just using the strong cipher. For those to which this seems counterintuitive, here is the paper that shows this result: https://link.springer.com/article/10.1007/BF02620231 https://link.springer.com/article/10.1007/BF02620231
    - magicalhippo 3y ago
      Would be a fun plot twist in a Bond-like movie. Baddies have used multiple encryption algorithms like an onion, which due to this issue can be broken rather easily by the good guys. "Good thing they didn't know about this issue and put the weak cipher first..."
    - SAI_Peregrinus 3y ago
      Correct, should have been "at least".
- dataflow 3y ago
  How does it not add security? It forces attackers to break every cipher instead of just one. That doesn't add security?
  - thadt 3y ago
    In theory - yes, multiple ciphers are harder to break. In practice, we have zero examples of anyone breaking (good) modern ciphers, and lots of examples of people breaking clever constructions involving those ciphers.
Retr0id 3y ago
The scheme you describe (as-is) is not authenticated, compared to something like OCB (mentioned in a sibling comment). Xoring multiple ciphers together doesn't achieve anything especially useful.
- dataflow 3y ago
  Are you saying the hash I mentioned doesn't prevent tampering? And I thought xoring them forces attackers to have to break all of the ciphers instead of just one. That seems pretty useful.
  - Retr0id 3y ago
    If you hashed the plaintext, you leak information about the plaintext, and depending on the hash it's vulnerable to length extension attacks. If you hashed the ciphertext then anyone can re-hash a modified version. What you're looking for is a HMAC, which works, but it's usually slower than a block mode that integrates authentication functionality (like OCB, or GCM). It's true that you'd have to break all the ciphers, but we're generally very confident about the security of our symmetric ciphers, so unless you're very paranoid it's just a waste of clock cycles,
    - dataflow 3y ago
      I think you misunderstood what I wrote. What I said was you finish off by hashing the plaintext and xoring it with the final chunk of your random stream. So you're not sending over the hash itself, but the encryption of it. I don't buy the confidence thing but sure.
      - Retr0id 3y ago
        This violates the Cryptographic Doom Principle https://moxie.org/2011/12/13/the-cryptographic-doom-principle.html https://moxie.org/2011/12/13/the-cryptographic-doom-principl...
        3y ago

minitech 3y ago

> Why is this not popular? If you meant using a counter-based cipher: it is. GCM is the most popular mode on the modern internet, for example. If you meant using multiple ciphers: because it adds overhead without adding security.

SAI_Peregrinus 3y ago
Of note: cascading ciphers is, in general, at most as secure as the first cipher. The rest add nothing. For additive stream ciphers (like CTR mode) it's as secure as the most secure cipher instead.
- deleted 3y ago
  [deleted]
- n2d4 3y ago
  I think you made a typo, "at most as secure" should be "at least as secure" :) But you're right, the important takeaway here is that encrypting with a weak and a strong cipher sequentially may be less secure than just using the strong cipher. For those to which this seems counterintuitive, here is the paper that shows this result: https://link.springer.com/article/10.1007/BF02620231 https://link.springer.com/article/10.1007/BF02620231
  - magicalhippo 3y ago
    Would be a fun plot twist in a Bond-like movie. Baddies have used multiple encryption algorithms like an onion, which due to this issue can be broken rather easily by the good guys. "Good thing they didn't know about this issue and put the weak cipher first..."
  - SAI_Peregrinus 3y ago
    Correct, should have been "at least".
dataflow 3y ago
How does it not add security? It forces attackers to break every cipher instead of just one. That doesn't add security?
- thadt 3y ago
  In theory - yes, multiple ciphers are harder to break. In practice, we have zero examples of anyone breaking (good) modern ciphers, and lots of examples of people breaking clever constructions involving those ciphers.

Retr0id 3y ago

The scheme you describe (as-is) is not authenticated, compared to something like OCB (mentioned in a sibling comment). Xoring multiple ciphers together doesn't achieve anything especially useful.

dataflow 3y ago
Are you saying the hash I mentioned doesn't prevent tampering? And I thought xoring them forces attackers to have to break all of the ciphers instead of just one. That seems pretty useful.
- Retr0id 3y ago
  If you hashed the plaintext, you leak information about the plaintext, and depending on the hash it's vulnerable to length extension attacks. If you hashed the ciphertext then anyone can re-hash a modified version. What you're looking for is a HMAC, which works, but it's usually slower than a block mode that integrates authentication functionality (like OCB, or GCM). It's true that you'd have to break all the ciphers, but we're generally very confident about the security of our symmetric ciphers, so unless you're very paranoid it's just a waste of clock cycles,
  - dataflow 3y ago
    I think you misunderstood what I wrote. What I said was you finish off by hashing the plaintext and xoring it with the final chunk of your random stream. So you're not sending over the hash itself, but the encryption of it. I don't buy the confidence thing but sure.
    - Retr0id 3y ago
      This violates the Cryptographic Doom Principle https://moxie.org/2011/12/13/the-cryptographic-doom-principle.html https://moxie.org/2011/12/13/the-cryptographic-doom-principl...
      - 3y ago