> First, ciphertext is ciphertext. They'd probably be able to determine it's a block cipher and what the block size is, but that's about it. They're not going t

> First, ciphertext is ciphertext. They'd probably be able to determine it's a block cipher and what the block size is, but that's about it. They're not going to be able to tell AES ciphertext from 3DES ciphertext if they're both set to use the same block size. There's no point "obscuring" the fact that you're using AES. If you can break a set of ciphers it's trivial to determine which was used for a connection, if one was used; You just try each. The whole point is to hide which is the real cipher to make it more costly to attack you. Making it more costly for the attacker is what we want. > Second, (...) This is no argument for or against the scheme I presented. > Even quantum algorithms are only able to halve the bits of the key search space (so 2^256 will become 2^128, which is still mostly infeasible even against a government adversary). Breaking a cipher means to not have to search all the key space. That's the definition of a broken cipher. > I don't think your suggestion would decrease security, if implemented perfectly (which is unlikely), even if the cipher is insecure and vulnerable to cryptanalysis. But I don't think it would increase security either. And since it wouldn't increase it, yet may decrease it in practice due to an implementation flaw which compromises both ciphers, why bother? We disagree on the practicality of implementing it without adding another vulnerability to your system.