Cool. I have to think about this some more and see if I can
   provide you with a proof either way, but for now you're right. I am
   operating entirely on conventional wisdom. That is not sound. My
   assumption here (offered for your opinion) is that provided a working
   knowledge of the actual ciphers and a copy of the key (compromised
   through a weakness in one of the ciphers), that I could use that same
   key, along with the respective decryption algorithms, to completely
   unravel all of the encryption. Granted, step-by-step analysis would
   almost definitely not include plaintext related attacks (as deciphered
   text from one algorithm simply results in unobfuscated text resulting
   from the previously implemented cipher), but my knee-jerk reaction here
   is to think that if one could compromise the last cipher applied and
   derive the key, then the entire scheme would be blown. If this is the
   case, then the strength of the entire cipher is only as strong as it's
   weakest link. On the other hand, I would think that some chain of
   ciphers that all used different keys (preferably not derivative) would
   seem stronger to me. At any rate, please keep me posted on your
   thoughts.

   ok,
   Rush Carskadden

   -----Original Message-----
   From: Arnold G. Reinhold [[1]mailto:reinhold@world.std.com]
   Sent: Friday, October 27, 2000 3:20 PM
   To: Carskadden, Rush; Damien Miller
   Cc: John Kelsey; Bram Cohen; cryptography@c2.net;
   cypherpunks@cyberpass.net
   Subject: RE: Paranoid Encryption Standard (was Re: Rijndael & Hitachi)

   At 1:00 PM -0500 10/27/2000, Carskadden, Rush wrote:
   >Are you guys still talking about the feasibility of a cipher that
   >implements each AES candidate in turn with the same key? I don't
   >really get this idea. Provided you were actually using the same key
   >with each stage of the encryption, then your system is only gong to
   >be as secure as the key of the first algorithm. In fact, it seems
   >that if the key is compromised at any one point, then the entire
   >system is shot, given that you know the algorithm (Kerckhoff's
   >principle IIRC). Maybe I am misunderstanding.
   >

   That is the theoretical question that I am asking. What you say
   appears to be the conventional wisdom, and I am claiming that it is
   wrong.  As long as there is some way to make sure that none of the
   ciphers in a chain are inverses of the others, or close to an
   inverse, in some sense, then I claim as long as one of the ciphers is
   strong, there is no way to get any information out about the keys
   from the other ciphers, even if they are all designed to reveal that
   information.

   As a practical matter, you may as well derive the sub keys from the
   master key using a one-way hash, but I am questioning the theoretical
   justification for doing that.  Massey and Maurer base their paper on
   oracles that give you the key for all component ciphers but one. I am
   saying such oracles cannot exist if one of the ciphers is strong and
   "inverses" of the strong cipher are excluded.

   Arnold Reinhold

References

   1. mailto:reinhold@world.std.com