Is TrueCrypt's multiple/cascading encryption safe? Is TrueCrypt use of cascading encryption safe?  Is it useful?  TrueCrypt is arguably one of the most popular and widely used encryption applications in use today, yet it seems to use a very unconventional scheme.  

The software offers cascading encryption, where the user can specify either double or triple encryption using any combination of AES, Twofish, and Serpent.  Unusually, multiple-encryption is performed on each block, before moving on to the next block, as opposed to encrypting all the data and then encrypting the resulting ciphertext.

After having spent a lot of time reading through crypto.se, the consensus seems to be that multiple/cascading encryption offers little (or perhaps no) extra security, and some even argue that if may be weaker than just following a standard protocol (although the latter rarely seems to be substantiated by any reasoning).  However, in Bruce Schneier's Applied Cryptography (considered by many to be a quintessential text on cryptography), he advocates the use of multiple encryption (albeit cautiously, and with some caveats).  See sections: 15.7 Cascading Multiple Block Algorithms, 15.8 Combining Multiple Block Algorithms, and 17.11 Cascading Multiple Stream Ciphers.

Another example of going against this consensus would be the Tahoe-Lafs 100 Year Cryptography Project, which has been recommended on crypto.se. Their protocol involves encrypting with AES in CTR mode and then encrypting the output with XSalsa20. 

So my question is, is TrueCrypt's use of multiple/cascading cryptography reasonable, and why?
Cascading cipher gives a sense of security; and one that is technically justified with respect to the possibility that a weakness in one of the cipher would allow recovering the encrypted data. That's Bruce Schneier's argument, and it made sense in an era where DES, the then leading cipher, was a closed design, clearly deliberately weakened by a small key, giving rise to the fear that is was also deliberately weakened otherwise (which turned out not to be the case).

On the other hand, the more serious threats facing systems like TrueCrypt are not a weakness of the cipher; they include compromise of the software, compromise of the hardware running the software, compromise of the key (by eavesdropping, guess of the passphrase, rubber hose cryptanalysis, recovery from hibernation file or RAM memory..), analysis of changed sectors.. These risks are hard to mitigate, and in the opinion of many (including me), much more likely to materialize than cryptanalysis of AES, for at least decades even if we consider AES-128. And further, technological progress likely will enable a guess of the passphrase by brute force sooner than a cryptanalysis of AES.

Cascading ciphers has at least one obvious drawback: performance is lowered. Often it matters, sometime it does not, e.g. when enciphering a key. In my opinion, compared to AES, cascading might only improve practical security by a side effect: making it harder to verify a guess of the passphrase (that would be the case in a system where the only way to check such guess is to turn the passphrase into keys, decipher something using the cascade of ciphers, and check that it makes sense).

So all in all, I would think of cascading a cipher in addition to AES only as a way to damp paranoia or indicate an extra level of care, like telling to someone knowing little about cryptography: for the cold storage of your all-important master keys, you could use a Truecrypt volume on a USB stick, perhaps even with cascaded ciphers; and most importantly, strive for the integrity of all the hardware and software used!



Addition following comment asking how to do cascading (of block ciphers) properly. My answer to that would be that if one uses cascading:


That might be considered in the key-stretching phase (turning the user's passphrase into the key of the bulk cipher), where cascading is useful, because it makes construction of a device that successfully brute-force passphrases significantly harder/more expensive/less likely. Cascading is useful in key stretching because when a cascade of encryptions is iterated, a fast implementation must be fast on each of the cascaded ciphers, which is a very serious problem in a password cracker using ASIC or FPGA; search FPGA password for some interesting links. Beware however that speed optimization of the legitimate implementation for each of the cascaded cipher iterated in the key-streching phase is important for security (because we need to push the number of iterations as high as feasible), when it is immaterial to security in the bulk-encryption phase.
At least the first cipher in the cascade (the one in contact with the plaintext during bulk encryption, or to a lesser degree the one in contact with the passphrase during key stretching) should be implemented in a manner protecting from any likely side-channel attacks, including timing and unwanted emissions (for an illustration of that later danger in a slightly different context, see this).
When the key must be secret (in particular the key used for bulk encryption), the cascaded ciphers positively must use different keys (e.g. extracted from a wide derived key); otherwise using a cascade could well turn out to enable an attack if any of the ciphers turns out to leak its key through a side channel.


Truecrypt's use of cascaded ciphers definitely follows 3; I can't tell for 2, and the most important 1.