Hashes as mutually independent keys For cascading encryption (ie. AES-Twofish-Serpent), the most secure implementation is with mutually independent keys. My question is if it is secure to hash the previous key for each layer of encryption. In my case, Serpent will be the innermost cipher and AES the outermost.
password = &quot;my_hopefully_secure_password&quot;
masterKey = argon2(password,...)
serpentKey = sha3_256(masterKey)
twofishKey = sha3_256(serpentKey)
aesKey = sha3_256(twofishKey)

ciphertext = aes(twofish(serpent(plaintext,serpentKey),twofishKey),aesKey)

In this case, an attacker would have to attack AES first, since it's the outer shell. Suppose that the attacker successfully found the key to AES and decrypted it. Now the attacker is left with Twofish and Serpent, but the AES key doesn't reveal anything because it's a hash of the Twofish key (hashes are one-way). If the attacker broke Twofish, they still wouldn't know Serpent's key because the Twofish key is only a hash of the Serpent key.
Is this secure?
Edit: Is this secure and does it provide 256-bit security? Would this scheme correctly implement cascading encryption and provide three layers of protection?
The security is considered to be proportional to the size of the keyspace. In your proposal, the keyspace is not increased by adding encryption layers since all keys are derived from a single password.
In the proposed case Hashes are not mutually independent keys since they are derived from a single password. If they are derived from separate password then the algorithm provides three-layered security
Based on the proposal, it can be inferred that the sequence of encryption and the key derivation has to be kept secret for improving security. This is Security through obscurity and is not considered as any stronger. Wiki
If the algorithm is not hidden then cascading encryption with keys derived from the same source is not adding any layers (additional time penalty to brute-force keys at each stage) therefore no better than one layer of encryption, that is the outermost layer.
It provides one layer of encryption with a strength depending on password complexity.