Order of cascaded ciphers Does the order of a block cipher cascade (e.g. in TrueCrypt) make a difference to the security provided, assuming independant keys?

For example:

Plaintext -&gt; Rijndael -&gt; Serpent -&gt; 3DES -&gt; Ciphertext
Plaintext -&gt; 3DES -&gt; Serpent -&gt; Rijndael -&gt; Ciphertext


The same ciphers, just ordered differently.

My intuition says no, and that the security will be at least that of the strongest cipher, but I can think of a few situations (e.g. timing attacks) where this might make a difference. I can't think of a concrete case where you could exploit this ordering, though.
Yes, order of ciphers would matter in some practical scenarios, in particular if an adversary can subject the implementation to a DPA attack.

Consider the scenario where the same plaintext is encrypted several times using the same key, using some chaining mode other than ECB, a random IV, and the cipher in contact with the plaintext (on either the encrypting or decrypting side) is vulnerable to DPA. The known random IV allows recovering that cipher's key using standard DPA, and then a slight variant of DPA allows recovering the plaintext in all the subsequent blocks. It does not matter how the various ciphers are keyed, the plaintext can be short, but the key (of the attacked cipher) must be reused in many sessions.

Contrast that with the case where the cipher in contact with the plaintext is DPA-protected. Perhaps the others (in particular, the one in contact with the ciphertext, which is most exposed) can be broken, but (since the keys are independent), protection of the confidentiality of the plaintext remains at least as good a that of the cipher in contact with the plaintext.



Conclusion: if you must cascade block ciphers using truly independent keys for some reason (I can imagine an order from high-up, e.g. regulatory), and DPA is an issue, you want to put the one you are most confident with in contact with the plaintext. However if the ciphers share their key, that's the other way around: you likely want to put the most trusted one at the most exposed place, which is in contact with the ciphertext.

Update following Hunter's question: A situation where ciphers share their key would be a cascade of 3DES-CBC with 192-bit key (168 used), followed by AES-192, using the same 192-bit key for the two ciphers (a very poor choice when DPA attacks matter). Truly independent keys are chosen independently and randomly. Derivation from a single master key using a strong KDF is also fine if performed out of the reach of an attacker, assuming in particular no side-channel attack such as DPA can be mounted on the KDF. 

Note: if the first encryption scheme in a cascade leaks information about the plaintext through the length of the ciphertext (e.g. has a built-in compression scheme), then the cascade might not be secure (as pointed in this comment to a related question). That does not apply in the context of the question, though.