First of all a couple of things: I am aware that cascade encryption tries to solve a problem that isn't present often. Attacks are more likely to be mounted against implementation details instead of creating a pure cryptoanalytic break on modern crypto.
I am also aware that cascade encryption has at least the security of the inner layer/first cipher of the cascade. This question asks about the case when the inner layer is insecure against the adversary and the designer of the cascade does not know which block cipher in the cascade is secure.
Finally, I am aware that one can combine the usage of multiple block ciphers by either using the block ciphers to encrypt random pads that then are combined used to encrypt the plaintext or by using them as keystream generators(ie run the block ciphers in CTR mode on all zero plaintext) which are then combined to encrypt the plaintext.
- The designer of the cascade is given a set of N block ciphers.
- Cascade construction is as follows: \begin{equation} \text{Enc}_1\left(\text{Enc}_2\left(\ldots \text{Enc}_N(p,k_N),k_2\right),k_1\right) \end{equation}
- Each encryption layer is a block cipher that appears IND-CCA2 secure to everyone(Except for the situation in point 3).
- The adversary has attacks against all but one block cipher that can be composed together. For example, assuming that \begin{equation}\text{Enc}_1(p,k_1)\end{equation} \begin{equation}\text{Enc}_2(p,k_2)\end{equation} are attackable by the adversary, \begin{equation}\text{Enc}_1(\text{Enc}_2(p,k_2),k_1)\end{equation} \begin{equation}\text{Enc}_2(\text{Enc}_1(p,k_1),k_2)\end{equation}are also attackable. Also note that this means one of the block ciphers in the cascade is IND-CCA2 secure against even the adversary. It is unknown which one of the block ciphers is this one however.
- The secure block cipher in the set of block ciphers used in the cascade does not form a group in any possible cascade with the other block ciphers.
- All keys are random and independent.
- For this question assume that mode of operations are out of scope. The plaintext is exactly the size of the block cipher's block size and all of the block ciphers share the same block size.
- Also assume that side channel attacks are out of scope. If the implmentation is vulnerable to an exploit or timing side channel or the adversary has direct physical access, all bets are off anyways.
What happens to the security of the cascade encryption scheme? Does the attacker get the ability to attack the entire scheme IND-CCA2 wise despite the inclusion of the one secure block cipher somewhere in the cascade? Does the security only merely degrade(IE there is some special attack akin to meet in the middle) relative to the secure block cipher by itself? Or is the security of the cascade equivalent to the security of the strongest block cipher in the cascade?
From what I've been able to find on the internet, it isn't very clear what happens to the security of the cascade in this specific context.
