Some cryptographers, like Matthew Green of Johns Hopkins University, say multiple encryption addresses a problem that mostly doesn't exist: Modern ciphers rarely get broken... You’re far more likely to get hit by malware or an implementation bug than you are to suffer a catastrophic attack on AES.However, from the previous quote an argument for multiple encryption can be made, namely poor implementation.
Its good security policy never to provide the same data in both plaintext and ciphertext when using the same key and IV.
Therefore, its recommended (although at this moment without specific evidence) to use separate IVs for each layer of encryption.
This is the case when the first layer is a program P that always adds the same string S of characters at the beginning (or end) of all ciphertexts (commonly known as a magic number).
To prevent this kind of attack, one can use the method provided by Bruce Schneier:[1] A cryptanalyst must break both ciphers to get any information.
The Rule of Two is a data security principle from the NSA's Commercial Solutions for Classified Program (CSfC).
This way if one components is compromised there is still an entire layer of encryption protecting the information at rest or in transit.
The figure shows from inside to outside the process of how the encrypted capsule is formed in the context of Echo Protocol, used by the Software Application GoldBug Messenger.
[citation needed] Third layer of the encryption: Then, this capsule is transmitted via a secure SSL/TLS connection to the communication partner